Edit tour

Windows Analysis Report
http://mauzanapsusi.com

Overview

General Information

Sample URL:	http://mauzanapsusi.com
Analysis ID:	1525747
Infos:

Errors URL not reachable

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2608 --field-trial-handle=2192,i,8595022831753486897,13261828926118445509,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 760 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://mauzanapsusi.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49720 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.5:49718 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49720 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: mauzanapsusi.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.5:49718 version: TLS 1.2

Source: classification engine

Classification label: unknown1.win@19/6@12/3

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2608 --field-trial-handle=2192,i,8595022831753486897,13261828926118445509,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://mauzanapsusi.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2608 --field-trial-handle=2192,i,8595022831753486897,13261828926118445509,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
google.com	172.217.18.14	true	false	unknown
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	unknown
www.google.com	172.217.16.196	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
mauzanapsusi.com	unknown	unknown	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved		unknown	unknown	false
172.217.16.196	www.google.com	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525747
Start date and time:	2024-10-04 14:34:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://mauzanapsusi.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	UNKNOWN
Classification:	unknown1.win@19/6@12/3
Cookbook Comments:	URL browsing timeout or error

Errors

URL not reachable

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.18.3, 142.250.185.174, 173.194.76.84, 34.104.35.123, 184.28.90.27, 4.175.87.197, 199.232.210.172, 192.229.221.95, 13.85.23.206
Excluded domains from analysis (whitelisted): azurefd-t-fb-prod.trafficmanager.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, ocsp.digicert.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, azureedge-t-prod.trafficmanager.net, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://mauzanapsusi.com

