Edit tour

Windows Analysis Report
https://ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top/u/hs-schmalkalden.de

Overview

General Information

Sample URL:	https://ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top/u/hs-schmalkalden.de
Analysis ID:	1525217
Infos:

Errors URL not reachable

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3640 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3436 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2164,i,3349396247227516795,7502699321134445247,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4816 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top/u/hs-schmalkalden.de" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown

HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49715 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.5:60271 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 60277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 60275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60282
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60280
Source: unknown	Network traffic detected: HTTP traffic on port 60281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60279
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60274
Source: unknown	Network traffic detected: HTTP traffic on port 60284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60295 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60293
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60291
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60285
Source: unknown	Network traffic detected: HTTP traffic on port 60292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60284
Source: unknown	Network traffic detected: HTTP traffic on port 60289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60283
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60295
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60294
Source: unknown	Network traffic detected: HTTP traffic on port 60293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60285 -> 443

Source: unknown

HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49715 version: TLS 1.2

Source: classification engine

Classification label: unknown1.win@19/6@17/3

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2164,i,3349396247227516795,7502699321134445247,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top/u/hs-schmalkalden.de"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2164,i,3349396247227516795,7502699321134445247,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
google.com	142.250.185.174	true	false	unknown
www.google.com	142.250.184.228	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	unknown	unknown	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved		unknown	unknown	false
142.250.184.228	www.google.com	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525217
Start date and time:	2024-10-03 21:41:29 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top/u/hs-schmalkalden.de
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	UNKNOWN
Classification:	unknown1.win@19/6@17/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	URL browsing timeout or error

Errors

URL not reachable

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.16.195, 142.250.186.142, 108.177.15.84, 34.104.35.123, 184.28.90.27, 4.175.87.197, 93.184.221.240, 192.229.221.95, 13.95.31.18, 13.85.23.206, 20.3.187.198
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, e16604.g.akamaiedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, azureedge-t-prod.trafficmanager.net, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top/u/hs-schmalkalden.de

