Edit tour

Windows Analysis Report
https://us-usps-wukhzy.xyz/update/

Overview

General Information

Sample URL:	https://us-usps-wukhzy.xyz/update/
Analysis ID:	1526978
Tags:	openphish
Infos:

Errors URL not reachable

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Performs DNS queries to domains with low reputation

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2556 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3868 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2000,i,17161473894225688281,10000816620996369041,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6776 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-usps-wukhzy.xyz/update/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://us-usps-wukhzy.xyz/update/

SlashNext: detection malicious, Label: Fraudulent Website type: Phishing & Social Engineering

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49718 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.5:49722 version: TLS 1.2

Networking

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-wukhzy.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-wukhzy.xyz
Source:	DNS query: us-usps-wukhzy.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-wukhzy.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-wukhzy.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-wukhzy.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-wukhzy.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-wukhzy.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-wukhzy.xyz
Source:	DNS query: us-usps-wukhzy.xyz

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49718 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: us-usps-wukhzy.xyz
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.5:49722 version: TLS 1.2

Source: classification engine

Classification label: mal52.troj.win@19/6@14/3

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2000,i,17161473894225688281,10000816620996369041,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-usps-wukhzy.xyz/update/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2000,i,17161473894225688281,10000816620996369041,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://us-usps-wukhzy.xyz/update/	100%	SlashNext	Fraudulent Website type: Phishing & Social Engineering

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
google.com	142.250.184.206	true	false	unknown
s-part-0044.t-0009.fb-t-msedge.net	13.107.253.72	true	false	unknown
www.google.com	216.58.206.68	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
us-usps-wukhzy.xyz	unknown	unknown	true	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved		unknown	unknown	false
216.58.206.68	www.google.com	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526978
Start date and time:	2024-10-06 18:47:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://us-usps-wukhzy.xyz/update/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.troj.win@19/6@14/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	URL browsing timeout or error

Errors

URL not reachable

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.195, 66.102.1.84, 142.250.185.206, 34.104.35.123, 184.28.90.27, 199.232.210.172, 20.109.210.53, 192.229.221.95, 13.95.31.18
Excluded domains from analysis (whitelisted): azurefd-t-fb-prod.trafficmanager.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, ocsp.digicert.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, azureedge-t-prod.trafficmanager.net, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://us-usps-wukhzy.xyz/update/

