Edit tour

Windows Analysis Report
https://us-usps-qgleum.xyz/update/

Overview

General Information

Sample URL:	https://us-usps-qgleum.xyz/update/
Analysis ID:	1526984
Tags:	openphish
Infos:

Errors URL not reachable

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Performs DNS queries to domains with low reputation

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3012 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2952 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,4751949160752344263,348731842178357154,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-usps-qgleum.xyz/update/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://us-usps-qgleum.xyz/update/

SlashNext: detection malicious, Label: Fraudulent Website type: Phishing & Social Engineering

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49719 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.5:49720 version: TLS 1.2

Networking

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-qgleum.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-qgleum.xyz
Source:	DNS query: us-usps-qgleum.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-qgleum.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-qgleum.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-qgleum.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us-usps-qgleum.xyz
Source:	DNS query: us-usps-qgleum.xyz

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49719 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: us-usps-qgleum.xyz
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.5:49720 version: TLS 1.2

Source: classification engine

Classification label: mal52.troj.win@19/6@12/3

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,4751949160752344263,348731842178357154,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-usps-qgleum.xyz/update/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,4751949160752344263,348731842178357154,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://us-usps-qgleum.xyz/update/	100%	SlashNext	Fraudulent Website type: Phishing & Social Engineering

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
google.com	142.250.184.206	true	false	unknown
s-part-0044.t-0009.fb-t-msedge.net	13.107.253.72	true	false	unknown
www.google.com	142.250.185.132	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
us-usps-qgleum.xyz	unknown	unknown	true	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved		unknown	unknown	false
142.250.185.132	www.google.com	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526984
Start date and time:	2024-10-06 18:53:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://us-usps-qgleum.xyz/update/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.troj.win@19/6@12/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	URL browsing timeout or error

Errors

URL not reachable

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.99, 142.250.185.142, 74.125.133.84, 34.104.35.123, 184.28.90.27, 52.149.20.212, 88.221.110.91, 2.16.100.168, 192.229.221.95, 40.69.42.241
Excluded domains from analysis (whitelisted): azurefd-t-fb-prod.trafficmanager.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, clientservices.googleapis.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, ocsp.digicert.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, azureedge-t-prod.trafficmanager.net, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://us-usps-qgleum.xyz/update/