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 11:35:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9685572104350357
Encrypted:	false
SSDEEP:	48:8CdWTSiuHehecidAKZdA19ehwiZUklqehGy+3:8PfnYqdy
MD5:	A328A2615D858CB8AD3BD6D641F08552
SHA1:	7208E1130FABE14EA6C3AA9B638A2BA914133209
SHA-256:	A36C37C8681B1B52574680A307D7546366286D4448283188EBA168D8D0157109
SHA-512:	F31C9CF8DF90898845EA09CE2C9F18BBA81D588A4F8806D219B0EEB0438027120A50E65BA8D65E3A1D8CAA2FBE9EAEA600EA39502B7AED111F639F9472238D10
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........Y...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDYpd....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDYpd....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDYpd....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDYpd..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDYrd...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........w.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 11:35:34 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9844020766139514
Encrypted:	false
SSDEEP:	48:8FdWTSiuHehecidAKZdA1weh/iZUkAQkqehNy+2:8OfnYg9QQy
MD5:	E4AE111CB71A32A116ABEDA0C44C4973
SHA1:	0322D33DD4DB6405AD48CF460793FB9D078EC8E0
SHA-256:	BAC1A38534B6F08B2BC2C41A1B277486A6B88BF2EADA11248884AF1262DA5B1A
SHA-512:	100FECEBC0D237655B9CB0966E2510866E81F1991AC7708322D897D67CCADD235A82A269C1E7DC8193601C42B85DB18E86B192C559CA569B50F6AD67BD293509
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....z...Y...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDYpd....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDYpd....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDYpd....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDYpd..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDYrd...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........w.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.9961343658255335
Encrypted:	false
SSDEEP:	48:8x7dWTSisHehecidAKZdA14tseh7sFiZUkmgqeh7sHy+BX:8xUftY4nxy
MD5:	1655B93888A2B703A677598D005E0F28
SHA1:	1281FFD02694D3BB4AA07733C35D1F4D0F5A5283
SHA-256:	2E6F88EE452622CBDEF22E0584028831BAF39C442EBF787E689E2C6A1E517F52
SHA-512:	1A4B1758DC8327437D82A2B91AA8350F7BB67B41A0EB4978EAFA9B422555B5839C9B4ADDAC951AA48529DA82FCB48A9408E33A8D4DE63DE953512417539DBBBF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDYpd....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDYpd....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDYpd....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDYpd..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........w.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 11:35:34 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.983332417271285
Encrypted:	false
SSDEEP:	48:8tdWTSiuHehecidAKZdA1vehDiZUkwqehJy+R:82fnYrfy
MD5:	4D7488124A74CAAD70A6BF92497B70F8
SHA1:	B596EB40E6AC40B8C6F48A438A405BE3537D9A82
SHA-256:	2BE2083FF5B574434415F3E4571CB60F1F51DB977F87A9E96FED0D5D23D9CC07
SHA-512:	A382111FDDE3809F1F66CDE65A9F8983B67DAFF299E364FC81213E0703C8D60F712DCBF2153B0E443EC74751B8201D2B1D42DFAB5C6C08826F82B3A7DEE0EAE3
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....z...Y...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDYpd....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDYpd....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDYpd....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDYpd..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDYrd...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........w.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 11:35:34 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9706001457357454
Encrypted:	false
SSDEEP:	48:8bdWTSiuHehecidAKZdA1hehBiZUk1W1qehLy+C:80fnYr9ry
MD5:	C456572CF9E9FBFCA42EE49D250AA5E4
SHA1:	A55E61A7696A0F19005BAB1EC765CB4ACFA7EDDF
SHA-256:	462A579096AA37465FD3C76BEDCC686D91BA535527EE57DAA8C8CD6EF7512676
SHA-512:	15365FF76120395D8B34741643BCA7976C3D179BCE764206E981C4DF5BFBEEE963D0A8B1919349AEE003501F329ABF60CD801E3B7539680F768FA91CB3A997FF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....T..Y...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDYpd....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDYpd....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDYpd....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDYpd..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDYrd...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........w.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 11:35:34 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9799400724219134
Encrypted:	false
SSDEEP:	48:8HdWTSiuHehecidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbxy+yT+:8wfnYLT/TbxWOvTbxy7T
MD5:	4CA66B9C9BFF45A83F35C1FD5927C70D
SHA1:	AE5299244FE109595652375E28AFE81D7EFA2E71
SHA-256:	A6146C316F4289E59FCC7D72AA3FBBD71AE3B2F4587A50814CDE77FEB4CC0905
SHA-512:	C8579C01751FE4FBF2AF5A02493A244FF0C338F76ECCD6E6E535FB609090B271C8C1C1563B427740B87AE87390ED793DB6ACA4B180718FC82AB02AC31F945DBE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....-.\|.Y...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDYpd....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDYpd....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDYpd....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDYpd..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDYrd...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........w.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 14:35:25.046252012 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 4, 2024 14:35:25.077481031 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 4, 2024 14:35:25.155622005 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 4, 2024 14:35:34.665896893 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 4, 2024 14:35:34.712771893 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 4, 2024 14:35:34.775264978 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 4, 2024 14:35:36.405304909 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 4, 2024 14:35:36.406224966 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 4, 2024 14:35:37.783972025 CEST	49711	443	192.168.2.5	172.217.16.196
Oct 4, 2024 14:35:37.784013987 CEST	443	49711	172.217.16.196	192.168.2.5
Oct 4, 2024 14:35:37.788079023 CEST	49711	443	192.168.2.5	172.217.16.196
Oct 4, 2024 14:35:37.788635015 CEST	49711	443	192.168.2.5	172.217.16.196
Oct 4, 2024 14:35:37.788651943 CEST	443	49711	172.217.16.196	192.168.2.5
Oct 4, 2024 14:35:39.464070082 CEST	443	49711	172.217.16.196	192.168.2.5
Oct 4, 2024 14:35:39.464875937 CEST	49711	443	192.168.2.5	172.217.16.196
Oct 4, 2024 14:35:39.464904070 CEST	443	49711	172.217.16.196	192.168.2.5
Oct 4, 2024 14:35:39.465848923 CEST	443	49711	172.217.16.196	192.168.2.5
Oct 4, 2024 14:35:39.465976000 CEST	49711	443	192.168.2.5	172.217.16.196
Oct 4, 2024 14:35:39.471942902 CEST	49711	443	192.168.2.5	172.217.16.196
Oct 4, 2024 14:35:39.472057104 CEST	443	49711	172.217.16.196	192.168.2.5
Oct 4, 2024 14:35:39.525783062 CEST	49711	443	192.168.2.5	172.217.16.196
Oct 4, 2024 14:35:39.525804996 CEST	443	49711	172.217.16.196	192.168.2.5
Oct 4, 2024 14:35:39.572758913 CEST	49711	443	192.168.2.5	172.217.16.196
Oct 4, 2024 14:35:47.322974920 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:47.323074102 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:47.323215961 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:47.331984043 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:47.332019091 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:47.401833057 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 4, 2024 14:35:47.401833057 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 4, 2024 14:35:47.402296066 CEST	49720	443	192.168.2.5	23.1.237.91
Oct 4, 2024 14:35:47.402343035 CEST	443	49720	23.1.237.91	192.168.2.5
Oct 4, 2024 14:35:47.402971029 CEST	49720	443	192.168.2.5	23.1.237.91
Oct 4, 2024 14:35:47.402971029 CEST	49720	443	192.168.2.5	23.1.237.91
Oct 4, 2024 14:35:47.403004885 CEST	443	49720	23.1.237.91	192.168.2.5
Oct 4, 2024 14:35:47.410742044 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 4, 2024 14:35:47.410757065 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 4, 2024 14:35:48.010890007 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.010991096 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.012748957 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.012758970 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.013010979 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.019223928 CEST	443	49720	23.1.237.91	192.168.2.5
Oct 4, 2024 14:35:48.019294977 CEST	49720	443	192.168.2.5	23.1.237.91
Oct 4, 2024 14:35:48.022849083 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.067399025 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.150954008 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.150979996 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.150995970 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.151047945 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.151118040 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.151159048 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.151218891 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.468067884 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.468115091 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.468159914 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.468163013 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.468210936 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.468245029 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.468296051 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.468296051 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.469084024 CEST	443	49711	172.217.16.196	192.168.2.5
Oct 4, 2024 14:35:48.469139099 CEST	443	49711	172.217.16.196	192.168.2.5
Oct 4, 2024 14:35:48.469182014 CEST	49711	443	192.168.2.5	172.217.16.196
Oct 4, 2024 14:35:48.473433018 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.473479033 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.473494053 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.473545074 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.473551989 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.473593950 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.478990078 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.479031086 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.479068995 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.479074955 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.479130030 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.479149103 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.484136105 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.484179974 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.484261036 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.484266996 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.484307051 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.486571074 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.486612082 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.486650944 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.486655951 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.486699104 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.486712933 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.488595009 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.488634109 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.488662958 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.488667965 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.488704920 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.488732100 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.491059065 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.491097927 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.491123915 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.491128922 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.491172075 