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 6 15:48:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.967658895189168
Encrypted:	false
SSDEEP:	48:8edST0LKY0H5idAKZdA19ehwiZUklqehLy+3:8TQmYyky
MD5:	492430770D56C15939712664BA2F638F
SHA1:	5D0577F91781BF608962D56A2B417C3F4FC33DD7
SHA-256:	F5AC8415BA65394E0013F507CB7BFDE55C9F457065C6973E11FEEF0591845982
SHA-512:	B59DDFA33B80AFF77D4770130D355323363AE69AC1F6873D97F0B4159E6D43F0B8BD3840B51D22E459EB4E4D2AD30C82A48E2821C2F623B96561D31C4B3280DF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......`.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IFY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............U.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 6 15:48:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.983974860585648
Encrypted:	false
SSDEEP:	48:8OdST0LKY0H5idAKZdA1weh/iZUkAQkqehUy+2:8jQmYo9QBy
MD5:	4C618CF2537BC5BB20C38B654E4A9ADD
SHA1:	F8BB3CB5C6A1EC11E4C0CA4A3B52A36BC147F730
SHA-256:	5F7495F4CCAA4F47CD052BDFF478CC8E1C50050BB9246A71D70F900EDA97A71E
SHA-512:	A6C9A4298876A0E5B099D69555A2A913E629A518B2F49DBFF64A1735536936798E9EE1669FD304D08F959BDB9FD6023A0050705984423B4C90CD7D2F1A0D62E0
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......Q.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IFY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............U.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.9933761889901116
Encrypted:	false
SSDEEP:	48:8xDdST0LKsH5idAKZdA14tseh7sFiZUkmgqeh7sSy+BX:8xgQmonoy
MD5:	6C3A6CC56CB6AEC2902B28B7BEF55926
SHA1:	9C520723EBB2E3F9A89490672799F2ADF5556837
SHA-256:	C44E626D646ED3D6A10CEB196E67ABA54597CABCA78FCC9B285AA44719ABF6CF
SHA-512:	119E57593330387DBEB9EE17FBE6FCCDDC40B2CF87CE05134BA2D92FE37851B7644A1B4C625EF29ACA325FC13AB6EF84215739085631B9352DC54788D3E94F14
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IFY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............U.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 6 15:48:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9802421416713902
Encrypted:	false
SSDEEP:	48:87dST0LKY0H5idAKZdA1vehDiZUkwqehAy+R:84QmYzKy
MD5:	7DA03ED117808C0A83800B6A249A06EE
SHA1:	DBAB1CA2DFD1AB6189179E5BD3C0BDADEDE41648
SHA-256:	522A53AF31EB715BB828AA94D100C6B030862B657F964DDC9BFD0656E82602A0
SHA-512:	118A623A95FE6B468372DFB0092092177F23C00AD91F5D46741B1A8CA29085B416395B128E2268DFB5C0A2B3DB6CEAC1666F9682E7C1E0F0786DE46753715AAF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....K/H.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IFY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............U.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 6 15:48:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9694949860749835
Encrypted:	false
SSDEEP:	48:8PdST0LKY0H5idAKZdA1hehBiZUk1W1qehWy+C:88QmYj92y
MD5:	70CE82F8A72BDA433673B0FFBF3AC48E
SHA1:	B87BB38F14E2BF07A4248810A1AC46746148DDD5
SHA-256:	513E88B780EC5EC49A336556319A6867305F70AB955408C22363DFE38715984F
SHA-512:	B94224CCB7721FA3BA4D9732B49E56B6AF9ACD8E17261EF28B75D156136C1E1081753E28DDE51F22CFB0698EC16832B7BB9371B6711D7CFDD6272C1AC334E93B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...._.X.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IFY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............U.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 6 15:48:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.979561761079626
Encrypted:	false
SSDEEP:	48:8FdST0LKY0H5idAKZdA1duT+ehOuTbbiZUk5OjqehOuTboy+yT+:8qQmYTT/TbxWOvTboy7T
MD5:	859E6F47FACFC1B1DC49B0C317C443ED
SHA1:	FD8BAE1A42600998BE48DC2EF503310734EADC51
SHA-256:	6D8CECA125B1C22F7BEA2032C30AA0C08AB74E5C0E621A4B259453EEC8E0909A
SHA-512:	E72C41B9768321C09373A1AF00AAA5DF40DC4B24F8866BE78B51D82291BBFF598E0C0F395A9C21334296E4EA03A3D65068FDE51E56B82248D194B500A47329E1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......>.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IFY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............U.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 18:47:54.831691027 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:47:54.941063881 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:47:54.941194057 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:48:04.607562065 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:48:04.607569933 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:48:04.607569933 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:48:06.148309946 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 6, 2024 18:48:06.148514032 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:48:08.788783073 CEST	49711	443	192.168.2.5	216.58.206.68
Oct 6, 2024 18:48:08.788873911 CEST	443	49711	216.58.206.68	192.168.2.5
Oct 6, 2024 18:48:08.789596081 CEST	49711	443	192.168.2.5	216.58.206.68
Oct 6, 2024 18:48:08.790097952 CEST	49711	443	192.168.2.5	216.58.206.68
Oct 6, 2024 18:48:08.790132046 CEST	443	49711	216.58.206.68	192.168.2.5
Oct 6, 2024 18:48:09.432723999 CEST	443	49711	216.58.206.68	192.168.2.5
Oct 6, 2024 18:48:09.437688112 CEST	49711	443	192.168.2.5	216.58.206.68
Oct 6, 2024 18:48:09.437784910 CEST	443	49711	216.58.206.68	192.168.2.5
Oct 6, 2024 18:48:09.439403057 CEST	443	49711	216.58.206.68	192.168.2.5
Oct 6, 2024 18:48:09.439501047 CEST	49711	443	192.168.2.5	216.58.206.68
Oct 6, 2024 18:48:09.442415953 CEST	49711	443	192.168.2.5	216.58.206.68
Oct 6, 2024 18:48:09.442519903 CEST	443	49711	216.58.206.68	192.168.2.5
Oct 6, 2024 18:48:09.513895035 CEST	49711	443	192.168.2.5	216.58.206.68
Oct 6, 2024 18:48:09.513925076 CEST	443	49711	216.58.206.68	192.168.2.5
Oct 6, 2024 18:48:09.639259100 CEST	49711	443	192.168.2.5	216.58.206.68
Oct 6, 2024 18:48:16.930080891 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:48:16.935590982 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 6, 2024 18:48:16.936722994 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:48:16.938491106 CEST	49718	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:48:16.938585997 CEST	443	49718	23.1.237.91	192.168.2.5
Oct 6, 2024 18:48:16.938920021 CEST	49718	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:48:16.942014933 CEST	49718	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:48:16.942014933 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 6, 2024 18:48:16.942039013 CEST	443	49718	23.1.237.91	192.168.2.5
Oct 6, 2024 18:48:17.530061960 CEST	443	49718	23.1.237.91	192.168.2.5
Oct 6, 2024 18:48:17.530153990 CEST	49718	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:48:18.477813005 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:18.477869034 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:18.478367090 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:18.480122089 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:18.480156898 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.162636995 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.162996054 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.211256981 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.211301088 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.211637974 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.222830057 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.263493061 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.335583925 CEST	443	49711	216.58.206.68	192.168.2.5
Oct 6, 2024 18:48:19.335732937 CEST	443	49711	216.58.206.68	192.168.2.5
Oct 6, 2024 18:48:19.336071968 CEST	49711	443	192.168.2.5	216.58.206.68
Oct 6, 2024 18:48:19.352673054 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.352699995 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.352746010 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.352950096 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.353024006 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.353070974 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.353408098 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.436741114 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.436762094 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.436888933 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.436952114 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.437067032 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.443238020 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.443250895 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.443342924 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.443423986 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.443773031 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.526521921 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.526546001 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.526742935 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.526807070 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.526887894 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.527601004 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.527623892 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.527686119 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.527703047 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.527802944 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.529247046 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.529272079 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.529360056 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.529373884 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.529438019 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.533509970 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.533533096 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.533643007 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.533658028 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.533714056 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.617070913 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.617089987 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.617180109 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.617247105 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.617309093 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.617938995 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.617953062 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.618016005 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.618031979 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.618156910 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.618830919 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.618845940 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.618927002 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.618941069 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.618993998 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.619853973 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.619868994 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.619935036 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.619949102 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.620016098 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.620659113 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.620673895 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.620752096 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.620764971 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.620831013 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.621644020 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.621659040 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.621733904 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.621747971 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.621809006 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.621865988 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.621881008 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.621906042 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.621953964 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.622148991 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.622184992 