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 18:42:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9738137100442312
Encrypted:	false
SSDEEP:	48:83WdGTim7HzidAKZdA19ehwiZUklqehAy+3:8D7p/y
MD5:	38CD7B81351D0192D743841AA40AF364
SHA1:	44F45CF8FAAB4DC0C71082F415D2D823DFB586FC
SHA-256:	DDC6AA18CCB96CC0CF32A2929A1C4B6B1D741C4A964388DD4F483C1182ECD956
SHA-512:	1C98EF01DBFDC1D955E98F8F98EAE4BACD36C493E485DE628DF92713C53BAD23956652703BCE3257B3A722624A4A6AFF6CA771E57ED7029E64F1EF3A3DB59D25
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....e._....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ICYL.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCYL.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCYL.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCYL............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VCYM............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y.N.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 18:42:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9915628352629935
Encrypted:	false
SSDEEP:	48:8ydGTim7HzidAKZdA1weh/iZUkAQkqehvy+2:8f779Qay
MD5:	2F5B7124EB0DAB511D62341529F85B4E
SHA1:	76C0C60D366DA16E233E1DF875AB9797081A0B16
SHA-256:	6765743A0A19EB381428061C908DF443FA9DD7C32D22BF50EBA4AAC0A1AFC142
SHA-512:	DC1D1D00D46E082DE5335AC0F4248794460C8A1593F0D9D17DD8FA1CC776A3E4A275EE773493F4005C1CE65126768BCA501180F7F8EBD32F0FBC5292EB099034
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......_....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ICYL.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCYL.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCYL.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCYL............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VCYM............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y.N.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.002369945888438
Encrypted:	false
SSDEEP:	48:8x/dGTimsHzidAKZdA14tseh7sFiZUkmgqeh7sZy+BX:8xs7+nby
MD5:	5EF6DDA40E061EB1CF9987B0BA656446
SHA1:	50E3F68CC9143329D94F5411CDF13C4B20F5613F
SHA-256:	C477D98BE5511CB9E3A2693BA137B9D98751E8129FB75B1D7A06CDFAAFDE0CF0
SHA-512:	FBB7EC51B515C0F7209FE9A7C519CAA784E0F581501F1CD9486ADE5EBB8D7202658247F8C568247834CE713BE45A3E826839CED651DE594FB72068376CA459BE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ICYL.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCYL.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCYL.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCYL............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y.N.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 18:42:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9879923794824426
Encrypted:	false
SSDEEP:	48:8idGTim7HzidAKZdA1vehDiZUkwqehTy+R:8P7YRy
MD5:	78A4530BC42AF796DBFD58D871106241
SHA1:	F02E4F2A86C317C18925D761DB111D94FA81BF37
SHA-256:	57A9300449340EE17B7C50EEACAE2C46C209069444F61C58725CF6562A7ED88C
SHA-512:	382DD7CDF228AED2EADF575E0A94998A31438E588139FDF57EFF0B79F7BC936ECD554BBAB9F9EA4F11894865A80417CEFC9B318087CF6D386EFA4CFF7CFA5CCE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....P.._....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ICYL.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCYL.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCYL.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCYL............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VCYM............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y.N.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 18:42:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9782192767738844
Encrypted:	false
SSDEEP:	48:8wdGTim7HzidAKZdA1hehBiZUk1W1qehFy+C:8p7I9ly
MD5:	C9CA1E99D1BFAD3C8FC6491B8EFFE7E4
SHA1:	5D9D7B4A1AE9BA6E47DE9F8E91B2FB92B44EA051
SHA-256:	2C5CEF81D66A4F8B55C140A8DFC9627FC8CB88AF4D8EF7F8FAEBE245A80C3FA6
SHA-512:	0E2339ED6B22644E2E2EA377DD68D450C6093D0CEF00990345DCFBE12C953FCD22A9D48834D632CD7C6388E3FB0FA854A72320286A2BB68E5697F9398538B9BE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....)._....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ICYL.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCYL.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCYL.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCYL............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VCYM............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y.N.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 18:42:25 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.989371721722647
Encrypted:	false
SSDEEP:	48:8g/dGTim7HzidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbby+yT+:8h7mT/TbxWOvTbby7T
MD5:	7673396BBF6CCF9DE57E3CDBEE25CE46
SHA1:	6B6A3167AE51DF536F90B176CCAA6888A36064B2
SHA-256:	3BDA64C97079DF89848EA7AF0BC12FA8B5F178A63890075C30CB6FC7CCE26D85
SHA-512:	BD4C989D2BE5480080BCC1FF549773A473224DC55B02B92664CF4CEB1DC71E262FA43DAB7630A15742F45AD3E1AE53442D07473956F5FAF049FFC7B7F5B91C7A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......_....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ICYL.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCYL.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCYL.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCYL............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VCYM............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............y.N.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 21:42:20.066663027 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 3, 2024 21:42:20.066745996 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 3, 2024 21:42:20.176044941 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 3, 2024 21:42:29.567507029 CEST	49712	443	192.168.2.5	142.250.184.228
Oct 3, 2024 21:42:29.567538023 CEST	443	49712	142.250.184.228	192.168.2.5
Oct 3, 2024 21:42:29.567630053 CEST	49712	443	192.168.2.5	142.250.184.228
Oct 3, 2024 21:42:29.568238974 CEST	49712	443	192.168.2.5	142.250.184.228
Oct 3, 2024 21:42:29.568252087 CEST	443	49712	142.250.184.228	192.168.2.5
Oct 3, 2024 21:42:29.674604893 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 3, 2024 21:42:29.674634933 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 3, 2024 21:42:29.783750057 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 3, 2024 21:42:30.213380098 CEST	443	49712	142.250.184.228	192.168.2.5
Oct 3, 2024 21:42:30.235071898 CEST	49712	443	192.168.2.5	142.250.184.228
Oct 3, 2024 21:42:30.235105038 CEST	443	49712	142.250.184.228	192.168.2.5
Oct 3, 2024 21:42:30.238924980 CEST	443	49712	142.250.184.228	192.168.2.5
Oct 3, 2024 21:42:30.239008904 CEST	49712	443	192.168.2.5	142.250.184.228
Oct 3, 2024 21:42:30.295321941 CEST	49712	443	192.168.2.5	142.250.184.228
Oct 3, 2024 21:42:30.295588970 CEST	443	49712	142.250.184.228	192.168.2.5
Oct 3, 2024 21:42:30.345676899 CEST	49712	443	192.168.2.5	142.250.184.228
Oct 3, 2024 21:42:30.345705986 CEST	443	49712	142.250.184.228	192.168.2.5
Oct 3, 2024 21:42:30.392535925 CEST	49712	443	192.168.2.5	142.250.184.228
Oct 3, 2024 21:42:31.550012112 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 3, 2024 21:42:31.550525904 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 3, 2024 21:42:39.128088951 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:39.128125906 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:39.128211021 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:39.128690958 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:39.128711939 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:39.788678885 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:39.788764000 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:39.791219950 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:39.791229963 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:39.791536093 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:39.822143078 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:39.867393970 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:39.920283079 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:39.920351982 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:39.920373917 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:39.920413971 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:39.920427084 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:39.920444012 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:39.920484066 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:39.920494080 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.005558968 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.005577087 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.005624056 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.005671978 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.005678892 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.005742073 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.007060051 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.007108927 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.007152081 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.007160902 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.007193089 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.007200956 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.091517925 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.091538906 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.091587067 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.091597080 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.091628075 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.091646910 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.092344046 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.092360973 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.092426062 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.092434883 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.092457056 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.092474937 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.092890024 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.092905998 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.092977047 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.092983961 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.093087912 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.096277952 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.096293926 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.096352100 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.096358061 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.096396923 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.118671894 CEST	443	49712	142.250.184.228	192.168.2.5
Oct 3, 2024 21:42:40.118731022 CEST	443	49712	142.250.184.228	192.168.2.5
Oct 3, 2024 21:42:40.118788004 CEST	49712	443	192.168.2.5	142.250.184.228
Oct 3, 2024 21:42:40.178560972 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.178628922 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.178632975 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.178657055 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.178688049 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.178702116 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.178893089 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.178936005 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.178962946 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.178971052 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.178998947 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.179016113 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.179033041 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.179074049 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.179099083 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.179105043 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.179146051 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.179146051 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.179696083 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.179738998 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.179764986 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.179770947 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.179802895 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.179826021 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.180479050 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.180521965 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.180560112 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.180566072 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.180598974 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.180608988 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.180696011 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.180737019 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.180757999 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.180764914 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.180799007 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.180814981 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.180839062 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.180892944 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.180900097 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.180974960 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.180982113 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.181025982 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.184587002 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.189070940 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.189076900 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.316543102 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.316591024 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.316677094 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.317939997 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.317982912 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.318048954 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.320043087 