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 6 15:54:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.977418836194644
Encrypted:	false
SSDEEP:	48:8VpdroTLssPHMidAKZdA19ehwiZUklqehAy+3:8SXSPy
MD5:	5CFBC6243729D7C503403E5F6ADFB9DF
SHA1:	2AD6C971505DF41E98E0968954EE2C677250E02C
SHA-256:	4CA5E100558A0071F79C3E5E7205CD3C24E784B4E517850A5E7A4E559682948B
SHA-512:	6A2209865F64A1506DC3A2CCD91B0D34FA98F948CFBFA1E8AE61F44E4A383F878F24AC35D7487DA67DEC90F3F852DBF7A0FDEDFF2AD643527FF60E2460E84B1D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......F\....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IFY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 6 15:54:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.994615697339952
Encrypted:	false
SSDEEP:	48:85droTLssPHMidAKZdA1weh/iZUkAQkqeh/y+2:84XI9Qiy
MD5:	548EE3E485CDCED183FCD6D5EABDD7AE
SHA1:	DADBC3C09D7F21E74A7AE88A93FDB88FD6891F1E
SHA-256:	8E11DC44E7EA8B169C6A0AB2BC1186141838D60CD5F11A5FE33283B1BE087CE1
SHA-512:	FC119628E7011A397C3E6212099D8044A785CCFA5199875FAE257577DE1341DB5D8C794D9870A40202C26298BC738E6A654377BA7714409B4D59E53281539BE2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....N.;\....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IFY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.008291722172149
Encrypted:	false
SSDEEP:	48:8xVdroTLsssHMidAKZdA14tseh7sFiZUkmgqeh7sZy+BX:8xkXlnLy
MD5:	504A8CD36BA8F7A9625D1B136DA7B41C
SHA1:	19461F9212289F4E30F3D64BC33B7A34922DDEEE
SHA-256:	D9CF7C7A1F6E480B79617313D2E7930112007DC9F8121215362200AE110E1772
SHA-512:	4EB61234723D7579B3EB8665D628FA6D7AFAF2C753E499A22C51305A32C6BF4FA6B68B79650169F00491DA8FCC2B6E4209FBA90D665F04082F5D81237A07CCA6
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IFY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 6 15:54:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.991511175292695
Encrypted:	false
SSDEEP:	48:8/droTLssPHMidAKZdA1vehDiZUkwqehTy+R:8iXTBy
MD5:	710F173FD59F1ABF99B8461E9712632F
SHA1:	2BA8AAE84E0FB59EA2F80F0B06FBBC7BFC9FF169
SHA-256:	EE880C1A91B19CB41DCDC479D42D2C54B7FFC0436A39137E098A5503F6B40672
SHA-512:	7F054626B00D36EE8EFBDE3465AF2AE0C3B05E36AA81930A0DAEB77472813B997E025AB4CEB4C86586A9EA27A54FE921F9F6D77D77C57DEB2EF3EBA28C795C4C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......5\....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IFY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 6 15:54:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9806392200611986
Encrypted:	false
SSDEEP:	48:8mdroTLssPHMidAKZdA1hehBiZUk1W1qehVy+C:8xXD91y
MD5:	3EF8CBBF69B9F408C6BA94FFD7CD8F88
SHA1:	5278F57D61224AF5889585F7462CD6195305D770
SHA-256:	D50DCD97DBD61E3421ECF5F60745C037BC5A14018636E61C96398E08436F6824
SHA-512:	E9A920B54BE34177EF205A7E7D438E38BD11537FDC6F956E22B86301C3081FD488A2244967C85C2A90421768F847E3BA9221059EF2125417254A3989E45F8742
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....A\....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IFY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Oct 6 15:54:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9925655260572492
Encrypted:	false
SSDEEP:	48:8udroTLssPHMidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:8ZXzT/TbxWOvTbLy7T
MD5:	71A73615A774DE61B24BA8D6AE1BC627
SHA1:	A8C6C4AD885DC129D4518C506F55B80E90068C2C
SHA-256:	89B4977710103F237082A25CB92095206E6080CCA3B6A1605C8C0C1A7BA30ECF
SHA-512:	C39A0004FE70D3E793EE94AE895998F0C341427CD74CAD8ECA85B8426193AC9EA4F4C84E4753BF14E00CFD71142CBB6E103B33DD70503687E110C956C95399BE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....q.+\....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IFY.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VFY.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VFY.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VFY............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFY............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 18:53:59.384881973 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:53:59.384990931 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:53:59.511442900 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:54:09.084187984 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:54:09.084283113 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:54:09.281358957 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:54:10.754628897 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 6, 2024 18:54:10.754719019 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:54:11.715867996 CEST	49711	443	192.168.2.5	142.250.185.132
Oct 6, 2024 18:54:11.715929031 CEST	443	49711	142.250.185.132	192.168.2.5
Oct 6, 2024 18:54:11.716702938 CEST	49711	443	192.168.2.5	142.250.185.132
Oct 6, 2024 18:54:11.717006922 CEST	49711	443	192.168.2.5	142.250.185.132
Oct 6, 2024 18:54:11.717026949 CEST	443	49711	142.250.185.132	192.168.2.5
Oct 6, 2024 18:54:12.366020918 CEST	443	49711	142.250.185.132	192.168.2.5
Oct 6, 2024 18:54:12.377851963 CEST	49711	443	192.168.2.5	142.250.185.132
Oct 6, 2024 18:54:12.377878904 CEST	443	49711	142.250.185.132	192.168.2.5
Oct 6, 2024 18:54:12.379293919 CEST	443	49711	142.250.185.132	192.168.2.5
Oct 6, 2024 18:54:12.379379988 CEST	49711	443	192.168.2.5	142.250.185.132
Oct 6, 2024 18:54:12.387598038 CEST	49711	443	192.168.2.5	142.250.185.132
Oct 6, 2024 18:54:12.387763977 CEST	443	49711	142.250.185.132	192.168.2.5
Oct 6, 2024 18:54:12.443447113 CEST	49711	443	192.168.2.5	142.250.185.132
Oct 6, 2024 18:54:12.443458080 CEST	443	49711	142.250.185.132	192.168.2.5
Oct 6, 2024 18:54:12.490407944 CEST	49711	443	192.168.2.5	142.250.185.132
Oct 6, 2024 18:54:21.580704927 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:54:21.580704927 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:54:21.584577084 CEST	49719	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:54:21.584614992 CEST	443	49719	23.1.237.91	192.168.2.5
Oct 6, 2024 18:54:21.584765911 CEST	49719	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:54:21.585632086 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 6, 2024 18:54:21.585647106 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 6, 2024 18:54:21.585665941 CEST	49719	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:54:21.585692883 CEST	443	49719	23.1.237.91	192.168.2.5
Oct 6, 2024 18:54:21.588571072 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:21.588644981 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:21.592813969 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:21.592813969 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:21.592897892 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.203216076 CEST	443	49719	23.1.237.91	192.168.2.5
Oct 6, 2024 18:54:22.203342915 CEST	49719	443	192.168.2.5	23.1.237.91
Oct 6, 2024 18:54:22.261090994 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.261198997 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.264178038 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.264220953 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.264645100 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.266561031 CEST	443	49711	142.250.185.132	192.168.2.5
Oct 6, 2024 18:54:22.266649961 CEST	443	49711	142.250.185.132	192.168.2.5
Oct 6, 2024 18:54:22.266707897 CEST	49711	443	192.168.2.5	142.250.185.132
Oct 6, 2024 18:54:22.286395073 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.327470064 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.396034956 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.396090984 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.396114111 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.396153927 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.396158934 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.396209955 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.396231890 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.396267891 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.396267891 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.396267891 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.396296978 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.477241993 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.477299929 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.477339029 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.477370024 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.477395058 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.477412939 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.482594967 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.482644081 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.482708931 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.482723951 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.482758045 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.482777119 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.562988043 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.563035011 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.563083887 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.563128948 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.563159943 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.563182116 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.564076900 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.564120054 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.564166069 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.564186096 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.564208984 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.564235926 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.565776110 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.565820932 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.565870047 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.565884113 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.565910101 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.565929890 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.569420099 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.569463015 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.569511890 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.569525003 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.569577932 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.569598913 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.658587933 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.658637047 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.658689022 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.658740997 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.658772945 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.658793926 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.658849001 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.658888102 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.658921003 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.658941984 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.658977032 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.658998966 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659017086 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659056902 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659084082 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659096003 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659126997 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659145117 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659173012 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659214020 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659235954 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659248114 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659277916 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659300089 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659333944 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659374952 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659420967 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659439087 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659463882 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659497976 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659502983 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659533024 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659568071 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659584045 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659601927 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659615993 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659643888 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659666061 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659691095 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659765005 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659776926 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659832001 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.659837008 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.659895897 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.661179066 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.662672997 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.662698984 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.662723064 CEST	49720	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.662738085 