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.622212887 CEST	49722	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.622226954 CEST	443	49722	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.737189054 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.737241030 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.737373114 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.739272118 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.739403009 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.739581108 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.741342068 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.741379976 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.741455078 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.741835117 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.741848946 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.741913080 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.741944075 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.743191957 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.743199110 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.743504047 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.744182110 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.744223118 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.745235920 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.745265961 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.745417118 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.745635033 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.745659113 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:19.745855093 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:19.745867014 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.401690006 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.404851913 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.404912949 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.405680895 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.405694962 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.415934086 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.416529894 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.416680098 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.416724920 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.417934895 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.418154955 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.418162107 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.418812037 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.418834925 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.419905901 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.419910908 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.420398951 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.421128035 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.421164036 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.422216892 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.422229052 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.422522068 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.422530890 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.423149109 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.423155069 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.470967054 CEST	49711	443	192.168.2.5	216.58.206.68
Oct 6, 2024 18:48:20.471003056 CEST	443	49711	216.58.206.68	192.168.2.5
Oct 6, 2024 18:48:20.687066078 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687068939 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687087059 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687136889 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687156916 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687189102 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.687206984 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.687403917 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687422991 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687453032 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687465906 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687505960 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.687530041 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687558889 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687561035 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.687568903 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.687602997 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.687791109 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687841892 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687863111 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.687880039 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.687886000 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687896967 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.687959909 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.688138962 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.690473080 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.690479040 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.691462994 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.691481113 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.692405939 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.692420959 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.692497015 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.692502022 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.693332911 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.693336964 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.698530912 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.698554039 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.698616982 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.701006889 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.701097012 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.701255083 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.702945948 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.702981949 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.703049898 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.703268051 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.703279018 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.704046965 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.704055071 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.704152107 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.704320908 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.704329967 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.705365896 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.705393076 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.705447912 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.705642939 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.705698967 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.705936909 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.705964088 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:20.706063986 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:20.706077099 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.508614063 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.509125948 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.509176970 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.509578943 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.509586096 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.515324116 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.515671968 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.515710115 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.516052961 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.516058922 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.516232967 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.516413927 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.516495943 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.516508102 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.516746044 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.516818047 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.516891956 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.516896963 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.516906023 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.517155886 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.517173052 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.517312050 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.517338037 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.517620087 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.517625093 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.617552996 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.617633104 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.617784977 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.617826939 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.617849112 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.617866039 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.617872953 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.620537996 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.620574951 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.620650053 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.620819092 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.620832920 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.621644020 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.621795893 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.621855974 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.621906042 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.621906042 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.621922970 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.621933937 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.624315023 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.624324083 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.624393940 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.624490023 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.624500990 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.626192093 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.626334906 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.626393080 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.626435995 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.626435995 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.626442909 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.626451015 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.627269983 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.627445936 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.627513885 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.627593040 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.627593040 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.627645969 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.627666950 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.628676891 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.628722906 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.628782988 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.628911018 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.628938913 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.629039049 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.629177094 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.629261017 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.629509926 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.629513979 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.629519939 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.629535913 