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.320090055 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.320318937 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.320897102 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.320919037 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.321043968 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.321666002 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.321680069 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.322031975 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.322045088 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.322150946 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.322174072 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.322216988 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.322230101 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.323008060 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.323055029 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.323172092 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.323363066 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.323376894 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.963601112 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.964329004 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.964360952 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.964792967 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.964801073 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.964879990 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.965214968 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.965275049 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.965635061 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.965648890 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.989454985 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.989952087 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.989967108 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.990451097 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.990456104 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.996196032 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.997376919 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.997422934 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:40.997972012 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:40.997984886 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.000106096 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.000406981 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.000446081 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.000829935 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.000838995 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.067600965 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.067689896 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.067727089 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.067753077 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.067755938 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.067797899 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.067810059 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.067873955 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.068192005 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.068218946 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.068234921 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.068243027 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.069230080 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.069266081 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.071909904 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.072030067 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.072108030 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.073427916 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.073452950 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.073592901 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.073910952 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.073910952 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.073944092 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.073976994 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.091996908 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.092017889 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.092077971 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.092097044 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.092447042 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.092509031 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.093321085 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.093333960 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.093347073 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.093352079 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.099647999 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.099668026 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.099725962 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.099764109 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.099822044 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.100004911 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.100048065 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.100481987 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.101353884 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.101353884 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.101381063 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.101393938 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.103127956 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.103163958 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.103272915 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.104859114 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.104912996 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.104963064 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.109472036 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.109487057 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.109523058 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.109523058 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.109550953 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.109561920 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.110867023 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.110915899 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.111062050 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.113415003 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.113440037 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.149909973 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.149959087 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.150027990 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.150294065 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.150310993 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.153107882 CEST	49712	443	192.168.2.5	142.250.184.228
Oct 3, 2024 21:42:41.153130054 CEST	443	49712	142.250.184.228	192.168.2.5
Oct 3, 2024 21:42:41.636727095 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.642218113 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.642297029 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.644596100 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.644610882 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.729572058 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.733072996 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.733108044 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.733710051 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.733722925 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.743880987 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.743947983 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.744007111 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.745523930 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.745549917 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.745577097 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.745590925 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.752763987 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.752821922 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.752897978 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.754888058 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.754915953 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.772023916 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.790213108 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.795346022 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.813127041 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.813188076 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.813736916 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.813750029 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.815056086 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.815079927 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.815705061 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.815732956 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.815776110 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.815781116 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.816284895 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.816297054 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.835105896 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.835257053 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.835325003 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.835558891 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.835589886 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.835614920 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.835628033 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.862206936 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.862251043 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.862315893 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.907073975 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.907089949 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.911648989 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.911711931 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.911861897 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.912031889 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.912056923 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.912091017 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.912100077 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.914344072 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.914484978 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.914541006 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.915024042 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.915071011 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.915134907 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.915350914 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.915374041 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.915688992 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.915707111 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.915719032 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.915724993 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.918400049 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.918418884 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.918493032 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.918582916 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.918653011 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.918690920 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.918730974 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.918756008 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.919549942 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.919549942 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.919560909 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.919569016 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.922274113 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.922291994 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:41.922350883 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.922745943 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:41.922755957 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.406436920 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.406940937 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.406981945 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.408854008 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.408860922 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.508287907 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.508371115 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.508435965 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.508635998 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.508666039 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.508683920 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.508693933 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.511363029 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.511398077 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.511646032 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.511761904 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.511773109 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.557583094 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.558024883 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.558191061 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.558217049 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.558518887 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.558532000 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.559866905 