CEST	443	49720	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.719240904 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.719332933 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.719412088 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.721107006 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.721143007 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.722429037 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.722464085 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.722522974 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.722654104 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.722671032 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.723627090 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.723720074 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.723793983 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.724221945 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.724245071 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.724309921 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.725282907 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.725295067 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.725342989 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.728640079 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.728656054 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.728719950 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.728753090 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:22.728893042 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:22.728914976 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.374063015 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.375216007 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.375267029 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.375286102 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.377448082 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.377460003 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.378254890 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.378256083 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.378269911 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.378288984 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.379580975 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.380352974 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.380435944 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.380964041 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.380979061 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.397463083 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.398082972 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.398112059 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.399255037 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.399265051 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.406503916 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.407180071 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.407196999 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.408580065 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.408586025 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.481718063 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.481746912 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.482021093 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.482059002 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.487498999 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.487550020 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.487554073 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.487675905 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.487711906 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.488662004 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.488692045 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.488704920 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.488853931 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.488899946 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.495031118 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.505161047 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.505265951 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.509058952 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.519220114 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.519284010 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.521476030 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.522680044 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.522700071 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.522739887 CEST	49723	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.522754908 CEST	443	49723	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.522880077 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.522880077 CEST	49726	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.522917032 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.522929907 CEST	443	49726	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.522973061 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.522973061 CEST	49725	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.522989035 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.523015976 CEST	443	49725	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.523049116 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.523049116 CEST	49727	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.523061991 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.523070097 CEST	443	49727	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.524070024 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.524070024 CEST	49724	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.524075031 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.524080992 CEST	443	49724	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.527570009 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.527595997 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.527636051 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.527673960 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.527710915 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.527992964 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.528004885 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.528034925 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.528247118 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.528428078 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.528446913 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.528512001 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.528527021 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.528537989 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.528553009 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.528585911 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.528644085 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.528652906 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.528716087 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.528784037 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.528810978 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.528850079 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.528851986 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:23.528862000 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:23.528873920 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.014519930 CEST	49711	443	192.168.2.5	142.250.185.132
Oct 6, 2024 18:54:24.014547110 CEST	443	49711	142.250.185.132	192.168.2.5
Oct 6, 2024 18:54:24.181967974 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.182887077 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.182921886 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.185091019 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.185105085 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.201733112 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.203260899 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.203277111 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.203675985 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.203871012 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.203876972 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.204507113 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.204536915 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.206908941 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.206914902 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.207508087 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.208360910 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.208360910 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.208373070 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.208389997 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.212559938 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.213265896 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.213274002 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.214379072 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.214384079 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.289839029 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.289905071 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.289968967 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.312474012 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.312632084 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.312700987 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.313895941 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.314027071 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.314188957 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.318886995 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.318969965 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.319025040 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.327879906 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.327924013 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.327981949 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.461328030 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.461349010 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.461436987 CEST	49731	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.461452007 CEST	443	49731	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.464863062 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.464881897 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.464890957 CEST	49732	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.464896917 CEST	443	49732	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.466983080 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.467004061 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.467017889 CEST	49729	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.467025042 CEST	443	49729	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.469353914 CEST	49730	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.469360113 CEST	443	49730	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.471503973 CEST	49728	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.471518040 CEST	443	49728	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.477263927 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.477354050 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.477444887 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.478598118 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.478636980 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.482429981 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.482451916 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.482532978 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.483675957 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.483700991 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.485589981 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.485610962 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.485666990 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.485945940 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.485959053 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.488879919 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.488920927 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.488985062 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.490833044 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.490850925 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.492234945 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.492274046 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:24.492352009 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.492604971 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:24.492624998 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.146037102 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.146601915 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.146697998 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.147334099 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.147349119 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.149029970 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.149589062 