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.491190910 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.492573977 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.492615938 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.492647886 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.492652893 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.492723942 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.492723942 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.494263887 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.494313955 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.494332075 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.494338036 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.494374990 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.494394064 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.498210907 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.498250008 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.498281956 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.498286963 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.498338938 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.498357058 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.498774052 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.498815060 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.498852968 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.498857021 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.498888969 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.498903990 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.501310110 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.501348972 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.501388073 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.501401901 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.501455069 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.501456022 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.502111912 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.502290010 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.502300978 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.502342939 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.504846096 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.549804926 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.549838066 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.549875021 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.549891949 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.771555901 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.771596909 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.771663904 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.776856899 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.776870966 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.785448074 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.785480976 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.785531998 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.785784006 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.785804987 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.786798000 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.786834955 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.786900043 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.788880110 CEST	49726	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.788893938 CEST	443	49726	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.788955927 CEST	49726	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.789340973 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.789352894 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.791399002 CEST	49727	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.791409969 CEST	443	49727	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.791465044 CEST	49727	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.791649103 CEST	49727	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.791654110 CEST	443	49727	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:48.792346001 CEST	49726	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:48.792356014 CEST	443	49726	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.445523024 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.445983887 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.446002007 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.447621107 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.447624922 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.452924013 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.453651905 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.453651905 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.453680992 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.453704119 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.466294050 CEST	443	49726	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.467000008 CEST	49726	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.467000008 CEST	49726	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.467015028 CEST	443	49726	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.467031956 CEST	443	49726	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.490127087 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.490326881 CEST	443	49727	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.490865946 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.490865946 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.490880013 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.490895987 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.491404057 CEST	49727	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.491410017 CEST	443	49727	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.491525888 CEST	49727	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.491533995 CEST	443	49727	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.556790113 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.556812048 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.556880951 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.556907892 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.557128906 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.557178020 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.557178020 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.557188988 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.557197094 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.559727907 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.559746981 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.559973001 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.560010910 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.560097933 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.560127020 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.560169935 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.560170889 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.560170889 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.560188055 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.560328960 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.560337067 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.560364008 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.560471058 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.560486078 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.560523033 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.562202930 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.562218904 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.562406063 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.562406063 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.562421083 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.588191032 CEST	443	49726	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.588236094 CEST	443	49726	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.588408947 CEST	49726	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.588443041 CEST	49726	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.588443041 CEST	49726	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.588473082 CEST	443	49726	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.588494062 CEST	443	49726	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.590557098 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.590581894 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.590790033 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.590790033 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.590810061 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.603012085 CEST	443	49727	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.603039026 CEST	443	49727	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.603095055 CEST	443	49727	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.603120089 CEST	49727	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.603275061 CEST	49727	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.603275061 CEST	49727	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.603677034 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.603735924 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.603744030 CEST	49727	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.603755951 CEST	443	49727	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.603904009 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.603981972 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.603981972 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.603987932 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.603996038 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.605742931 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.605756998 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.605943918 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.605943918 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.605962992 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.606053114 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.606076956 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.606251955 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.606251955 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:49.606270075 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:49.935753107 CEST	49711	443	192.168.2.5	172.217.16.196
Oct 4, 2024 14:35:49.935782909 CEST	443	49711	172.217.16.196	192.168.2.5