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.559870958 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.559875965 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.559878111 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.566960096 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.567344904 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.567358971 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.567790031 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.567799091 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.604183912 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.604753971 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.604818106 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.605190992 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.605206013 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.658870935 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.658946037 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.659061909 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.659192085 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.659229040 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.659255028 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.659271002 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.659430027 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.659501076 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.659578085 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.659661055 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.659679890 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.662467957 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.662509918 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.662714958 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.662812948 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.662844896 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.662859917 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.662872076 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.662906885 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.663074017 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.663091898 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.671515942 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.671581030 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.671639919 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.671816111 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.671832085 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.671844006 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.671849966 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.674206972 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.674237967 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.674303055 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.674449921 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.674462080 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.681619883 CEST	60271	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:42.688088894 CEST	53	60271	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:42.688158989 CEST	60271	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:42.688191891 CEST	60271	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:42.693219900 CEST	53	60271	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:42.715507030 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.715589046 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.715759039 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.715833902 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.715852976 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.715873957 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.715886116 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.718684912 CEST	60272	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.718732119 CEST	443	60272	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:42.719060898 CEST	60272	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.719244003 CEST	60272	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:42.719271898 CEST	443	60272	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.153268099 CEST	53	60271	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:43.153850079 CEST	60271	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:43.162995100 CEST	53	60271	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:43.163067102 CEST	60271	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:43.190819025 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.191329002 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.191354990 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.191832066 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.191840887 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.296791077 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.296942949 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.297066927 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.297168970 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.297169924 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.297190905 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.297200918 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.299894094 CEST	60273	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.299956083 CEST	443	60273	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.300081015 CEST	60273	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.300148964 CEST	60273	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.300157070 CEST	443	60273	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.340708017 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.341407061 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.341418982 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.341692924 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.341697931 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.341869116 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.342325926 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.342391968 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.342411041 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.342787027 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.342823029 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.342909098 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.342915058 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.343010902 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.343017101 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.365369081 CEST	443	60272	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.366103888 CEST	60272	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.366103888 CEST	60272	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.366147041 CEST	443	60272	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.366172075 CEST	443	60272	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.445293903 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.445360899 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.445575953 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.445575953 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.445692062 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.445710897 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.446602106 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.446655989 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.446779013 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.446852922 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.446852922 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.446872950 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.446882963 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.447454929 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.447536945 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.447789907 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.448131084 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.448146105 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.448260069 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.448271036 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.448637962 CEST	60274	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.448682070 CEST	443	60274	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.449441910 CEST	60274	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.449692965 CEST	60274	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.449719906 CEST	443	60274	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.449801922 CEST	60275	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.449875116 CEST	443	60275	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.450007915 CEST	60275	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.450417995 CEST	60275	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.450417995 CEST	60276	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.450443983 CEST	443	60275	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.450510979 CEST	443	60276	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.450668097 CEST	60276	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.450668097 CEST	60276	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.450754881 CEST	443	60276	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.466489077 CEST	443	60272	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.466557980 CEST	443	60272	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.466701031 CEST	60272	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.466701031 CEST	60272	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.466806889 CEST	60272	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.466830015 CEST	443	60272	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.468703985 CEST	60277	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.468727112 CEST	443	60277	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.468875885 CEST	60277	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.469008923 CEST	60277	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.469022036 CEST	443	60277	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.950366020 CEST	443	60273	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.951368093 CEST	60273	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.951407909 CEST	443	60273	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:43.951437950 CEST	60273	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:43.951462030 CEST	443	60273	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.051587105 CEST	443	60273	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.051644087 CEST	443	60273	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.051702976 CEST	60273	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.051912069 CEST	60273	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.051912069 CEST	60273	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.051929951 CEST	443	60273	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.051939964 CEST	443	60273	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.054419041 CEST	60278	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.054444075 CEST	443	60278	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.054636955 CEST	60278	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.054661989 CEST	60278	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.054666042 CEST	443	60278	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.085278988 CEST	443	60276	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.086200953 CEST	60276	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.086200953 CEST	60276	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.086231947 CEST	443	60276	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.086250067 CEST	443	60276	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.091464996 CEST	443	60274	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.092180967 CEST	60274	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.092180967 CEST	60274	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.092195988 CEST	443	60274	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.092204094 CEST	443	60274	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.092458010 CEST	443	60275	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.092859983 CEST	60275	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.092890978 CEST	443	60275	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.093086958 CEST	60275	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.093092918 CEST	443	60275	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.153805017 CEST	443	60277	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.154386044 CEST	60277	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.154403925 CEST	443	60277	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.154783964 CEST	60277	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.154789925 CEST	443	60277	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.184951067 CEST	443	60276	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.185009003 CEST	443	60276	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.185256004 CEST	60276	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.185332060 CEST	60276	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.185332060 CEST	60276	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.185354948 CEST	443	60276	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.185365915 CEST	443	60276	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.188247919 CEST	60279	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.188273907 CEST	443	60279	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.188576937 CEST	60279	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.188576937 CEST	60279	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.188601017 CEST	443	60279	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.192318916 CEST	443	60274	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.192364931 CEST	443	60274	