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.149679899 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.150192976 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.150249004 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.162401915 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.162847996 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.162867069 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.163371086 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.163376093 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.168231010 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.168823957 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.168910027 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.169342041 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.169397116 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.169826984 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.170252085 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.170264006 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.170763016 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.170769930 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.260917902 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.261059999 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.261173964 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.261322021 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.261367083 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.261398077 CEST	49736	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.261414051 CEST	443	49736	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.263756037 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.263881922 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.264106035 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.264329910 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.264380932 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.264414072 CEST	49733	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.264430046 CEST	443	49733	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.264836073 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.264874935 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.265045881 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.265192986 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.265206099 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.267601013 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.267643929 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.267746925 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.267913103 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.267931938 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.274033070 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.274095058 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.274318933 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.274379969 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.274391890 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.274411917 CEST	49735	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.274416924 CEST	443	49735	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.277144909 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.277232885 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.277328014 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.277519941 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.277554989 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.282238960 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.282326937 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.282399893 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.282553911 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.282567024 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.282577991 CEST	49737	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.282583952 CEST	443	49737	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.285020113 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.285047054 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.285403967 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.285573006 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.285588980 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.547677994 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.547810078 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.548052073 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.548052073 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.548053026 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.550652027 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.550692081 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.550756931 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.550910950 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.550924063 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.849970102 CEST	49734	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.849996090 CEST	443	49734	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.926141977 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.926577091 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.926636934 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.927145958 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.927160025 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.930453062 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.930787086 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.930809021 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.931313038 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.931318998 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.940666914 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.941070080 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.941083908 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.941593885 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.941601992 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.975409985 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.975750923 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.975827932 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:25.976289034 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:25.976303101 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.037281036 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.037415028 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.037483931 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.037561893 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.037579060 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.037591934 CEST	49739	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.037600040 CEST	443	49739	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.039244890 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.039433002 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.039505959 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.039607048 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.039623022 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.039635897 CEST	49738	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.039642096 CEST	443	49738	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.040421963 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.040451050 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.040546894 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.040792942 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.040807962 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.041851997 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.041887045 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.042084932 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.042223930 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.042244911 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.050926924 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.051084042 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.051223040 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.051249981 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.051274061 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.051285982 CEST	49741	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.051295042 CEST	443	49741	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.054311037 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.054342031 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.054403067 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.054524899 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.054538965 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.091412067 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.091559887 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.091626883 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.091669083 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.091669083 CEST	49740	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.091692924 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.091730118 CEST	443	49740	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.093905926 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.093918085 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.093976021 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.094079018 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.094085932 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.203097105 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.203505993 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.203527927 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.204109907 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.204118013 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.312319040 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.312369108 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.312433004 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.312611103 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.312628984 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.312640905 CEST	49742	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.312648058 CEST	443	49742	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.314886093 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.314913034 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.314980030 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.315139055 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.315155983 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.701421022 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.701623917 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.701796055 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.701822996 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.702150106 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.702184916 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.702366114 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.702388048 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.702703953 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.702718019 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.703921080 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.704220057 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.704243898 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.704606056 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.704612970 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.748476982 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.748812914 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.748830080 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.749355078 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.749360085 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.810579062 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.810719967 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.810786963 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.810827017 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.810844898 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.810857058 CEST	49744	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.810864925 CEST	443	49744	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.812335968 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.812407017 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.812599897 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.812649965 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.812658072 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.812669039 CEST	49745	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.812674046 CEST	443	49745	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.813157082 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.813191891 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.813246965 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.813445091 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.813462019 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.813611031 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.813756943 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.813816071 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.813867092 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.813867092 