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.629540920 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.629599094 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.630027056 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.630134106 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.630162954 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.631488085 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.631573915 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:21.631649017 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.631772995 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:21.631803989 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.282171965 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.282654047 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.282677889 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.283107042 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.283112049 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.285861015 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.286196947 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.286267996 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.286545038 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.286557913 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.287492037 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.287775993 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.287837982 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.288109064 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.288122892 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.302309036 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.302639008 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.302647114 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.303020000 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.303025007 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.337632895 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.338007927 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.338064909 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.338386059 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.338399887 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.387929916 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.388098001 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.388174057 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.388201952 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.388219118 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.388226986 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.388232946 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.390726089 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.390784025 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.390902042 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.391033888 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.391062021 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.394272089 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.394413948 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.394529104 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.394607067 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.394607067 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.394651890 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.394680023 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.395114899 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.395248890 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.395401955 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.395483971 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.395523071 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.395572901 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.395589113 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.397445917 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.397516012 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.397600889 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.397730112 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.397738934 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.397775888 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.397814035 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.397890091 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.397994041 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.398030043 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.414849043 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.414916992 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.414966106 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.415018082 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.415023088 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.415050983 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.415054083 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.416790962 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.416825056 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.416970015 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.417092085 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.417110920 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.452557087 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.452685118 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.452855110 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.452990055 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.452990055 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.453033924 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.453064919 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.455837011 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.455851078 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:22.455981970 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.456098080 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:22.456108093 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.094538927 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.094957113 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.095005035 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.095037937 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.095345020 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.095417976 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.095467091 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.095479012 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.095918894 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.095933914 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.114952087 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.115086079 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.115345001 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.115382910 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.115454912 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.115463972 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.115905046 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.115910053 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.116039991 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.116050005 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.122493982 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.122781038 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.122790098 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.123152018 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.123157024 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.201884031 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.202018976 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.202085972 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.202163935 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.202194929 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.202209949 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.202218056 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.204941988 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.204991102 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.205132008 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.205287933 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.205311060 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.209446907 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.209532976 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.209635019 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.209712029 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.209712029 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.209754944 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.209795952 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.211467981 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.211502075 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.211566925 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.211666107 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.211677074 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.224284887 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.224348068 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.224422932 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.224484921 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.224498987 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.224509954 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.224515915 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.226968050 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.227052927 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.227133989 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.227264881 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.227298975 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.238167048 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.238245010 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.238322020 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.238343954 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.238353968 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.238357067 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.238368034 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.238373995 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.238420963 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.238500118 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.238678932 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.238678932 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.238714933 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.238739967 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.239981890 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.240005970 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.240094900 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.240189075 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.240214109 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.240499973 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.240513086 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.240736961 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.240854979 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.240868092 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.861695051 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.862540960 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.862560987 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.864095926 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.864101887 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.890119076 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.890172005 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.890541077 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.890597105 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.890942097 