Oct 4, 2024 14:35:50.223893881 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.224558115 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.224595070 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.227065086 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.227077007 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.268520117 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.272550106 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.323311090 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.323311090 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.330041885 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.330055952 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.330492973 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.330497026 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.330713987 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.330718994 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.331063032 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.331067085 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.333044052 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.333112955 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.333164930 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.333517075 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.333538055 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.333553076 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.333559036 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.337438107 CEST	49733	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.337482929 CEST	443	49733	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.337568045 CEST	49733	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.337869883 CEST	49733	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.337884903 CEST	443	49733	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.432600021 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.432665110 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.432713985 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.433146000 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.433151960 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.433163881 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.433170080 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.437500000 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.437521935 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.437603951 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.437946081 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.437977076 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.445671082 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.445739985 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.445782900 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.446075916 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.446079016 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.446088076 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.446090937 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.449959993 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.449980974 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.450047970 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.450242996 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.450254917 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.477837086 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.478338957 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.478357077 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.479556084 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.479564905 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.491530895 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.492218018 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.492235899 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.492945910 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.492952108 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.606420994 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.606498003 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.606556892 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.606715918 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.606739998 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.606750965 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.606758118 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.610867023 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.610898018 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.610955954 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.611321926 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.611330032 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.612380981 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.612545967 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.612608910 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.612643957 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.612663031 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.612672091 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.612679005 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.615947962 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.615991116 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.616051912 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.616178989 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.616194010 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.995018005 CEST	443	49733	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.995645046 CEST	49733	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.995671034 CEST	443	49733	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:50.996187925 CEST	49733	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:50.996195078 CEST	443	49733	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.112035036 CEST	443	49733	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.112096071 CEST	443	49733	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.112168074 CEST	49733	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.112412930 CEST	49733	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.112433910 CEST	443	49733	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.112448931 CEST	49733	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.112456083 CEST	443	49733	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.113888979 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.114362955 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.114377975 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.114990950 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.114995003 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.115573883 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.115611076 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.115721941 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.115847111 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.115865946 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.141330957 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.141938925 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.141958952 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.142398119 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.142402887 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.228075981 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.228245020 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.228336096 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.228396893 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.228416920 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.228426933 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.228435993 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.231236935 CEST	49739	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.231276035 CEST	443	49739	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.231398106 CEST	49739	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.231564999 CEST	49739	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.231574059 CEST	443	49739	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.257808924 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.257970095 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.258028984 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.258070946 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.258094072 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.258109093 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.258116007 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.260305882 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.260341883 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:51.260412931 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.260559082 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:51.260569096 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.317647934 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.318058014 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.318749905 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.318749905 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.318783998 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.318789959 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.319032907 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.319051027 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.319480896 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.319488049 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.432451963 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.432590008 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.432895899 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.432926893 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.432926893 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.432926893 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.432950974 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.433290958 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.433326006 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.433326006 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.433337927 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.433346033 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.435641050 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.435669899 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.435687065 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.435694933 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.435765982 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.435765982 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.435903072 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.435903072 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.435920000 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.435934067 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.520528078 CEST	443	49739	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.521554947 CEST	49739	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.521554947 CEST	49739	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.521574974 CEST	443	49739	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.521583080 CEST	443	49739	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.526320934 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.526782990 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.526807070 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.527230978 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.527236938 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.636367083 CEST	443	49739	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.636514902 CEST	443	49739	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.636671066 CEST	49739	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.636671066 CEST	49739	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.636890888 CEST	49739	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.636910915 CEST	443	49739	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.639379978 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.639426947 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.639590025 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.639667034 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.639676094 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.641022921 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.641078949 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.641232967 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.641259909 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.641259909 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.641273975 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.641282082 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.643255949 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.643338919 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.643510103 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.643569946 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.643590927 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:52.745299101 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:52.745337963 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.094470024 