CEST	49743	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.813899040 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.813922882 CEST	443	49743	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.815318108 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.815422058 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.815459967 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.815485001 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.815521955 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.815578938 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.815617085 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.815638065 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.815673113 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.815697908 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.876708984 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.876853943 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.876956940 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.876998901 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.877002954 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.877033949 CEST	49746	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.877038002 CEST	443	49746	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.879462957 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.879484892 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.879545927 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.879687071 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.879699945 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.965533018 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.965893030 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.965919018 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:26.966252089 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:26.966263056 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.073800087 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.073837996 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.073904037 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.073997974 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.074018955 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.074033022 CEST	49747	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.074039936 CEST	443	49747	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.076067924 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.076095104 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.076220989 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.076329947 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.076353073 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.468383074 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.468705893 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.468751907 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.469151974 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.469163895 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.476838112 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.477189064 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.477214098 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.477744102 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.477750063 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.497123003 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.497958899 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.497958899 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.497977018 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.497991085 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.577989101 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.578521967 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.578541994 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.578675032 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.578680992 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.584985971 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.585048914 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.585187912 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.585187912 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.585329056 CEST	49748	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.585340977 CEST	443	49748	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.586837053 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.586922884 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.587073088 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.587137938 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.587157965 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.595909119 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.595972061 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.596227884 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.596227884 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.596227884 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.598099947 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.598169088 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.598373890 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.598373890 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.598449945 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.610701084 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.610842943 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.610919952 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.611078024 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.611078024 CEST	49749	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.611108065 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.611130953 CEST	443	49749	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.612777948 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.612811089 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.612993002 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.612993002 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.613024950 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.703511000 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.703660011 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.703777075 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.703777075 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.704452038 CEST	49751	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.704459906 CEST	443	49751	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.705646992 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.705684900 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.705815077 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.706082106 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.706100941 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.733160973 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.733611107 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.733623028 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.733818054 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.733835936 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.841319084 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.841454029 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.841743946 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.841778994 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.841778994 CEST	49752	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.841793060 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.841804981 CEST	443	49752	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.843697071 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.843774080 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.843964100 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.844109058 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.844142914 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:27.896864891 CEST	49750	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:27.896908998 CEST	443	49750	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.273513079 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.273874044 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.273935080 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.274247885 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.274261951 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.288225889 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.288568020 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.288578987 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.289083004 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.289089918 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.294725895 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.295003891 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.295018911 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.295339108 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.295347929 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.373847961 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.374167919 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.374197006 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.374492884 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.374500990 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.384541988 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.384634972 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.384692907 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.384924889 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.384955883 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.385003090 CEST	49753	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.385018110 CEST	443	49753	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.387401104 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.387487888 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.387576103 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.387687922 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.387707949 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.399858952 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.400013924 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.400116920 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.400116920 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.400240898 CEST	49755	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.400269985 CEST	443	49755	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.402107954 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.402141094 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.402277946 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.402456999 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.402475119 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.402816057 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.402959108 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.403177977 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.403321028 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.403321981 CEST	49754	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.403340101 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.403359890 CEST	443	49754	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.405464888 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.405474901 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.405586004 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.405700922 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.405715942 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.491807938 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.491955996 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.492013931 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.492042065 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.492060900 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.492073059 CEST	49756	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.492079973 CEST	443	49756	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.493772984 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.493804932 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.493870020 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.493974924 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.493989944 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.505678892 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.505990982 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.506009102 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.506427050 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.506437063 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.614459038 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.614605904 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.614792109 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.614876986 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.614876986 CEST	49757	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.614907026 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.614933014 CEST	443	49757	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.624955893 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.624988079 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:28.625058889 