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.890957117 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.890954018 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.891032934 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.891447067 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.891459942 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.895428896 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.895787954 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.895802975 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.897990942 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.898000002 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.901583910 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.901940107 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.901963949 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.902239084 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.902249098 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.969249964 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.969376087 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.969535112 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.969535112 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.969635010 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.969651937 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.972660065 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.972708941 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.972887039 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.972887039 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.972939014 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.997906923 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.997976065 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.998193979 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.998337984 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.998338938 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:23.998383045 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:23.998409033 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.001066923 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.001111031 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.001184940 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.001542091 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.001554966 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.003315926 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.003478050 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.003732920 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.003791094 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.003820896 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.003856897 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.003873110 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.006455898 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.006468058 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.006536007 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.006743908 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.006756067 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.007291079 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.007369995 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.007421970 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.007821083 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.007821083 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.007852077 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.007879019 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.010030031 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.010130882 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.010257959 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.010281086 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.010418892 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.010421991 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.010454893 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.010560036 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.010606050 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.010606050 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.010618925 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.010631084 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.013372898 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.013397932 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.013469934 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.013766050 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.013786077 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.655107975 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.655860901 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.655915022 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.656574965 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.656588078 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.661922932 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.662508011 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.662522078 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.663018942 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.663028002 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.663208961 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.663525105 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.663554907 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.663928986 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.663934946 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.667428017 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.667927980 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.667944908 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.668359995 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.668365002 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.694796085 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.695888996 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.695907116 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.696403027 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.696409941 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.771414042 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.771416903 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.771477938 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.771616936 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.771693945 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.771811008 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.771811008 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.771811008 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.771811008 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.771811962 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.771867990 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.771908998 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.772624016 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.772753954 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.772813082 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.773216963 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.773231983 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.773243904 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.773251057 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.774739027 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.774812937 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.774912119 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.775059938 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.775079966 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.775221109 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.775242090 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.775304079 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.775454998 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.775480986 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.776231050 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.776262045 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.776346922 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.776468992 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.776475906 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.778042078 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.778181076 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.778234005 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.778256893 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.778261900 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.778274059 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.778278112 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.780282021 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.780364037 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.780543089 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.780647039 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.780682087 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.806286097 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.806428909 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.806503057 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.806570053 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.806570053 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.806583881 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.806595087 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.808320999 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.808366060 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:24.808429003 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.808516026 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:24.808533907 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.076210022 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.076266050 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.434844971 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.435787916 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.435867071 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.436173916 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.436189890 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.447052002 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.447666883 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.447716951 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.448199034 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.448213100 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.463047981 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.463479996 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.463522911 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.463954926 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.463963985 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.466137886 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.466531992 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.466552019 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.466908932 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.466918945 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.469955921 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.470448017 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.470460892 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.470813990 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.470818996 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.543678045 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.543826103 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.544018984 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.544018984 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.544125080 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.544167995 