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.192600012 CEST	60274	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.192600012 CEST	60274	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.193133116 CEST	60274	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.193161964 CEST	443	60274	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.194029093 CEST	443	60275	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.194092989 CEST	443	60275	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.194286108 CEST	60275	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.194286108 CEST	60275	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.194587946 CEST	60275	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.194606066 CEST	443	60275	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.195017099 CEST	60280	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.195066929 CEST	443	60280	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.196111917 CEST	60281	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.196151972 CEST	443	60281	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.196208000 CEST	60280	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.196263075 CEST	60281	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.196402073 CEST	60280	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.196403980 CEST	60281	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.196418047 CEST	443	60280	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.196424961 CEST	443	60281	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.271349907 CEST	443	60277	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.271444082 CEST	443	60277	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.271645069 CEST	60277	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.271719933 CEST	60277	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.271719933 CEST	60277	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.271738052 CEST	443	60277	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.271749020 CEST	443	60277	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.274255037 CEST	60282	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.274296045 CEST	443	60282	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.274414062 CEST	60282	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.274514914 CEST	60282	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.274522066 CEST	443	60282	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.752441883 CEST	443	60278	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.753103971 CEST	60278	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.753129005 CEST	443	60278	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.753515959 CEST	60278	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.753520966 CEST	443	60278	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.850168943 CEST	443	60280	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.850756884 CEST	60280	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.850795031 CEST	443	60280	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.851162910 CEST	60280	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.851171017 CEST	443	60280	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.867005110 CEST	443	60279	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.867458105 CEST	60279	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.867494106 CEST	443	60279	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.867872953 CEST	60279	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.867878914 CEST	443	60279	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.890320063 CEST	443	60278	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.890381098 CEST	443	60278	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.890532017 CEST	60278	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.890616894 CEST	60278	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.890639067 CEST	443	60278	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.890656948 CEST	60278	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.890662909 CEST	443	60278	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.893641949 CEST	60283	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.893697023 CEST	443	60283	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.893904924 CEST	60283	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.894062042 CEST	60283	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.894083023 CEST	443	60283	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.900912046 CEST	443	60281	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.901245117 CEST	60281	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.901274920 CEST	443	60281	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.901606083 CEST	60281	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.901612997 CEST	443	60281	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.967542887 CEST	443	60282	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.968040943 CEST	60282	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.968065977 CEST	443	60282	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.968446016 CEST	60282	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.968451977 CEST	443	60282	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.993230104 CEST	443	60280	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.993292093 CEST	443	60280	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.993350029 CEST	60280	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.993516922 CEST	60280	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.993541956 CEST	443	60280	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.993558884 CEST	60280	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.993567944 CEST	443	60280	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.996273994 CEST	60284	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.996315956 CEST	443	60284	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.996329069 CEST	443	60279	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.996377945 CEST	443	60279	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.996397972 CEST	60284	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.996445894 CEST	60279	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.996573925 CEST	60284	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.996586084 CEST	443	60284	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.996618032 CEST	60279	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.996639967 CEST	443	60279	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.996656895 CEST	60279	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.996663094 CEST	443	60279	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:44.998661995 CEST	60285	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:44.998692036 CEST	443	60285	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.002521992 CEST	60285	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.002521992 CEST	60285	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.002546072 CEST	443	60285	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.026774883 CEST	443	60281	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.026849985 CEST	443	60281	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.026892900 CEST	60281	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.027044058 CEST	60281	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.027060986 CEST	443	60281	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.027072906 CEST	60281	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.027079105 CEST	443	60281	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.029257059 CEST	60286	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.029277086 CEST	443	60286	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.029453039 CEST	60286	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.029705048 CEST	60286	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.029712915 CEST	443	60286	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.068448067 CEST	443	60282	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.068517923 CEST	443	60282	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.068558931 CEST	60282	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.068708897 CEST	60282	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.068717957 CEST	443	60282	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.068730116 CEST	60282	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.068734884 CEST	443	60282	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.071557045 CEST	60287	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.071605921 CEST	443	60287	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.071702957 CEST	60287	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.071791887 CEST	60287	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.071803093 CEST	443	60287	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.653616905 CEST	443	60285	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.654762030 CEST	60285	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.654789925 CEST	443	60285	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.655225992 CEST	60285	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.655231953 CEST	443	60285	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.670970917 CEST	443	60284	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.671396017 CEST	60284	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.671422958 CEST	443	60284	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.672166109 CEST	60284	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.672179937 CEST	443	60284	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.683685064 CEST	443	60286	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.684370041 CEST	60286	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.684379101 CEST	443	60286	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.684878111 CEST	60286	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.684880972 CEST	443	60286	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.741220951 CEST	443	60287	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.742100954 CEST	60287	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.742100954 CEST	60287	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.742130995 CEST	443	60287	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.742151976 CEST	443	60287	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.765611887 CEST	443	60285	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.765672922 CEST	443	60285	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.765825033 CEST	60285	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.771245003 CEST	60285	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.771245003 CEST	60285	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.771262884 CEST	443	60285	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.771270990 CEST	443	60285	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.774524927 CEST	60288	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.774573088 CEST	443	60288	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.774748087 CEST	60288	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.774775982 CEST	60288	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.774781942 CEST	443	60288	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.775039911 CEST	443	60284	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.775192976 CEST	443	60284	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.775285959 CEST	60284	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.775285959 CEST	60284	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.775326014 CEST	60284	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.775342941 CEST	443	60284	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.790591955 CEST	60289	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.790636063 CEST	443	60289	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.790838003 CEST	60289	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.791088104 CEST	60289	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.791102886 CEST	443	60289	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.792330027 CEST	443	60286	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.792407990 CEST	443	60286	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.792562962 CEST	60286	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.792562962 CEST	60286	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.793533087 CEST	60286	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.793545008 CEST	443	60286	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.806564093 CEST	60290	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.806580067 CEST	443	60290	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.806662083 CEST	60290	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.806823969 CEST	60290	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.806833982 CEST	443	60290	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.847829103 CEST	443	60287	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.847903013 CEST	443	60287	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.848050117 CEST	60287	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.848140955 CEST	60287	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.848140955 CEST	60287	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.848167896 CEST	443	60287	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.848181009 CEST	443	60287	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.854664087 CEST	60291	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.854707003 CEST	443	60291	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:45.854794025 CEST	60291	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.854954004 CEST	60291	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:45.854964972 CEST	443	60291	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.451154947 CEST	443	60288	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.451668024 CEST	60288	