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.625147104 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:28.625179052 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.105720043 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.106165886 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.106204033 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.106628895 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.106638908 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.109044075 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.109348059 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.109361887 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.109689951 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.109695911 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.116533041 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.116833925 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.116842985 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.117161036 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.117166042 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.208257914 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.208589077 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.208615065 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.208970070 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.208976030 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.217756987 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.217835903 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.217981100 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.218015909 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.218015909 CEST	49758	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.218036890 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.218049049 CEST	443	49758	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.219322920 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.219563961 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.219662905 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.219662905 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.219741106 CEST	49759	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.219758034 CEST	443	49759	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.220455885 CEST	49763	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.220483065 CEST	443	49763	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.220563889 CEST	49763	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.220649004 CEST	49763	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.220657110 CEST	443	49763	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.221560001 CEST	49764	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.221600056 CEST	443	49764	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.221775055 CEST	49764	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.221775055 CEST	49764	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.221812963 CEST	443	49764	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.232323885 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.232394934 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.232469082 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.232525110 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.232525110 CEST	49760	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.232532978 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.232542038 CEST	443	49760	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.234422922 CEST	49765	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.234488964 CEST	443	49765	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.234597921 CEST	49765	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.234833002 CEST	49765	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.234863997 CEST	443	49765	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.281177044 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.281790018 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.281790972 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.281819105 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.281830072 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.321826935 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.321971893 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.322213888 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.322213888 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.322343111 CEST	49761	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.322360039 CEST	443	49761	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.323802948 CEST	49766	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.323832035 CEST	443	49766	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.324003935 CEST	49766	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.324170113 CEST	49766	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.324193001 CEST	443	49766	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.389403105 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.389533997 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.389612913 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.389612913 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.389766932 CEST	49762	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.389782906 CEST	443	49762	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.391221046 CEST	49767	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.391262054 CEST	443	49767	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.391324997 CEST	49767	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.391433001 CEST	49767	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.391458988 CEST	443	49767	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.876312971 CEST	443	49764	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.876944065 CEST	49764	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.876964092 CEST	443	49764	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.877217054 CEST	49764	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.877223969 CEST	443	49764	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.898152113 CEST	443	49765	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.898529053 CEST	49765	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.898564100 CEST	443	49765	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.898926020 CEST	49765	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.898941040 CEST	443	49765	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.903373957 CEST	443	49763	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.903814077 CEST	49763	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.903846979 CEST	443	49763	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.904088020 CEST	49763	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.904097080 CEST	443	49763	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.983522892 CEST	443	49764	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.983588934 CEST	443	49764	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.983781099 CEST	49764	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.983781099 CEST	49764	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.984044075 CEST	49764	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.984060049 CEST	443	49764	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.986174107 CEST	49768	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.986202002 CEST	443	49768	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:29.986355066 CEST	49768	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.986511946 CEST	49768	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:29.986534119 CEST	443	49768	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.013514996 CEST	443	49766	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.013827085 CEST	49766	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.013850927 CEST	443	49766	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.014246941 CEST	49766	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.014256954 CEST	443	49766	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.019490957 CEST	443	49763	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.019520044 CEST	443	49765	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.019665956 CEST	443	49763	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.019680977 CEST	443	49765	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.019730091 CEST	49763	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.019881964 CEST	49763	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.019887924 CEST	49765	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.019895077 CEST	443	49763	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.019931078 CEST	49765	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.019980907 CEST	443	49765	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.020011902 CEST	49765	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.020025015 CEST	443	49765	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.022084951 CEST	49769	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.022126913 CEST	443	49769	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.022151947 CEST	49770	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.022167921 CEST	443	49770	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.022214890 CEST	49769	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.022337914 CEST	49770	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.022337914 CEST	49770	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.022394896 CEST	443	49770	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.022425890 CEST	49769	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.022440910 CEST	443	49769	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.047154903 CEST	443	49767	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.047502995 CEST	49767	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.047519922 CEST	443	49767	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.047930002 CEST	49767	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.047950983 CEST	443	49767	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.128889084 CEST	443	49766	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.129036903 CEST	443	49766	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.129153013 CEST	49766	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.129153967 CEST	49766	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.129153967 CEST	49766	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.130949974 CEST	49771	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.130975008 CEST	443	49771	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.131032944 CEST	49771	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.131192923 CEST	49771	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.131202936 CEST	443	49771	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.161880016 CEST	443	49767	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.162026882 CEST	443	49767	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.162166119 CEST	49767	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.162166119 CEST	49767	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.162211895 CEST	49767	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.162231922 CEST	443	49767	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.163995028 CEST	49772	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.164086103 CEST	443	49772	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.164211988 CEST	49772	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.164295912 CEST	49772	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.164319038 CEST	443	49772	13.107.253.72	192.168.2.5
Oct 6, 2024 18:54:30.443804026 CEST	49766	443	192.168.2.5	13.107.253.72
Oct 6, 2024 18:54:30.443856001 CEST	443	49766	13.107.253.72	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 18:54:07.352679968 CEST	53	52223	1.1.1.1	192.168.2.5
Oct 6, 2024 18:54:07.358923912 CEST	53	57871	1.1.1.1	192.168.2.5
Oct 6, 2024 18:54:08.509145975 CEST	53	53736	1.1.1.1	192.168.2.5
Oct 6, 2024 18:54:09.149660110 CEST	56417	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:54:09.149821043 CEST	60937	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:54:09.164040089 CEST	53	56417	1.1.1.1	192.168.2.5
Oct 6, 2024 18:54:09.165790081 CEST	53	60937	1.1.1.1	192.168.2.5
Oct 6, 2024 18:54:09.169111013 CEST	57393	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:54:09.188179970 CEST	53	57393	1.1.1.1	192.168.2.5
Oct 6, 2024 18:54:09.231338024 CEST	57199	53	192.168.2.5	8.8.8.8
Oct 6, 2024 18:54:09.231657982 CEST	50772	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:54:09.238213062 CEST	53	57199	8.8.8.8	192.168.2.5
Oct 6, 2024 18:54:09.238342047 CEST	53	50772	1.1.1.1	192.168.2.5
Oct 6, 2024 18:54:10.246553898 CEST	63465	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:54:10.246689081 CEST	64422	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:54:10.255165100 CEST	53	64422	1.1.1.1	192.168.2.5
Oct 6, 2024 18:54:10.273315907 CEST	53	63465	1.1.1.1	192.168.2.5
Oct 6, 2024 18:54:11.691811085 CEST	64953	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:54:11.692130089 CEST	62146	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:54:11.699194908 CEST	53	62146	1.1.1.1	192.168.2.5