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.095124006 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.095144987 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.095624924 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.095629930 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.205576897 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.205631971 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.205859900 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.205929995 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.205955029 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.205964088 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.205970049 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.209319115 CEST	49745	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.209362030 CEST	443	49745	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.209429979 CEST	49745	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.209572077 CEST	49745	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.209588051 CEST	443	49745	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.282031059 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.282541037 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.282598972 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.282978058 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.282991886 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.288557053 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.288985968 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.289004087 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.289391994 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.289402962 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.310391903 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.310853958 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.310874939 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.311286926 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.311296940 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.321484089 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.321909904 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.321940899 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.322302103 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.322313070 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.390574932 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.390640020 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.390804052 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.390903950 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.390922070 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.390939951 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.390947104 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.393857956 CEST	49746	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.393892050 CEST	443	49746	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.394085884 CEST	49746	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.394284010 CEST	49746	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.394294977 CEST	443	49746	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.400122881 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.400180101 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.400233984 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.400401115 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.400407076 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.400414944 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.400418997 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.402705908 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.402754068 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.402940035 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.403115988 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.403129101 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.423454046 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.423516035 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.423664093 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.423688889 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.423701048 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.423717976 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.423726082 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.426014900 CEST	49748	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.426035881 CEST	443	49748	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.426158905 CEST	49748	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.426316977 CEST	49748	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.426323891 CEST	443	49748	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.438668013 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.438816071 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.439019918 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.439048052 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.439062119 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.439073086 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.439078093 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.441207886 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.441248894 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:53.441309929 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.441482067 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:53.441493034 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.055491924 CEST	443	49745	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.056214094 CEST	49745	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.056230068 CEST	443	49745	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.057147026 CEST	49745	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.057152033 CEST	443	49745	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.098083019 CEST	443	49746	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.099154949 CEST	49746	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.099163055 CEST	443	49746	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.099683046 CEST	49746	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.099687099 CEST	443	49746	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.104154110 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.104696989 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.104710102 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.105565071 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.105568886 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.114877939 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.115318060 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.115340948 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.115776062 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.115780115 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.177364111 CEST	443	49745	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.177531958 CEST	443	49745	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.177593946 CEST	49745	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.177740097 CEST	49745	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.177756071 CEST	443	49745	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.177767992 CEST	49745	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.177773952 CEST	443	49745	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.180857897 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.180888891 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.180960894 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.181106091 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.181117058 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.222489119 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.222654104 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.222707987 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.222785950 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.222805023 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.222824097 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.222831011 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.223458052 CEST	443	49746	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.223517895 CEST	443	49746	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.223587036 CEST	49746	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.223721027 CEST	49746	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.223737001 CEST	443	49746	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.223751068 CEST	49746	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.223757982 CEST	443	49746	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.226943970 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.226957083 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.227010012 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.227312088 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.227422953 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.227550983 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.227873087 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.227884054 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.227946043 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.227977037 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.228322983 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.228465080 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.228529930 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.228565931 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.228565931 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.228583097 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.228593111 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.231329918 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.231410980 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.231502056 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.231631994 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.231652975 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.884635925 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.885150909 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.885184050 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.885608912 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.885615110 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.891844988 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.892376900 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.892405033 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.892695904 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.892700911 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.901989937 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.902417898 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.902452946 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.902825117 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.902838945 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.912033081 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.912830114 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.912830114 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:54.912904978 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:54.912938118 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.003710032 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.003870964 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.004070997 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.004070997 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.004070997 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.006812096 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.006913900 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.007092953 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.007170916 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.007189989 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.009073973 