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.451688051 CEST	443	60288	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.452275991 CEST	60288	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.452280998 CEST	443	60288	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.458278894 CEST	443	60290	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.458695889 CEST	60290	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.458720922 CEST	443	60290	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.459096909 CEST	60290	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.459104061 CEST	443	60290	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.712126970 CEST	443	60288	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.712205887 CEST	443	60290	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.712210894 CEST	443	60288	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.712275982 CEST	60288	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.712282896 CEST	443	60290	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.712352037 CEST	60290	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.712385893 CEST	60288	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.712403059 CEST	443	60288	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.712412119 CEST	60288	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.712416887 CEST	443	60288	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.712937117 CEST	60290	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.712958097 CEST	443	60290	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.712970018 CEST	60290	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.712975979 CEST	443	60290	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.714234114 CEST	443	60291	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.714829922 CEST	60291	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.714837074 CEST	443	60291	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.715315104 CEST	60291	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.715318918 CEST	443	60291	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.716451883 CEST	60292	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.716485977 CEST	443	60292	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.716615915 CEST	60292	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.716734886 CEST	60292	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.716754913 CEST	443	60292	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.716936111 CEST	60293	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.716984034 CEST	443	60293	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.717050076 CEST	60293	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.717139006 CEST	60293	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.717156887 CEST	443	60293	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.718736887 CEST	443	60289	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.719089985 CEST	60289	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.719099998 CEST	443	60289	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.719711065 CEST	60289	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.719717979 CEST	443	60289	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.817045927 CEST	443	60291	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.817106009 CEST	443	60291	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.817187071 CEST	60291	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.817373037 CEST	60291	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.817388058 CEST	443	60291	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.817397118 CEST	60291	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.817401886 CEST	443	60291	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.819979906 CEST	60294	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.820079088 CEST	443	60294	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.820156097 CEST	60294	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.820291996 CEST	60294	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.820321083 CEST	443	60294	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.821507931 CEST	443	60289	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.821654081 CEST	443	60289	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.821749926 CEST	60289	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.821837902 CEST	60289	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.821837902 CEST	60289	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.821851015 CEST	443	60289	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.821858883 CEST	443	60289	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.823688030 CEST	60295	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.823714018 CEST	443	60295	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:46.823848009 CEST	60295	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.823997974 CEST	60295	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:46.824022055 CEST	443	60295	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.283576965 CEST	443	60283	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.284560919 CEST	60283	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.284560919 CEST	60283	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.284600019 CEST	443	60283	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.284616947 CEST	443	60283	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.551378965 CEST	443	60283	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.551443100 CEST	443	60283	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.551713943 CEST	60283	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.551713943 CEST	60283	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.552448034 CEST	60283	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.552469969 CEST	443	60283	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.552810907 CEST	443	60292	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.553302050 CEST	443	60293	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.553348064 CEST	60292	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.553369045 CEST	443	60292	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.553749084 CEST	60292	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.553756952 CEST	443	60292	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.554029942 CEST	60293	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.554063082 CEST	443	60293	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.554299116 CEST	60293	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.554306030 CEST	443	60293	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.554858923 CEST	60296	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.554900885 CEST	443	60296	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.555140972 CEST	60296	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.555183887 CEST	60296	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.555188894 CEST	443	60296	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.653695107 CEST	443	60292	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.653753042 CEST	443	60292	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.654005051 CEST	60292	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.654046059 CEST	60292	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.654061079 CEST	443	60292	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.654122114 CEST	60292	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.654129028 CEST	443	60292	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.656759024 CEST	60297	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.656788111 CEST	443	60297	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.656869888 CEST	60297	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.657336950 CEST	60297	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.657350063 CEST	443	60297	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.658404112 CEST	443	60293	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.658462048 CEST	443	60293	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.658705950 CEST	60293	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.658729076 CEST	60293	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.658729076 CEST	60293	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.658742905 CEST	443	60293	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.658751011 CEST	443	60293	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.660861969 CEST	60298	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.660868883 CEST	443	60298	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.661011934 CEST	60298	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.661124945 CEST	60298	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.661135912 CEST	443	60298	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.730557919 CEST	443	60294	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.730972052 CEST	60294	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.730989933 CEST	443	60294	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.731396914 CEST	60294	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.731401920 CEST	443	60294	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.734325886 CEST	443	60295	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.734785080 CEST	60295	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.734798908 CEST	443	60295	13.107.246.60	192.168.2.5
Oct 3, 2024 21:42:47.735001087 CEST	60295	443	192.168.2.5	13.107.246.60
Oct 3, 2024 21:42:47.735004902 CEST	443	60295	13.107.246.60	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 21:42:24.990920067 CEST	53	51952	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:24.990997076 CEST	53	57373	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:26.064275980 CEST	53	51038	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:26.359167099 CEST	65100	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:26.359376907 CEST	49465	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:26.549251080 CEST	53	65100	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:26.549923897 CEST	49754	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:26.653223991 CEST	53	49465	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:26.653819084 CEST	57677	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:26.812295914 CEST	53	49754	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:26.813240051 CEST	50245	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:26.831779003 CEST	53	57677	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:27.278434992 CEST	53	50245	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:27.347078085 CEST	65391	53	192.168.2.5	8.8.8.8
Oct 3, 2024 21:42:27.347300053 CEST	62362	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:27.355056047 CEST	53	62362	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:27.355817080 CEST	53	65391	8.8.8.8	192.168.2.5
Oct 3, 2024 21:42:28.620073080 CEST	61627	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:28.621278048 CEST	59776	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:28.799432993 CEST	53	61627	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:28.800327063 CEST	65332	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:29.087733984 CEST	53	59776	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:29.088438034 CEST	53861	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:29.102011919 CEST	53	53861	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:29.308573008 CEST	53	65332	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:29.507406950 CEST	51305	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:29.507652998 CEST	51588	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:29.515319109 CEST	53	51588	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:29.515816927 CEST	53	51305	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:34.512516022 CEST	50610	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:34.513535976 CEST	60270	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:34.805972099 CEST	53	50610	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:34.806708097 CEST	65145	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:34.975090027 CEST	53	60270	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:34.990230083 CEST	53	65145	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:35.000983953 CEST	54110	53	192.168.2.5	1.1.1.1
Oct 3, 2024 21:42:35.185388088 CEST	53	54110	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:42.681242943 CEST	53	49647	1.1.1.1	192.168.2.5
Oct 3, 2024 21:42:43.213232040 CEST	53	63883	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 3, 2024 21:42:24.991122961 CEST	192.168.2.5	1.1.1.1	c22d	(Port unreachable)	Destination Unreachable
Oct 3, 2024 21:42:26.832659960 CEST	192.168.2.5	1.1.1.1	c204	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 21:42:26.359167099 CEST	192.168.2.5	1.1.1.1	0xdfd0	Standard query (0)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:26.359376907 CEST	192.168.2.5	1.1.1.1	0x5c67	Standard query (0)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	65	IN (0x0001)	false
Oct 3, 2024 21:42:26.549923897 CEST	192.168.2.5	1.1.1.1	0x3843	Standard query (0)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:26.653819084 CEST	192.168.2.5	1.1.1.1	0x196b	Standard query (0)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	65	IN (0x0001)	false
Oct 3, 2024 21:42:26.813240051 CEST	192.168.2.5	1.1.1.1	0xbfb9	Standard query (0)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:27.347078085 CEST	192.168.2.5	8.8.8.8	0xcd29	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:27.347300053 CEST	192.168.2.5	1.1.1.1	0x51a3	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:28.620073080 CEST	192.168.2.5	1.1.1.1	0x4615	Standard query (0)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:28.621278048 CEST	192.168.2.5	1.1.1.1	0x12d6	Standard query (0)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	65	IN (0x0001)	false