Oct 6, 2024 18:54:11.699959040 CEST	53	64953	1.1.1.1	192.168.2.5
Oct 6, 2024 18:54:15.304270029 CEST	57646	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:54:15.304697037 CEST	51305	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:54:15.314341068 CEST	53	57646	1.1.1.1	192.168.2.5
Oct 6, 2024 18:54:15.319355965 CEST	53	51305	1.1.1.1	192.168.2.5
Oct 6, 2024 18:54:15.322833061 CEST	52935	53	192.168.2.5	1.1.1.1
Oct 6, 2024 18:54:15.334001064 CEST	53	52935	1.1.1.1	192.168.2.5
Oct 6, 2024 18:54:25.594073057 CEST	53	62724	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 6, 2024 18:54:09.149660110 CEST	192.168.2.5	1.1.1.1	0xd41e	Standard query (0)	us-usps-qgleum.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:09.149821043 CEST	192.168.2.5	1.1.1.1	0xbb9e	Standard query (0)	us-usps-qgleum.xyz	65	IN (0x0001)	false
Oct 6, 2024 18:54:09.169111013 CEST	192.168.2.5	1.1.1.1	0x6a93	Standard query (0)	us-usps-qgleum.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:09.231338024 CEST	192.168.2.5	8.8.8.8	0x21bc	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:09.231657982 CEST	192.168.2.5	1.1.1.1	0x6cc6	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:10.246553898 CEST	192.168.2.5	1.1.1.1	0xf444	Standard query (0)	us-usps-qgleum.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:10.246689081 CEST	192.168.2.5	1.1.1.1	0xe1f1	Standard query (0)	us-usps-qgleum.xyz	65	IN (0x0001)	false
Oct 6, 2024 18:54:11.691811085 CEST	192.168.2.5	1.1.1.1	0xa426	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:11.692130089 CEST	192.168.2.5	1.1.1.1	0x586e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 6, 2024 18:54:15.304270029 CEST	192.168.2.5	1.1.1.1	0x139	Standard query (0)	us-usps-qgleum.xyz	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:15.304697037 CEST	192.168.2.5	1.1.1.1	0xc78f	Standard query (0)	us-usps-qgleum.xyz	65	IN (0x0001)	false
Oct 6, 2024 18:54:15.322833061 CEST	192.168.2.5	1.1.1.1	0x98c7	Standard query (0)	us-usps-qgleum.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 6, 2024 18:54:09.164040089 CEST	1.1.1.1	192.168.2.5	0xd41e	Name error (3)	us-usps-qgleum.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:09.165790081 CEST	1.1.1.1	192.168.2.5	0xbb9e	Name error (3)	us-usps-qgleum.xyz	none	none	65	IN (0x0001)	false
Oct 6, 2024 18:54:09.188179970 CEST	1.1.1.1	192.168.2.5	0x6a93	Name error (3)	us-usps-qgleum.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:09.238213062 CEST	8.8.8.8	192.168.2.5	0x21bc	No error (0)	google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:09.238342047 CEST	1.1.1.1	192.168.2.5	0x6cc6	No error (0)	google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:10.255165100 CEST	1.1.1.1	192.168.2.5	0xe1f1	Name error (3)	us-usps-qgleum.xyz	none	none	65	IN (0x0001)	false
Oct 6, 2024 18:54:10.273315907 CEST	1.1.1.1	192.168.2.5	0xf444	Name error (3)	us-usps-qgleum.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:11.699194908 CEST	1.1.1.1	192.168.2.5	0x586e	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 6, 2024 18:54:11.699959040 CEST	1.1.1.1	192.168.2.5	0xa426	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:15.314341068 CEST	1.1.1.1	192.168.2.5	0x139	Name error (3)	us-usps-qgleum.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:15.319355965 CEST	1.1.1.1	192.168.2.5	0xc78f	Name error (3)	us-usps-qgleum.xyz	none	none	65	IN (0x0001)	false
Oct 6, 2024 18:54:15.334001064 CEST	1.1.1.1	192.168.2.5	0x98c7	Name error (3)	us-usps-qgleum.xyz	none	none	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:20.925345898 CEST	1.1.1.1	192.168.2.5	0x33ed	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:54:20.925345898 CEST	1.1.1.1	192.168.2.5	0x33ed	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 6, 2024 18:54:21.586250067 CEST	1.1.1.1	192.168.2.5	0x13f4	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:54:21.586250067 CEST	1.1.1.1	192.168.2.5	0x13f4	No error (0)	dual.s-part-0044.t-0009.fb-t-msedge.net	s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 6, 2024 18:54:21.586250067 CEST	1.1.1.1	192.168.2.5	0x13f4	No error (0)	s-part-0044.t-0009.fb-t-msedge.net		13.107.253.72	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49720	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:22 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:22 UTC	561	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:22 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 04 Oct 2024 23:21:50 GMT ETag: "0x8DCE4CB535A72FA" x-ms-request-id: 5e64ff20-601e-005c-6bc1-17f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165422Z-1767f7688dc97m2se6u6hv466400000006gg00000000fwmz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:22 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-06 16:54:22 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-06 16:54:22 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-06 16:54:22 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-06 16:54:22 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-06 16:54:22 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-06 16:54:22 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-06 16:54:22 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-06 16:54:22 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-06 16:54:22 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49723	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:23 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:23 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:23 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 265a1445-001e-00a2-25c7-17d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165423Z-1767f7688dczvnhxbpcveghk5g0000000a7g00000000dm3a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:23 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49724	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:23 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:23 UTC	584	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:23 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c59bb0f9-701e-0097-2d01-17b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165423Z-1767f7688dc7bfz42qn9t7yq500000000qs000000000kkqr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:23 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49726	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:23 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:23 UTC	584	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:23 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b9d87bc3-001e-008d-128c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165423Z-r154656d9bctbqfcgmyvqx3k100000000d6g00000000cdmg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:23 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49725	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:23 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:23 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 92b6e55f-b01e-003d-50eb-17d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165423Z-1767f7688dcsjpdx60gbb8v42g0000000a1000000000hcym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:23 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49727	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:23 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:23 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4b0a31e7-c01e-00ad-448c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165423Z-r154656d9bcc2bdtn1pd2qfd4c0000000qu0000000008uk2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:23 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49731	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:24 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:24 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 3a0dc1eb-601e-0032-608c-15eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165424Z-1767f7688dcxjm7c0w73xyx8vs0000000qy000000000e2ab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:24 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49730	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:24 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 757ce4f4-401e-000a-128c-154a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165424Z-1767f7688dc7bfz42qn9t7yq500000000qu000000000bedn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49728	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:24 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: aa8826a4-b01e-0053-608c-15cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165424Z-r154656d9bczmvnbrzm0xmzrs40000000d8g00000000er5y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:24 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49732	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:24 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:24 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: b2393cc3-501e-005b-768c-15d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165424Z-r154656d9bcpkd87yvea8r1dfg0000000cwg000000005kwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:24 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49729	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:24 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 24b39cfc-301e-0096-2a8c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165424Z-r154656d9bcmxqxrqrw0qrf8hg00000009kg00000000a0g5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49736	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:25 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: e0871f45-901e-00a0-0d8c-156a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165425Z-1767f7688dcdvjcfkw13t1btbs0000000r3000000000047u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49733	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:25 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: cc223d3c-501e-008f-0ec7-179054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165425Z-r154656d9bcmxqxrqrw0qrf8hg00000009mg000000007qne x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49735	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:25 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 0e559fae-201e-006e-7ee7-17bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165425Z-r154656d9bc94jg685tuhe75qw0000000dag000000006tpw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:54:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49734	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:25 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 1cc301c6-e01e-0071-6b8c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165425Z-r154656d9bcc2bdtn1pd2qfd4c0000000qvg000000006akv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49737	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:25 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 023e3944-a01e-003d-708c-1598d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165425Z-1767f7688dctps2t8qk28fz8yg0000000qs0000000008ty9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49739	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:25 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: c54fb296-901e-008f-528c-1567a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165425Z-r154656d9bc94jg685tuhe75qw0000000dag000000006tqt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49738	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:25 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:25 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 77844cee-a01e-0032-35c7-171949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165425Z-1767f7688dc2kzqgyrtc6e2gp40000000qpg000000009nzq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49741	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:25 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:25 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 348a4018-801e-0078-54c7-17bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165425Z-1767f7688dck2l7961u6s0hrtn0000000qyg00000000a2w8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:54:26 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49740	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:25 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 24b39fc0-301e-0096-298c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165426Z-r154656d9bcdp2lt7d5tpscfcn0000000r1g0000000023dr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49742	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:26 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:26 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 79ade187-001e-0065-788c-150b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165426Z-1767f7688dcjgr4ssr2c6t2x2s0000000qyg00000000huvm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:26 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49744	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:26 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8e9c869d-201e-000c-4b8c-1579c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165426Z-1767f7688dcdplk6tmg02e519n0000000qyg00000000emat x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49743	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:26 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 09392ef7-101e-0046-3f05-1791b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165426Z-1767f7688dccc6lkbm0py95vf00000000r3g000000002r18 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49745	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:26 