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.547118902 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.547199011 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.547293901 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.547475100 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.547489882 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.558938980 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.559000015 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.559094906 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.559178114 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.559218884 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.559253931 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.559269905 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.561506987 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.561597109 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.561810970 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.561810970 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.561893940 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.571054935 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.571197987 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.571281910 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.571281910 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.571831942 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.571857929 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.573498964 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.573580027 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.573781013 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.573781013 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.573857069 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.580950022 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.581116915 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.581250906 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.581250906 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.581444979 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.581466913 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.583426952 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.583476067 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.583641052 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.583641052 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.583684921 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.585077047 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.585141897 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.585314035 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.585314035 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.585467100 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.585491896 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.587188959 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.587227106 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:25.587441921 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.587441921 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:25.587482929 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.205826998 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.206518888 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.206590891 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.207055092 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.207067966 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.219537973 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.219980955 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.220026970 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.220460892 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.220468044 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.251074076 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.251537085 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.251559973 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.251955032 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.251960993 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.289973974 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.290507078 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.290538073 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.290874958 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.290884018 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.291662931 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.292026043 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.292053938 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.292504072 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.292510033 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.314781904 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.314920902 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.314987898 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.315184116 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.315222979 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.315258026 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.315273046 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.318377972 CEST	49763	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.318428993 CEST	443	49763	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.318595886 CEST	49763	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.318634033 CEST	49763	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.318643093 CEST	443	49763	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.330913067 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.331039906 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.331259012 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.331320047 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.331334114 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.331361055 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.331367016 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.333636045 CEST	49764	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.333664894 CEST	443	49764	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.333790064 CEST	49764	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.333962917 CEST	49764	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.333973885 CEST	443	49764	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.362098932 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.362153053 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.362226009 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.362366915 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.362380981 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.362410069 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.362416029 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.364443064 CEST	49765	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.364516020 CEST	443	49765	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.364749908 CEST	49765	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.364749908 CEST	49765	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.364799023 CEST	443	49765	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.406197071 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.406354904 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.406455040 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.406455040 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.406455040 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.406630993 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.406714916 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.406786919 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.406826019 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.406826973 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.406847000 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.406867027 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.408571005 CEST	49766	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.408631086 CEST	443	49766	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.408694983 CEST	49766	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.408797026 CEST	49767	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.408821106 CEST	49766	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.408827066 CEST	443	49767	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.408842087 CEST	443	49766	13.107.253.72	192.168.2.5
Oct 6, 2024 18:48:26.408920050 CEST	49767	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.409112930 CEST	49767	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:48:26.409125090 CEST	443	49767	13.107.253.72	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 18:48:04.469893932 CEST	53	49541	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:04.470470905 CEST	53	58303	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:05.665626049 CEST	53	55179	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:05.788950920 CEST	54591	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:48:05.789381981 CEST	57027	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:48:05.799166918 CEST	53	57027	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:05.804501057 CEST	53	54591	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:05.805241108 CEST	53282	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:48:05.881969929 CEST	53	53282	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:05.950045109 CEST	51348	53	192.168.2.5	8.8.8.8
Oct 6, 2024 18:48:05.950592995 CEST	63693	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:48:05.956904888 CEST	53	51348	8.8.8.8	192.168.2.5
Oct 6, 2024 18:48:05.957535982 CEST	53	63693	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:06.975358009 CEST	49761	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:48:06.975543022 CEST	64547	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:48:06.984920025 CEST	53	64547	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:06.985503912 CEST	53	49761	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:06.999756098 CEST	51212	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:48:06.999851942 CEST	58106	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:48:07.010914087 CEST	53	51212	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:07.016645908 CEST	53	58106	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:08.749331951 CEST	57416	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:48:08.750091076 CEST	60466	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:48:08.756453991 CEST	53	57416	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:08.759118080 CEST	53	60466	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:12.056835890 CEST	60475	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:48:12.056974888 CEST	49570	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:48:12.082298040 CEST	53	49570	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:12.082457066 CEST	53	60475	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:12.084552050 CEST	54448	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:48:12.093831062 CEST	53	54448	1.1.1.1	192.168.2.5
Oct 6, 2024 18:48:22.725941896 CEST	53	56344	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 18:48:05.788950920 CEST	192.168.2.5	1.1.1.1	0xd377	Standard query (0)	us-usps-wukhzy.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:05.789381981 CEST	192.168.2.5	1.1.1.1	0x977	Standard query (0)	us-usps-wukhzy.xyz	65	IN (0x0001)	false
Oct 6, 2024 18:48:05.805241108 CEST	192.168.2.5	1.1.1.1	0xce9b	Standard query (0)	us-usps-wukhzy.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:05.950045109 CEST	192.168.2.5	8.8.8.8	0xe3a6	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:05.950592995 CEST	192.168.2.5	1.1.1.1	0x6bca	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:06.975358009 CEST	192.168.2.5	1.1.1.1	0x4cd4	Standard query (0)	us-usps-wukhzy.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:06.975543022 CEST	192.168.2.5	1.1.1.1	0xf046	Standard query (0)	us-usps-wukhzy.xyz	65	IN (0x0001)	false