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.009129047 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.009375095 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.009375095 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.009569883 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.009583950 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.011565924 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.011605024 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.011778116 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.011821985 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.011831045 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.015672922 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.015815973 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.015925884 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.015925884 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.015925884 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.017709017 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.017784119 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.017970085 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.017970085 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.018039942 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.026290894 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.026369095 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.026650906 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.026757956 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.026757956 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.026776075 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.026786089 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.029057980 CEST	49757	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.029082060 CEST	443	49757	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.029304981 CEST	49757	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.029304981 CEST	49757	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.029335022 CEST	443	49757	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.307632923 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.307645082 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.323273897 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.323297977 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.680311918 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.680871010 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.680880070 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.681550026 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.681554079 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.700186968 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.700561047 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.700917959 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.700978041 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.700994015 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.701041937 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.701252937 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.701261997 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.701533079 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.701545954 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.725362062 CEST	443	49757	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.727410078 CEST	49757	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.727410078 CEST	49757	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.727421045 CEST	443	49757	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.727432013 CEST	443	49757	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.799346924 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.799405098 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.799634933 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.799937963 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.799937963 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.799979925 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.800026894 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.802674055 CEST	49758	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.802699089 CEST	443	49758	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.802958965 CEST	49758	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.802958965 CEST	49758	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.802983046 CEST	443	49758	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.815956116 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.816109896 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.816237926 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.816239119 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.816569090 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.816643953 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.816682100 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.816714048 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.816869974 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.816869974 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.818454981 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.818459034 CEST	49759	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.818481922 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.818510056 CEST	443	49759	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.818716049 CEST	49759	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.818716049 CEST	49759	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.818783998 CEST	443	49759	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.818806887 CEST	49760	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.818825960 CEST	443	49760	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.819015026 CEST	49760	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.819015026 CEST	49760	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.819073915 CEST	443	49760	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.837842941 CEST	443	49757	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.837917089 CEST	443	49757	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.837970972 CEST	49757	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.838234901 CEST	49757	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.838243961 CEST	443	49757	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.838274956 CEST	49757	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.838279963 CEST	443	49757	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.840709925 CEST	49761	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.840725899 CEST	443	49761	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:55.840781927 CEST	49761	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.841497898 CEST	49761	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:55.841506958 CEST	443	49761	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:56.476170063 CEST	443	49758	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:56.477238894 CEST	49758	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:56.477243900 CEST	443	49758	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:56.477561951 CEST	49758	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:56.477571964 CEST	443	49758	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:56.491228104 CEST	443	49760	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:56.491694927 CEST	49760	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:56.491720915 CEST	443	49760	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:56.491899967 CEST	443	49759	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:56.492291927 CEST	49759	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:56.492291927 CEST	49760	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:56.492300987 CEST	443	49759	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:56.492316008 CEST	443	49760	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:56.492705107 CEST	49759	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:56.492708921 CEST	443	49759	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:56.509527922 CEST	443	49761	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:56.510097980 CEST	49761	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:56.510111094 CEST	443	49761	13.107.253.45	192.168.2.5
Oct 4, 2024 14:35:56.510637045 CEST	49761	443	192.168.2.5	13.107.253.45
Oct 4, 2024 14:35:56.510649920 CEST	443	49761	13.107.253.45	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 14:35:33.747298956 CEST	53	56788	1.1.1.1	192.168.2.5
Oct 4, 2024 14:35:33.777203083 CEST	53	60981	1.1.1.1	192.168.2.5
Oct 4, 2024 14:35:34.778091908 CEST	53	55268	1.1.1.1	192.168.2.5
Oct 4, 2024 14:35:34.985899925 CEST	54365	53	192.168.2.5	1.1.1.1
Oct 4, 2024 14:35:34.986658096 CEST	60303	53	192.168.2.5	1.1.1.1
Oct 4, 2024 14:35:34.996716022 CEST	53	54365	1.1.1.1	192.168.2.5
Oct 4, 2024 14:35:35.007220030 CEST	58516	53	192.168.2.5	1.1.1.1
Oct 4, 2024 14:35:35.017595053 CEST	53	60303	1.1.1.1	192.168.2.5
Oct 4, 2024 14:35:35.041084051 CEST	53	58516	1.1.1.1	192.168.2.5
Oct 4, 2024 14:35:35.071274996 CEST	52958	53	192.168.2.5	1.1.1.1
Oct 4, 2024 14:35:35.071300030 CEST	51686	53	192.168.2.5	8.8.8.8
Oct 4, 2024 14:35:35.078463078 CEST	53	52958	1.1.1.1	192.168.2.5
Oct 4, 2024 14:35:35.078557014 CEST	53	51686	8.8.8.8	192.168.2.5
Oct 4, 2024 14:35:36.081096888 CEST	52065	53	192.168.2.5	1.1.1.1
Oct 4, 2024 14:35:36.081358910 CEST	61248	53	192.168.2.5	1.1.1.1
Oct 4, 2024 14:35:36.091792107 CEST	53	61248	1.1.1.1	192.168.2.5
Oct 4, 2024 14:35:36.094238997 CEST	53	52065	1.1.1.1	192.168.2.5
Oct 4, 2024 14:35:37.762927055 CEST	52434	53	192.168.2.5	1.1.1.1
Oct 4, 2024 14:35:37.762927055 CEST	59431	53	192.168.2.5	1.1.1.1
Oct 4, 2024 14:35:37.776138067 CEST	53	52434	1.1.1.1	192.168.2.5
Oct 4, 2024 14:35:37.778294086 CEST	53	59431	1.1.1.1	192.168.2.5
Oct 4, 2024 14:35:41.125510931 CEST	57891	53	192.168.2.5	1.1.1.1
Oct 4, 2024 14:35:41.125734091 CEST	56475	53	192.168.2.5	1.1.1.1
Oct 4, 2024 14:35:41.136282921 CEST	53	56475	1.1.1.1	192.168.2.5
Oct 4, 2024 14:35:41.162616014 CEST	53	57891	1.1.1.1	192.168.2.5
Oct 4, 2024 14:35:41.170619965 CEST	60148	53	192.168.2.5	1.1.1.1
Oct 4, 2024 14:35:41.182720900 CEST	53	60148	1.1.1.1	192.168.2.5
Oct 4, 2024 14:35:52.323160887 CEST	53	59808	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 4, 2024 14:35:35.017908096 CEST	192.168.2.5	1.1.1.1	c230	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 14:35:34.985899925 CEST	192.168.2.5	1.1.1.1	0xd136	Standard query (0)	mauzanapsusi.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:34.986658096 CEST	192.168.2.5	1.1.1.1	0x67c2	Standard query (0)	mauzanapsusi.com	65	IN (0x0001)	false
Oct 4, 2024 14:35:35.007220030 CEST	192.168.2.5	1.1.1.1	0xaa64	Standard query (0)	mauzanapsusi.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:35.071274996 CEST	192.168.2.5	1.1.1.1	0x968a	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:35.071300030 CEST	192.168.2.5	8.8.8.8	0x2b0f	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:36.081096888 CEST	192.168.2.5	1.1.1.1	0xaf06	Standard query (0)	mauzanapsusi.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:36.081358910 CEST	192.168.2.5	1.1.1.1	0x26e1	Standard query (0)	mauzanapsusi.com	65	IN (0x0001)	false
Oct 4, 2024 14:35:37.762927055 CEST	192.168.2.5	1.1.1.1	0xec70	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:37.762927055 CEST	192.168.2.5	1.1.1.1	0xc357	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 4, 2024 14:35:41.125510931 CEST	192.168.2.5	1.1.1.1	0x466	Standard query (0)	mauzanapsusi.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:41.125734091 CEST	192.168.2.5	1.1.1.1	0x2f85	Standard query (0)	mauzanapsusi.com	65	IN (0x0001)	false
Oct 4, 2024 14:35:41.170619965 CEST	192.168.2.5	1.1.1.1	0x2621	Standard query (0)	mauzanapsusi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 4, 2024 14:35:34.996716022 CEST	1.1.1.1	192.168.2.5	0xd136	Name error (3)	mauzanapsusi.com	none	none	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:35.017595053 CEST	1.1.1.1	192.168.2.5	0x67c2	Name error (3)	mauzanapsusi.com	none	none	65	IN (0x0001)	false