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:26 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f57b7c9f-801e-00a0-4a13-172196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165426Z-r154656d9bc5gm9nqxzv5c87e8000000049g00000000betk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:26 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49746	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:26 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f71a7e49-201e-000c-5aa4-1579c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165426Z-1767f7688dccc6lkbm0py95vf00000000qzg00000000ava7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:54:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49747	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:26 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:26 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 82f8b22c-c01e-0014-5a8c-15a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165426Z-1767f7688dc6trhkx0ckh4u3qn0000000r6g0000000024k8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:27 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49750	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:27 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: e44feb8c-a01e-0084-742d-169ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165427Z-r154656d9bcx62tnuqgh46euy400000006tg00000000cfud x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49748	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:27 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:27 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 22e42897-601e-0070-65c7-17a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165427Z-1767f7688dc7tjsxtc1ffgx97w0000000qwg000000005xkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:54:27 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49749	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:27 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 1e32dda0-e01e-000c-2bf8-178e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165427Z-r154656d9bcvjnbgheqhz2uek80000000qt000000000k1ub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:54:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49751	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:27 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c2ca9d4d-801e-0035-458c-15752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165427Z-1767f7688dc5kg9bwc8fvfnfb40000000r1000000000676y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49752	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:27 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:27 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: cce90406-001e-005a-059e-15c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165427Z-1767f7688dc97m2se6u6hv466400000006q00000000040yw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:27 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49753	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:28 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:28 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: a7623418-001e-00a2-348c-15d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165428Z-r154656d9bczmvnbrzm0xmzrs40000000df0000000000e20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:28 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49755	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:28 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: a62739ea-301e-005d-6402-17e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165428Z-r154656d9bcqqgssyv95384a1c0000000qvg0000000086d8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49754	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:28 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: cc1dda0d-101e-0079-139e-155913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165428Z-1767f7688dcp6rq9vksdbz5r100000000qug000000003vvv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49756	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:28 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 76615707-c01e-0082-6a8c-15af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165428Z-1767f7688dc4zx8hzkgqpgqkb400000008k0000000009xun x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49757	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:28 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:28 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: e8bdadc1-401e-0067-74c7-1709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165428Z-1767f7688dc7tjsxtc1ffgx97w0000000qv0000000008r99 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:54:28 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49758	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:29 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:29 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: c4ad759c-701e-0001-2422-16b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165429Z-r154656d9bcpnqc46yk454phh800000002kg000000005dfv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:29 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49759	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:29 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:29 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 0dcb6c6d-e01e-0003-668c-150fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165429Z-1767f7688dccnqqfuv6uyx4er00000000190000000009fzs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:29 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49760	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:29 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 8789ddbb-a01e-0084-6a8c-159ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165429Z-r154656d9bcjfw87mb0kw1h2480000000d8g0000000078u9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49761	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:29 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:29 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 9bed673a-001e-0046-278c-15da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165429Z-1767f7688dcjgr4ssr2c6t2x2s0000000qy000000000kqpc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:29 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49762	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:29 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:29 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: ed9c017d-601e-000d-3e22-162618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165429Z-r154656d9bczmvnbrzm0xmzrs40000000ddg000000004dre x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:29 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49764	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:29 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:29 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c5dbf9be-001e-0017-2cf1-160c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165429Z-r154656d9bcpkd87yvea8r1dfg0000000cr000000000fzhn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:29 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49765	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:29 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:29 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 1f480944-c01e-002b-018c-156e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165429Z-r154656d9bczc24jcy1csnb0es0000000140000000009r8q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:30 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49763	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:29 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:29 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cbb781ac-501e-0047-14a6-15ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165429Z-1767f7688dc5kg9bwc8fvfnfb40000000qz000000000adf0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:54:30 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49766	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:30 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:30 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 85e8bebc-601e-0032-1873-16eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165430Z-1767f7688dcp6rq9vksdbz5r100000000qrg00000000ae63 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:54:30 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49767	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:30 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:30 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 4b3baa61-c01e-00ad-4e9e-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165430Z-r154656d9bclprr71vn2nvcemn0000000qv000000000acr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:54:30 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49768	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:30 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:30 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 76252b1b-c01e-0066-488c-15a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165430Z-r154656d9bclhnqxthdkb0ps8000000006p000000000hkxh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:30 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49769	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:30 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b83a8dc4-f01e-003f-308c-15d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165430Z-1767f7688dc2kzqgyrtc6e2gp40000000qpg000000009p5g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49770	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:30 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: cc687b4d-101e-0079-45b6-155913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165430Z-r154656d9bcclz9cswng83z0t000000009c000000000anfv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:54:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49771	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:30 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c276760a-301e-0051-159c-1538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165430Z-r154656d9bclhnqxthdkb0ps8000000006v0000000004xtq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:54:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49772	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:30 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:30 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 3883747d-501e-008c-279e-15cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165430Z-r154656d9bc4v6bg39gwnbf5vn00000005bg00000000efew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-06 16:54:30 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49773	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:31 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 1f480aea-c01e-002b-028c-156e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165431Z-r154656d9bcvjnbgheqhz2uek80000000qx0000000008aws x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49775	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:31 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 16d3a614-701e-0032-288c-15a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165431Z-1767f7688dccc6lkbm0py95vf00000000r20000000005q4z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49774	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:31 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 7be6821c-d01e-008e-398c-15387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165431Z-1767f7688dcxs7gvbd5dcgxeys0000000qk000000000aq9b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49776	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:31 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: aa883537-b01e-0053-4c8c-15cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165431Z-r154656d9bc27nzfvdqr2guqt000000000h000000000ay8d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49777	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:31 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-06 16:54:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 06 Oct 2024 16:54:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: cce0beff-001e-0082-398c-155880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241006T165431Z-1767f7688dc7tjsxtc1ffgx97w0000000qz0000000001auy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-06 16:54:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49778	13.107.253.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-06 16:54:32 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 3012, Parent PID: 5424

General

Target ID:	0
Start time:	12:54:01
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 2952, Parent PID: 3012

General

Target ID:	2
Start time:	12:54:05
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,4751949160752344263,348731842178357154,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6348, Parent PID: 5424

General

Target ID:	3
Start time:	12:54:07
Start date:	06/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://us-usps-qgleum.xyz/update/"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://us-usps-qgleum.xyz/update/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 3012, Parent PID: 5424

General

Chronological Activities

Analysis Process: chrome.exePID: 2952, Parent PID: 3012

General

Chronological Activities

Analysis Process: chrome.exePID: 6348, Parent PID: 5424

General

Chronological Activities

Windows Analysis Report
https://us-usps-qgleum.xyz/update/