Oct 6, 2024 18:48:06.999756098 CEST	192.168.2.5	1.1.1.1	0x747a	Standard query (0)	us-usps-wukhzy.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:06.999851942 CEST	192.168.2.5	1.1.1.1	0xc5aa	Standard query (0)	us-usps-wukhzy.xyz	65	IN (0x0001)	false
Oct 6, 2024 18:48:08.749331951 CEST	192.168.2.5	1.1.1.1	0xc8b6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:08.750091076 CEST	192.168.2.5	1.1.1.1	0xa2e5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 6, 2024 18:48:12.056835890 CEST	192.168.2.5	1.1.1.1	0xb692	Standard query (0)	us-usps-wukhzy.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:12.056974888 CEST	192.168.2.5	1.1.1.1	0xc563	Standard query (0)	us-usps-wukhzy.xyz	65	IN (0x0001)	false
Oct 6, 2024 18:48:12.084552050 CEST	192.168.2.5	1.1.1.1	0x388d	Standard query (0)	us-usps-wukhzy.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 18:48:05.799166918 CEST	1.1.1.1	192.168.2.5	0x977	Name error (3)	us-usps-wukhzy.xyz	none	none	65	IN (0x0001)	false
Oct 6, 2024 18:48:05.804501057 CEST	1.1.1.1	192.168.2.5	0xd377	Name error (3)	us-usps-wukhzy.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:05.881969929 CEST	1.1.1.1	192.168.2.5	0xce9b	Name error (3)	us-usps-wukhzy.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:05.956904888 CEST	8.8.8.8	192.168.2.5	0xe3a6	No error (0)	google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:05.957535982 CEST	1.1.1.1	192.168.2.5	0x6bca	No error (0)	google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:06.984920025 CEST	1.1.1.1	192.168.2.5	0xf046	Name error (3)	us-usps-wukhzy.xyz	none	none	65	IN (0x0001)	false
Oct 6, 2024 18:48:06.985503912 CEST	1.1.1.1	192.168.2.5	0x4cd4	Name error (3)	us-usps-wukhzy.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:07.010914087 CEST	1.1.1.1	192.168.2.5	0x747a	Name error (3)	us-usps-wukhzy.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:07.016645908 CEST	1.1.1.1	192.168.2.5	0xc5aa	Name error (3)	us-usps-wukhzy.xyz	none	none	65	IN (0x0001)	false
Oct 6, 2024 18:48:08.756453991 CEST	1.1.1.1	192.168.2.5	0xc8b6	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:08.759118080 CEST	1.1.1.1	192.168.2.5	0xa2e5	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 6, 2024 18:48:12.082298040 CEST	1.1.1.1	192.168.2.5	0xc563	Name error (3)	us-usps-wukhzy.xyz	none	none	65	IN (0x0001)	false
Oct 6, 2024 18:48:12.082457066 CEST	1.1.1.1	192.168.2.5	0xb692	Name error (3)	us-usps-wukhzy.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:12.093831062 CEST	1.1.1.1	192.168.2.5	0x388d	Name error (3)	us-usps-wukhzy.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:15.421664000 CEST	1.1.1.1	192.168.2.5	0xe9d7	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:15.421664000 CEST	1.1.1.1	192.168.2.5	0xe9d7	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:16.186178923 CEST	1.1.1.1	192.168.2.5	0xaa95	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:48:16.186178923 CEST	1.1.1.1	192.168.2.5	0xaa95	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:48:18.476483107 CEST	1.1.1.1	192.168.2.5	0x9243	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:48:18.476483107 CEST	1.1.1.1	192.168.2.5	0x9243	No error (0)	dual.s-part-0044.t-0009.fb-t-msedge.net	s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:48:18.476483107 CEST	1.1.1.1	192.168.2.5	0x9243	No error (0)	s-part-0044.t-0009.fb-t-msedge.net		13.107.253.72	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49722	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:19 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:19 UTC	561	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:19 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 04 Oct 2024 23:21:50 GMT ETag: "0x8DCE4CB535A72FA" x-ms-request-id: 4dad204e-401e-005b-4bf5-169c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164819Z-r154656d9bcn4d55dey6ma44b00000000d8000000000e81r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:19 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-06 16:48:19 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-06 16:48:19 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-06 16:48:19 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-06 16:48:19 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-06 16:48:19 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-06 16:48:19 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-06 16:48:19 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-06 16:48:19 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-06 16:48:19 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49724	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:20 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:20 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 92b6e55f-b01e-003d-50eb-17d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164820Z-1767f7688dc5plpppuk35q59aw0000000qpg00000000f2gw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:20 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49726	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:20 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:20 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:20 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b9d87bc3-001e-008d-128c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164820Z-1767f7688dczvnhxbpcveghk5g0000000aag000000006xqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:20 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49723	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:20 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:20 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:20 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 265a1445-001e-00a2-25c7-17d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164820Z-1767f7688dc88qkvtwr7dy4vdn000000096000000000673t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:20 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49727	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:20 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:20 UTC	584	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:20 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: ec1acd5e-601e-00ab-3736-1666f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164820Z-r154656d9bc5qmxtyvgyzcay0c0000000d5g00000000nm1v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:20 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49725	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:20 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:20 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4b0a31e7-c01e-00ad-448c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164820Z-r154656d9bcclz9cswng83z0t000000009g0000000002m7p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:20 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49729	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:21 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 24b39cfc-301e-0096-2a8c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164821Z-r154656d9bcpnqc46yk454phh800000002k0000000005gq4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49728	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:21 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:21 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: aa8826a4-b01e-0053-608c-15cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164821Z-r154656d9bc94jg685tuhe75qw0000000da0000000007ke9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:21 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49731	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:21 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:21 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: b2393cc3-501e-005b-768c-15d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164821Z-1767f7688dc5std64kd3n8sca4000000079g000000006eu1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:21 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49732	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:21 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 757ce4f4-401e-000a-128c-154a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164821Z-1767f7688dcsjpdx60gbb8v42g0000000a1000000000h37s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49730	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:21 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:21 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: c55c0703-801e-00a0-3f04-182196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164821Z-r154656d9bcvjnbgheqhz2uek80000000qug00000000e04m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:21 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49734	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:22 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 1cc301c6-e01e-0071-6b8c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164822Z-r154656d9bckpfgl7fe14swubc0000000dc00000000064g2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49735	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:22 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 1cc301ca-e01e-0071-6f8c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164822Z-1767f7688dcdvjcfkw13t1btbs0000000qv000000000hpf8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:22 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49736	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:22 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: e0871f45-901e-00a0-0d8c-156a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164822Z-r154656d9bczc24jcy1csnb0es000000017g000000003gvc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49733	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:22 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: cc223d3c-501e-008f-0ec7-179054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164822Z-1767f7688dc5std64kd3n8sca40000000780000000008htn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49737	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:22 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 023e3944-a01e-003d-708c-1598d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164822Z-1767f7688dcr9sxxmettbmaaq40000000r300000000004hk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49740	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:23 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 5e74a9a8-b01e-003d-569e-15d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164823Z-1767f7688dczvnhxbpcveghk5g0000000adg000000000kzd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49738	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:23 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:23 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 77844cee-a01e-0032-35c7-171949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164823Z-1767f7688dcvlhnc8mxy0v1nqw00000001rg00000000heyu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:23 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49742	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:23 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:23 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 79ade187-001e-0065-788c-150b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164823Z-r154656d9bc4v6bg39gwnbf5vn00000005b000000000hbpp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:23 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49739	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:23 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: c54fb296-901e-008f-528c-1567a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164823Z-r154656d9bc2dpb46dmu3uezks0000000d9g0000000099an x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49741	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:23 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:23 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 348a4018-801e-0078-54c7-17bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164823Z-1767f7688dcvlhnc8mxy0v1nqw00000001wg00000000554x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:23 