Oct 4, 2024 14:35:35.041084051 CEST	1.1.1.1	192.168.2.5	0xaa64	Name error (3)	mauzanapsusi.com	none	none	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:35.078463078 CEST	1.1.1.1	192.168.2.5	0x968a	No error (0)	google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:35.078557014 CEST	8.8.8.8	192.168.2.5	0x2b0f	No error (0)	google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:36.091792107 CEST	1.1.1.1	192.168.2.5	0x26e1	Name error (3)	mauzanapsusi.com	none	none	65	IN (0x0001)	false
Oct 4, 2024 14:35:36.094238997 CEST	1.1.1.1	192.168.2.5	0xaf06	Name error (3)	mauzanapsusi.com	none	none	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:37.776138067 CEST	1.1.1.1	192.168.2.5	0xec70	No error (0)	www.google.com		172.217.16.196	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:37.778294086 CEST	1.1.1.1	192.168.2.5	0xc357	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 4, 2024 14:35:41.136282921 CEST	1.1.1.1	192.168.2.5	0x2f85	Name error (3)	mauzanapsusi.com	none	none	65	IN (0x0001)	false
Oct 4, 2024 14:35:41.162616014 CEST	1.1.1.1	192.168.2.5	0x466	Name error (3)	mauzanapsusi.com	none	none	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:41.182720900 CEST	1.1.1.1	192.168.2.5	0x2621	Name error (3)	mauzanapsusi.com	none	none	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:45.801883936 CEST	1.1.1.1	192.168.2.5	0x645	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:45.801883936 CEST	1.1.1.1	192.168.2.5	0x645	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:46.660376072 CEST	1.1.1.1	192.168.2.5	0xf816	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 14:35:46.660376072 CEST	1.1.1.1	192.168.2.5	0xf816	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 4, 2024 14:35:47.317325115 CEST	1.1.1.1	192.168.2.5	0x956a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 14:35:47.317325115 CEST	1.1.1.1	192.168.2.5	0x956a	No error (0)	dual.s-part-0017.t-0009.fb-t-msedge.net	s-part-0017.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 14:35:47.317325115 CEST	1.1.1.1	192.168.2.5	0x956a	No error (0)	s-part-0017.t-0009.fb-t-msedge.net		13.107.253.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49718	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:48 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:48 UTC	561	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:48 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 30 Sep 2024 13:16:38 GMT ETag: "0x8DCE1521DF74B57" x-ms-request-id: 90766f9b-701e-006f-578c-15afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123548Z-1767f7688dcjtlndds9yaebhvs00000004tg00000000ewr1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:48 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-04 12:35:48 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-04 12:35:48 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-04 12:35:48 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-04 12:35:48 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-04 12:35:48 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-04 12:35:48 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-04 12:35:48 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-04 12:35:48 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-04 12:35:48 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49722	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:49 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:49 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:49 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1cc2ff82-e01e-0071-478c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123549Z-r154656d9bcvjnbgheqhz2uek80000000ms00000000010h2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:49 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49725	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:49 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:49 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:49 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b9d87bc3-001e-008d-128c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123549Z-1767f7688dccc6lkbm0py95vf00000000mvg000000002fmk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:49 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49726	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:49 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:49 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4b0a31e7-c01e-00ad-448c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123549Z-1767f7688dcxs7gvbd5dcgxeys0000000mag00000000b0rm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:49 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49724	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:49 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:49 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: eb718e1d-001e-000b-2c22-1615a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123549Z-r154656d9bcq72z5pzdegcf4nn0000000360000000001w1k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:49 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49727	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:49 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:49 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:49 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 39d43082-801e-00ac-658c-15fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123549Z-1767f7688dc7tjsxtc1ffgx97w0000000mkg00000000crrc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:49 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49728	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:50 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:50 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: aa8826a4-b01e-0053-608c-15cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123550Z-r154656d9bckpfgl7fe14swubc0000000a50000000004ytk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:50 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49730	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:50 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:50 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 24b39cfc-301e-0096-2a8c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123550Z-1767f7688dc4gvn6w3bs6a6k900000000mng00000000eg10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:50 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49729	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:50 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:50 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:50 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 757ce4f4-401e-000a-128c-154a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123550Z-1767f7688dc7tjsxtc1ffgx97w0000000mh000000000eqrt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:50 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49732	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:50 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:50 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:50 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: b2393cc3-501e-005b-768c-15d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123550Z-r154656d9bccl8jh8cxn9cxxcs00000009z000000000kawf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:50 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49731	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:50 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:50 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:50 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 3a0dc1eb-601e-0032-608c-15eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123550Z-1767f7688dcdss7lwsep0egpxs0000000mhg000000002hxh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:50 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49733	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:50 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:51 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:51 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 023e3708-a01e-003d-568c-1598d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123551Z-1767f7688dc5kg9bwc8fvfnfb40000000mu00000000040kh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:51 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49735	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:51 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:51 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:51 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 1cc301ca-e01e-0071-6f8c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123551Z-r154656d9bcpkd87yvea8r1dfg00000009pg000000003m4c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:51 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49734	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:51 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:51 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:51 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 1cc301c6-e01e-0071-6b8c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123551Z-1767f7688dc88qkvtwr7dy4vdn00000005xg00000000azr2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:51 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49737	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:52 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:52 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 023e3944-a01e-003d-708c-1598d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123552Z-1767f7688dccc6lkbm0py95vf00000000mu0000000007ute x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:52 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49736	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:52 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:52 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:52 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: e0871f45-901e-00a0-0d8c-156a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123552Z-r154656d9bcgk58qzsfr5pfzg40000000mh000000000ht42 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:52 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49739	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:52 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:52 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:52 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: dae66c3e-d01e-0066-08a4-15ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123552Z-1767f7688dcbnsdm0gwhnpm7xw00000007300000000061kk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-04 12:35:52 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49738	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:52 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:52 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:52 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: a68dfe67-f01e-0052-588c-159224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123552Z-r154656d9bcpkd87yvea8r1dfg00000009pg000000003m6u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:52 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49740	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:53 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:53 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 24b39fc0-301e-0096-298c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123553Z-r154656d9bcrxcdc4sxf91b6u4000000048g00000000earb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:53 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49742	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:53 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:53 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: dc68ccfc-201e-006e-438c-15bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123553Z-r154656d9bcqqgssyv95384a1c0000000mkg00000000cq10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:53 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49741	