Oct 3, 2024 21:42:28.800327063 CEST	192.168.2.5	1.1.1.1	0xcd4d	Standard query (0)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:29.088438034 CEST	192.168.2.5	1.1.1.1	0x32a5	Standard query (0)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	65	IN (0x0001)	false
Oct 3, 2024 21:42:29.507406950 CEST	192.168.2.5	1.1.1.1	0x4296	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:29.507652998 CEST	192.168.2.5	1.1.1.1	0x25a7	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 3, 2024 21:42:34.512516022 CEST	192.168.2.5	1.1.1.1	0x3137	Standard query (0)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:34.513535976 CEST	192.168.2.5	1.1.1.1	0x2438	Standard query (0)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	65	IN (0x0001)	false
Oct 3, 2024 21:42:34.806708097 CEST	192.168.2.5	1.1.1.1	0xcdd3	Standard query (0)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:35.000983953 CEST	192.168.2.5	1.1.1.1	0x64f1	Standard query (0)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 21:42:26.549251080 CEST	1.1.1.1	192.168.2.5	0xdfd0	Server failure (2)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:26.653223991 CEST	1.1.1.1	192.168.2.5	0x5c67	Server failure (2)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	none	none	65	IN (0x0001)	false
Oct 3, 2024 21:42:26.812295914 CEST	1.1.1.1	192.168.2.5	0x3843	Server failure (2)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:26.831779003 CEST	1.1.1.1	192.168.2.5	0x196b	Server failure (2)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	none	none	65	IN (0x0001)	false
Oct 3, 2024 21:42:27.278434992 CEST	1.1.1.1	192.168.2.5	0xbfb9	Server failure (2)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:27.355056047 CEST	1.1.1.1	192.168.2.5	0x51a3	No error (0)	google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:27.355817080 CEST	8.8.8.8	192.168.2.5	0xcd29	No error (0)	google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:28.799432993 CEST	1.1.1.1	192.168.2.5	0x4615	Server failure (2)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:29.087733984 CEST	1.1.1.1	192.168.2.5	0x12d6	Server failure (2)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	none	none	65	IN (0x0001)	false
Oct 3, 2024 21:42:29.102011919 CEST	1.1.1.1	192.168.2.5	0x32a5	Server failure (2)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	none	none	65	IN (0x0001)	false
Oct 3, 2024 21:42:29.308573008 CEST	1.1.1.1	192.168.2.5	0xcd4d	Server failure (2)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:29.515319109 CEST	1.1.1.1	192.168.2.5	0x25a7	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 3, 2024 21:42:29.515816927 CEST	1.1.1.1	192.168.2.5	0x4296	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:34.805972099 CEST	1.1.1.1	192.168.2.5	0x3137	Server failure (2)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:34.975090027 CEST	1.1.1.1	192.168.2.5	0x2438	Server failure (2)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	none	none	65	IN (0x0001)	false
Oct 3, 2024 21:42:34.990230083 CEST	1.1.1.1	192.168.2.5	0xcdd3	Server failure (2)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:35.185388088 CEST	1.1.1.1	192.168.2.5	0x64f1	Server failure (2)	ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:39.127123117 CEST	1.1.1.1	192.168.2.5	0xa0e0	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 21:42:39.127123117 CEST	1.1.1.1	192.168.2.5	0xa0e0	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Oct 3, 2024 21:42:40.336847067 CEST	1.1.1.1	192.168.2.5	0x8e76	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 3, 2024 21:42:40.336847067 CEST	1.1.1.1	192.168.2.5	0x8e76	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49715	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:39 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:39 UTC	540	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:39 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 30 Sep 2024 13:16:38 GMT ETag: "0x8DCE1521DF74B57" x-ms-request-id: 90766f9b-701e-006f-578c-15afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194239Z-15767c5fc55ncqdn59ub6rndq00000000b6g000000007b86 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:39 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-03 19:42:40 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-03 19:42:40 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-03 19:42:40 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-03 19:42:40 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-03 19:42:40 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-03 19:42:40 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-03 19:42:40 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-03 19:42:40 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-03 19:42:40 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49720	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:40 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:41 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: b9d87bc4-001e-008d-138c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194241Z-15767c5fc55gq5fmm10nm5qqr80000000bkg00000000egpz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:41 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49718	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:40 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:41 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:40 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b9d87bc3-001e-008d-128c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194240Z-15767c5fc55xsgnlxyxy40f4m00000000b8000000000vd6f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:41 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49719	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:40 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:41 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:41 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 39d43082-801e-00ac-658c-15fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194241Z-15767c5fc5546rn6ch9zv310e000000004c000000000pqdr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:41 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49717	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:40 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:41 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:41 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1cc2ff82-e01e-0071-478c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194241Z-15767c5fc55gs96cphvgp5f5vc0000000b8g00000000x5ad x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:41 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49721	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:40 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:41 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4b0a31e7-c01e-00ad-448c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194241Z-15767c5fc552g4w83buhsr3htc0000000bfg00000000d921 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:41 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49726	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:41 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:41 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 757ce4f4-401e-000a-128c-154a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194241Z-15767c5fc55w69c2zvnrz0gmgw0000000btg000000002cyz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:41 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49725	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:41 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:41 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: aa8826a4-b01e-0053-608c-15cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194241Z-15767c5fc554w2fgapsyvy8ua00000000b10000000007vdf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:41 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49728	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:41 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:41 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 3a0dc1eb-601e-0032-608c-15eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194241Z-15767c5fc554w2fgapsyvy8ua00000000b2g0000000025ff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:41 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49727	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:41 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:41 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 24b39cfc-301e-0096-2a8c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194241Z-15767c5fc55tsfp92w7yna557w0000000bfg00000000f7yd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:41 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49729	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:41 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:41 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: b2393cc3-501e-005b-768c-15d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194241Z-15767c5fc55n4msds84xh4z67w000000054g00000000gq1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:41 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49731	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:42 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:42 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 023e3708-a01e-003d-568c-1598d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194242Z-15767c5fc55n4msds84xh4z67w000000058g000000001zpx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:42 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49732	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:42 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:42 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 1cc301c6-e01e-0071-6b8c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194242Z-15767c5fc55gq5fmm10nm5qqr80000000bgg00000000p2tu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:42 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49733	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:42 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:42 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 1cc301ca-e01e-0071-6f8c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194242Z-15767c5fc554wklc0x4mc5pq0w0000000bqg00000000tw6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:42 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49735	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:42 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:42 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 023e3944-a01e-003d-708c-1598d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194242Z-15767c5fc55v7j95gq2uzq37a00000000bsg000000005uhc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:42 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49734	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:42 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:42 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: e0871f45-901e-00a0-0d8c-156a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194242Z-15767c5fc554w2fgapsyvy8ua00000000b0g000000008w15 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:42 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49737	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:43 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:43 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: a68dfe67-f01e-0052-588c-159224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194243Z-15767c5fc55gq5fmm10nm5qqr80000000bn000000000961u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:43 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49739	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:43 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:43 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: c54fb296-901e-008f-528c-1567a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194243Z-15767c5fc55472x4k7dmphmadg0000000b70000000005h10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:43 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49740	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:43 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:43 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: dc68ccfc-201e-006e-438c-15bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194243Z-15767c5fc55d6fcl6x6bw8cpdc0000000bb000000000hmfr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:43 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49738	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:43 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:43 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 24b39fc0-301e-0096-298c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194243Z-15767c5fc55rv8zjq9dg0musxg0000000bm000000000129s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:43 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	60272	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:43 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:43 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 79ade187-001e-0065-788c-150b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194243Z-15767c5fc55rg5b7sh1vuv8t7n0000000bvg000000006rxx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:43 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	60273	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:43 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:43 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0da94923-701e-0097-168c-15b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194243Z-15767c5fc55whfstvfw43u8fp40000000bm000000000fex4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:44 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	60276	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:44 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:44 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 09e6f7ee-001e-0034-548c-15dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194244Z-15767c5fc55ncqdn59ub6rndq00000000b4000000000grms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:44 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	60274	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:44 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:44 