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49744	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:23 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8e9c869d-201e-000c-4b8c-1579c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164823Z-1767f7688dccc6lkbm0py95vf00000000qy000000000e3tu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49746	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:23 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f71a7e49-201e-000c-5aa4-1579c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164823Z-1767f7688dc5smv9fdkth3nru00000000qu0000000008xc7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49743	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:23 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0da94923-701e-0097-168c-15b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164823Z-r154656d9bclprr71vn2nvcemn0000000qug00000000a091 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49745	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:23 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:23 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4f10c824-e01e-0085-1c8c-15c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164823Z-1767f7688dcxjm7c0w73xyx8vs0000000qwg00000000hd0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:24 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49747	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:23 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:23 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: bc3bb15e-601e-003d-16f8-176f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164823Z-r154656d9bczbzfnyr5sz58vdw0000000d6g00000000gn12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:24 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49748	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:24 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:24 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 22e42897-601e-0070-65c7-17a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164824Z-1767f7688dc9hz5543dfnckp1w0000000f2000000000846w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:24 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49751	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:24 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c2ca9d4d-801e-0035-458c-15752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164824Z-r154656d9bcv7txsqsufsswrks0000000d5g00000000gby2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49750	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:24 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a910d2e0-401e-005b-72a6-159c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164824Z-1767f7688dcnlss9sm3w9wbbbn00000003800000000018pu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49749	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:24 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 1e32dda0-e01e-000c-2bf8-178e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164824Z-r154656d9bcc2bdtn1pd2qfd4c0000000qqg00000000gc01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49752	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:24 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: cce90406-001e-005a-059e-15c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164824Z-1767f7688dccbx4fmf9wh4mm3c0000000qf000000000d4r2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49756	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:25 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 76615707-c01e-0082-6a8c-15af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164825Z-1767f7688dcrlt4tm55zgvcmun0000000qs0000000005gnr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49754	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:25 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: cc1dda0d-101e-0079-139e-155913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164825Z-1767f7688dctps2t8qk28fz8yg0000000qu000000000419p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49757	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:25 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:25 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: bb2e28bd-501e-0016-0b8c-15181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164825Z-r154656d9bckpfgl7fe14swubc0000000d9g00000000b4qt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:25 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49753	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:25 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:25 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: a7623418-001e-00a2-348c-15d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164825Z-1767f7688dcvlhnc8mxy0v1nqw00000001z00000000001vr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:25 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49755	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:25 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: a62739ea-301e-005d-6402-17e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164825Z-r154656d9bczbzfnyr5sz58vdw0000000da0000000008feb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49758	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:26 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:26 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: c4ad759c-701e-0001-2422-16b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164826Z-r154656d9bcmxqxrqrw0qrf8hg00000009qg000000000rvn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:26 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49759	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:26 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:26 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 0dcb6c6d-e01e-0003-668c-150fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164826Z-1767f7688dc2kzqgyrtc6e2gp40000000qr0000000006bre x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:26 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49762	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:26 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:26 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: ed9c017d-601e-000d-3e22-162618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164826Z-r154656d9bc27nzfvdqr2guqt000000000q0000000004sya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:26 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49761	13.107.253.72	443	3868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:26 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:26 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 9bed673a-001e-0046-278c-15da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164826Z-1767f7688dcvlhnc8mxy0v1nqw00000001z00000000001wg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:26 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49760	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:26 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 8789ddbb-a01e-0084-6a8c-159ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164826Z-r154656d9bcc4snr2sy7ntt13c0000000a70000000007xtw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49763	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:26 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:27 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 3a0dcc46-601e-0032-6c8c-15eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164827Z-r154656d9bczbzfnyr5sz58vdw0000000dc0000000004fp0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:27 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49764	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:27 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:27 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 15fe0b87-a01e-0002-3b8c-155074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164827Z-1767f7688dcwt84hd6d7u4c7700000000qvg00000000bhsa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:27 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49765	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:27 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:27 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 1f480944-c01e-002b-018c-156e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164827Z-r154656d9bcrxcdc4sxf91b6u400000007mg000000005q9u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:27 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49766	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:27 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:27 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 85e8bebc-601e-0032-1873-16eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164827Z-1767f7688dc5plpppuk35q59aw0000000qvg000000000mxe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:27 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49767	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:27 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 75858473-001e-000b-318c-1515a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164827Z-1767f7688dcnlss9sm3w9wbbbn000000031000000000gd4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:27 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49768	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:27 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:27 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 76252b1b-c01e-0066-488c-15a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164827Z-r154656d9bc27nzfvdqr2guqt000000000kg00000000aqyu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:27 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49769	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:27 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: cc687b4d-101e-0079-45b6-155913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164827Z-r154656d9bcpnqc46yk454phh800000002e000000000dmp3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:48:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49770	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:27 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b83a8dc4-f01e-003f-308c-15d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164827Z-1767f7688dc4zx8hzkgqpgqkb400000008ng000000004nb2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49771	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:27 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c276760a-301e-0051-159c-1538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164827Z-r154656d9bcgk58qzsfr5pfzg40000000qwg0000000091ge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49772	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:48:27 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:48:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:48:27 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7be6812e-d01e-008e-528c-15387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T164827Z-1767f7688dcdss7lwsep0egpxs0000000qqg000000008zu8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:48:27 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 2556, Parent PID: 5544

General

Target ID:	0
Start time:	12:47:58
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 3868, Parent PID: 2556

General

Target ID:	2
Start time:	12:48:03
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2000,i,17161473894225688281,10000816620996369041,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6776, Parent PID: 5544

General

Target ID:	3
Start time:	12:48:05
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-usps-wukhzy.xyz/update/"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://us-usps-wukhzy.xyz/update/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 2556, Parent PID: 5544

General

Chronological Activities

Analysis Process: chrome.exePID: 3868, Parent PID: 2556

General

Chronological Activities

Analysis Process: chrome.exePID: 6776, Parent PID: 5544

General

Chronological Activities

Windows Analysis Report
https://us-usps-wukhzy.xyz/update/