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:53 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:53 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 79ade187-001e-0065-788c-150b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123553Z-1767f7688dccc6lkbm0py95vf00000000mp000000000mkbt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:53 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49744	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:53 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: eee776c4-301e-001f-2622-16aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123553Z-r154656d9bc4v6bg39gwnbf5vn000000025000000000dhan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49743	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:53 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:53 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:53 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0da94923-701e-0097-168c-15b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123553Z-1767f7688dc7tjsxtc1ffgx97w0000000mg000000000ghe5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:53 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49745	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:54 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:54 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:54 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: cbb27a59-501e-0047-64a4-15ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123554Z-r154656d9bcjpgqtzd4z33r5yn0000000a4g000000001gqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-04 12:35:54 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49746	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:54 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:54 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f71a7e49-201e-000c-5aa4-1579c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123554Z-1767f7688dc2kzqgyrtc6e2gp40000000ma000000000nexk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:54 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49747	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:54 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:54 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 82f8b22c-c01e-0014-5a8c-15a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123554Z-r154656d9bcdp2lt7d5tpscfcn0000000mpg00000000depc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:54 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49749	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:54 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:54 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:54 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: aa8ba4f5-b01e-0053-428d-15cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123554Z-1767f7688dcxs7gvbd5dcgxeys0000000m9g00000000dbmx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-04 12:35:54 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49750	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:54 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:54 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a910d2e0-401e-005b-72a6-159c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123554Z-1767f7688dcxjm7c0w73xyx8vs0000000msg00000000avxd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:55 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49751	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:54 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:55 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:54 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: cce90406-001e-005a-059e-15c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123554Z-1767f7688dczvnhxbpcveghk5g000000074g000000003wh5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-04 12:35:55 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49753	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:54 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:55 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:54 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: a7623418-001e-00a2-348c-15d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123554Z-r154656d9bclprr71vn2nvcemn0000000mp0000000007gzq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:55 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49752	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:54 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:54 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c2ca9d4d-801e-0035-458c-15752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123554Z-r154656d9bcx62tnuqgh46euy400000003pg000000005bs6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:55 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49754	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:55 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:55 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 4b0a3852-c01e-00ad-3b8c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123555Z-r154656d9bcp2td5zh846myygg0000000mq0000000002ntp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:55 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49755	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:55 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:55 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: eccf174e-001e-0079-238c-1512e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123555Z-1767f7688dczvnhxbpcveghk5g000000070g00000000eb07 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:55 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49756	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:55 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:55 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 4fef4e97-801e-007b-44c7-15e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123555Z-r154656d9bc6kzfwvnn9vvz3c4000000016g00000000b3hc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:55 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49757	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:55 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:55 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 4ee1628f-b01e-0098-52a6-15cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123555Z-1767f7688dcwt84hd6d7u4c7700000000mpg00000000a519 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:55 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49758	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:56 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:56 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:56 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4da5bf60-a01e-0070-668c-15573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123556Z-1767f7688dc5smv9fdkth3nru00000000me000000000mrum x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:56 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49760	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:56 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:56 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:56 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 70979e43-c01e-00a1-459c-157e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123556Z-1767f7688dcrppb7pkfhksct680000000m9000000000bz5r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-04 12:35:56 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49759	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:56 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:56 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 4700277e-801e-008f-589e-152c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123556Z-r154656d9bclhnqxthdkb0ps8000000003k0000000008pa4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:56 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49761	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:56 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:56 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 9bed673a-001e-0046-278c-15da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123556Z-1767f7688dc97m2se6u6hv4664000000039g00000000fk8z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:56 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49748	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:57 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:57 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:57 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 30fd46b0-d01e-00a1-368c-1535b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123557Z-1767f7688dcjgr4ssr2c6t2x2s0000000mq000000000mpv7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:57 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49762	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:57 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:57 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:57 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: ed9c017d-601e-000d-3e22-162618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123557Z-r154656d9bcwbfnhhnwdxge6u000000002000000000021w8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-04 12:35:57 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49763	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:57 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:57 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:57 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cbb781ac-501e-0047-14a6-15ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123557Z-1767f7688dcpgsfr1x222ta0gg00000002a00000000034mk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-04 12:35:57 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49764	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:57 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:57 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:57 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c28afb02-b01e-0097-6b28-164f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123557Z-r154656d9bcc4snr2sy7ntt13c000000070g000000007n1w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:57 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49765	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:57 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:57 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:57 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 1f480944-c01e-002b-018c-156e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123557Z-1767f7688dcp6rq9vksdbz5r100000000mf000000000dk64 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:57 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49766	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-04 12:35:57 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 12:35:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 12:35:57 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: c54fbac1-901e-008f-588c-1567a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T123557Z-1767f7688dcrlt4tm55zgvcmun0000000mgg000000006h9x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 12:35:58 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 4088, Parent PID: 5744

General

Target ID:	0
Start time:	08:35:26
Start date:	04/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3992, Parent PID: 4088

General

Target ID:	2
Start time:	08:35:31
Start date:	04/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2608 --field-trial-handle=2192,i,8595022831753486897,13261828926118445509,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 760, Parent PID: 5744

General

Target ID:	3
Start time:	08:35:34
Start date:	04/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://mauzanapsusi.com"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://mauzanapsusi.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 4088, Parent PID: 5744

General

Chronological Activities

Analysis Process: chrome.exePID: 3992, Parent PID: 4088

General

Chronological Activities

Analysis Process: chrome.exePID: 760, Parent PID: 5744

General

Chronological Activities

Windows Analysis Report
http://mauzanapsusi.com