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8e9c869d-201e-000c-4b8c-1579c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194244Z-15767c5fc55rg5b7sh1vuv8t7n0000000bqg00000000tx83 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:44 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	60275	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:44 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:44 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4f10c824-e01e-0085-1c8c-15c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194244Z-15767c5fc55852fxfeh7csa2dn0000000bf0000000003cgy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:44 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	60277	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:44 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:44 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 82f8b22c-c01e-0014-5a8c-15a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194244Z-15767c5fc55sdcjq8ksxt4n9mc00000000wg000000001nr4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:44 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	60278	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:44 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:44 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 30fd46b0-d01e-00a1-368c-1535b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194244Z-15767c5fc55lghvzbxktxfqntw0000000b1g00000000vkw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:44 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	60280	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:44 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:44 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 75493038-e01e-00aa-508c-15ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194244Z-15767c5fc55rg5b7sh1vuv8t7n0000000bv0000000009q5p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:44 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	60279	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:44 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:44 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a901ce3-301e-005d-708c-15e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194244Z-15767c5fc55472x4k7dmphmadg0000000b800000000024e1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:44 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	60281	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:44 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:44 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c2ca9d4d-801e-0035-458c-15752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194244Z-15767c5fc55rg5b7sh1vuv8t7n0000000bwg0000000046s1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	60282	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:44 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:45 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 831ef799-b01e-0098-7b8c-15cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194245Z-15767c5fc55kg97hfq5uqyxxaw0000000be000000000hu5x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:45 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	60285	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:45 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:45 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: eccf174e-001e-0079-238c-1512e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194245Z-15767c5fc554wklc0x4mc5pq0w0000000bq000000000w27b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:45 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	60284	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:45 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:45 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 4b0a3852-c01e-00ad-3b8c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194245Z-15767c5fc554wklc0x4mc5pq0w0000000brg00000000q7qc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:45 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	60286	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:45 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:45 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:45 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 76615707-c01e-0082-6a8c-15af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194245Z-15767c5fc55fdfx81a30vtr1fw0000000bxg0000000003w3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-03 19:42:45 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	60287	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:45 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:45 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: bb2e28bd-501e-0016-0b8c-15181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194245Z-15767c5fc55gq5fmm10nm5qqr80000000bm000000000caku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:45 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	60288	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:46 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:46 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4da5bf60-a01e-0070-668c-15573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194246Z-15767c5fc554l9xf959gp9cb1s00000005kg00000000pspp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:46 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	60290	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:46 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:46 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 8789ddbb-a01e-0084-6a8c-159ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194246Z-15767c5fc55xsgnlxyxy40f4m00000000bcg00000000bu2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:46 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	60291	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:46 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:46 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 9bed673a-001e-0046-278c-15da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194246Z-15767c5fc55d6fcl6x6bw8cpdc0000000bf0000000002f7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:46 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	60289	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:46 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:46 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 0dcb6c6d-e01e-0003-668c-150fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194246Z-15767c5fc5546rn6ch9zv310e000000004f000000000amgh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:46 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	60283	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:47 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:47 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: a7623418-001e-00a2-348c-15d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194247Z-15767c5fc55ncqdn59ub6rndq00000000b6g000000007bfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:47 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	60292	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:47 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:47 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 772ea1ab-e01e-003c-188c-15c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194247Z-15767c5fc55lghvzbxktxfqntw0000000b7g000000006g4h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:47 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	60293	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:47 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:47 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 3a0dcc46-601e-0032-6c8c-15eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194247Z-15767c5fc55xsgnlxyxy40f4m00000000b9000000000ryen x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:47 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	60294	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:47 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:47 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 15fe0b87-a01e-0002-3b8c-155074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194247Z-15767c5fc55whfstvfw43u8fp40000000bn000000000af00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:47 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	60295	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:47 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:47 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 1f480944-c01e-002b-018c-156e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194247Z-15767c5fc55rv8zjq9dg0musxg0000000beg00000000gew3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:47 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	60296	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:48 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:48 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: c54fbac1-901e-008f-588c-1567a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194248Z-15767c5fc55tsfp92w7yna557w0000000bg000000000b62t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:48 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	60298	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:48 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:48 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 76252b1b-c01e-0066-488c-15a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194248Z-15767c5fc55lghvzbxktxfqntw0000000b6000000000cpzv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:48 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	60297	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:48 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:48 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 75858473-001e-000b-318c-1515a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194248Z-15767c5fc554wklc0x4mc5pq0w0000000bs000000000pakq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:48 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	60299	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:48 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:48 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b9a197f6-401e-0078-3b8c-154d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194248Z-15767c5fc55qdcd62bsn50hd6s0000000b9g00000000a0cz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:48 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	60300	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:48 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:48 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b83a8dc4-f01e-003f-308c-15d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194248Z-15767c5fc55gs96cphvgp5f5vc0000000bcg00000000ce77 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:48 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	60301	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:49 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2f8443ca-b01e-0070-308c-151cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194249Z-15767c5fc55d6fcl6x6bw8cpdc0000000bbg00000000gcw6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	60302	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:49 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7be6812e-d01e-008e-528c-15387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194249Z-15767c5fc55852fxfeh7csa2dn0000000bbg00000000h26w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:49 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	60303	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:49 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 1f480aea-c01e-002b-028c-156e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194249Z-15767c5fc55qkvj6n60pxm9mbw00000000rg000000001thf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	60305	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:49 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 16d3a614-701e-0032-288c-15a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194249Z-15767c5fc55xsgnlxyxy40f4m00000000bag00000000kxrr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	60304	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:49 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 7be6821c-d01e-008e-398c-15387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194249Z-15767c5fc55lghvzbxktxfqntw0000000b6000000000cq15 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:49 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	60306	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:49 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: aa883537-b01e-0053-4c8c-15cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194249Z-15767c5fc55dtdv4d4saq7t47n0000000b8000000000dmh0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	60307	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 19:42:49 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-03 19:42:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 19:42:49 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: cce0beff-001e-0082-398c-155880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241003T194249Z-15767c5fc55rg5b7sh1vuv8t7n0000000bvg000000006s82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-03 19:42:50 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 3640, Parent PID: 5424

General

Target ID:	0
Start time:	15:42:20
Start date:	03/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3436, Parent PID: 3640

General

Target ID:	2
Start time:	15:42:23
Start date:	03/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2164,i,3349396247227516795,7502699321134445247,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 4816, Parent PID: 5424

General

Target ID:	3
Start time:	15:42:25
Start date:	03/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top/u/hs-schmalkalden.de"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top/u/hs-schmalkalden.de

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 3640, Parent PID: 5424

General

Chronological Activities

Analysis Process: chrome.exePID: 3436, Parent PID: 3640

General

Chronological Activities

Analysis Process: chrome.exePID: 4816, Parent PID: 5424

General

Chronological Activities

Windows Analysis Report
https://ag7midxamzdshh8dizdt-gea5hxewecng4zxzdcgm.top/u/hs-schmalkalden.de