Edit tour

Windows Analysis Report
https://sync.search.spotxchange.com

Overview

General Information

Sample URL:	https://sync.search.spotxchange.com
Analysis ID:	1540402
Infos:

Errors URL not reachable

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1400 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2352,i,10113120810550939655,13818382508830664056,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4768 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sync.search.spotxchange.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.51:443 -> 192.168.2.5:49714 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: sync.search.spotxchange.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.51:443 -> 192.168.2.5:49714 version: TLS 1.2

Source: classification engine

Classification label: unknown0.win@20/6@19/3

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2352,i,10113120810550939655,13818382508830664056,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sync.search.spotxchange.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2352,i,10113120810550939655,13818382508830664056,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
google.com	216.58.206.78	true	false	unknown
s-part-0023.t-0009.fb-t-msedge.net	13.107.253.51	true	false	unknown
www.google.com	216.58.212.132	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
sync.search.spotxchange.com	unknown	unknown	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved		unknown	unknown	false
216.58.212.132	www.google.com	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540402
Start date and time:	2024-10-23 18:41:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://sync.search.spotxchange.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	UNKNOWN
Classification:	unknown0.win@20/6@19/3
Cookbook Comments:	URL browsing timeout or error

Errors

URL not reachable

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.67, 142.250.186.110, 142.250.110.84, 34.104.35.123, 4.175.87.197, 199.232.214.172, 192.229.221.95, 13.85.23.206
Excluded domains from analysis (whitelisted): azurefd-t-fb-prod.trafficmanager.net, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.afd.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://sync.search.spotxchange.com

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 15:42:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9749623656819124
Encrypted:	false
SSDEEP:	48:8vdpTxR8HIidAKZdA19ehwiZUklqehyy+3:8PHDhy
MD5:	DB14A478C0C3C0ACE87660E29955A786
SHA1:	A0C70EB32B88E06C7B6B0FFCD9E64AB50B9D5108
SHA-256:	3BE14B6520F12221EC9400BB1120470CCCF48DED6CAD9EE8193B5FB22B38CBCC
SHA-512:	3760C2E9E3A4E24771DB523982A935EF2CFB45C25A9C413F2F55F0E791899CD42D1AC375ACB6C8AE551AA510F5C1D1670B6548D03DF1D4EE58A794D1291C8EEC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....'...j%..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IWYA.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VWYA.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VWYA.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VWYA............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VWYD............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 15:42:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9884634436764883
Encrypted:	false
SSDEEP:	48:8pdpTxR8HIidAKZdA1weh/iZUkAQkqehRy+2:81Hx9QMy
MD5:	99976464EACD397F7E3F8D5DF678F597
SHA1:	E83734B4AAC27C4482DBF377B8867A4C83E57FF6
SHA-256:	0AD1ECC414C61101F680ABD6E178E4F2FF1BA6954E872D7CF455A615307316C3
SHA-512:	F633879D782AB955F0D3BB73542E95D379EE65CF24D276FA63BE583A30BE5976E097C978AB8B71E48BABBBBCC4A8876E2C523184CEAC4D26354A1D46DBB067C8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....e...j%..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IWYA.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VWYA.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VWYA.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VWYA............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VWYD............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.001506861388589
Encrypted:	false
SSDEEP:	48:8xadpTxRsHIidAKZdA14tseh7sFiZUkmgqeh7szy+BX:8x8Hxn9y
MD5:	D7443B6ACABEA031EF17CB60CF893590
SHA1:	9207B2D392DCD2A86743CB8C7B77B8ABF545235E
SHA-256:	FFF385D4D2A01D970D4F336AF6C0FF2EBA5A25DC51C79D142DA0237E16976B14
SHA-512:	915BE9E04186E1E54BFB9C50087566E3388A38AAD9DC999952647196FA8A137ED7DA418358A601F39F0BB3874E875A22A7AB103B46FD88E6F0ED3AF7E00AA85B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IWYA.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VWYA.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VWYA.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VWYA............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 15:42:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9858149089479036
Encrypted:	false
SSDEEP:	48:8xdpTxR8HIidAKZdA1vehDiZUkwqehVy+R:8dHyry
MD5:	3762D63F6F918CDE973ACFCB94F46196
SHA1:	B2FDBE5FA86B8F15A3FFE337B6816C95B4163E56
SHA-256:	C8AA5EA936AF2707E8D7998295EE9ED40FEC5921C7885087F371B9604F4D3510
SHA-512:	4434F3B0F89FD99C33B958BE39C3D50EA6C1BCCBB77C143E430A2ADE3C0F27C7673080DBCFA979F2C1E724A14B976F9341D001238D81CD42EC2B3772CABC5981
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....qo..j%..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IWYA.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VWYA.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VWYA.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VWYA............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VWYD............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 15:42:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9769590140580515
Encrypted:	false
SSDEEP:	48:8mdpTxR8HIidAKZdA1hehBiZUk1W1qeh/y+C:84HC9fy
MD5:	7213315B510B5643E3720F0C82014200
SHA1:	E4795018A7ADB2C3B39A3710B149A00E318AE407
SHA-256:	FB38B55F945C4D13C6C52C58761FD735C3A2DAEC56D64792D5A08C6FA0A1A340
SHA-512:	ABB4C147E6A3DD3D63E2832C752112C2C6C88C8346A38B6F990215F77EE8E98FDDB71D0E32A02BB97799AACB0E52835576EE6E2462D8C5EDFAA6C82733DFBDAD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....4[..j%..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IWYA.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VWYA.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VWYA.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VWYA............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VWYD............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 23 15:42:07 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.987832570311037
Encrypted:	false
SSDEEP:	48:8OdpTxR8HIidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb9y+yT+:8AH8T/TbxWOvTb9y7T
MD5:	151C9F3B5A38F48219BC7C56CE6FDA6E
SHA1:	9ED8889E5DCCC86565D15F3F9D306C1C98E4F2E2
SHA-256:	D9187A6F8A6789A0FE091A69F53CEBA2BAD5AD377656A15B38A1252DA4A2FE44
SHA-512:	016637B6DF96EAA2BF984EAF5E693E578B0C2CD0B11A2EF409D5CF088FFA8E262EE6419AFCBA4187E5C0E4F1BF0FAF2F580E9781D650AB0650A1B6625586B5B2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........j%..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IWYA.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VWYA.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VWYA.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VWYA............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VWYD............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2024 18:41:58.018851995 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 23, 2024 18:41:58.112622023 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 23, 2024 18:41:58.222031116 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 23, 2024 18:42:07.639101028 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 23, 2024 18:42:07.838171959 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 23, 2024 18:42:07.838268042 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 23, 2024 18:42:09.542910099 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 23, 2024 18:42:09.543035984 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 23, 2024 18:42:09.688987017 CEST	49711	443	192.168.2.5	216.58.212.132
Oct 23, 2024 18:42:09.689042091 CEST	443	49711	216.58.212.132	192.168.2.5
Oct 23, 2024 18:42:09.689127922 CEST	49711	443	192.168.2.5	216.58.212.132
Oct 23, 2024 18:42:09.689368010 CEST	49711	443	192.168.2.5	216.58.212.132
Oct 23, 2024 18:42:09.689389944 CEST	443	49711	216.58.212.132	192.168.2.5
Oct 23, 2024 18:42:10.568406105 CEST	443	49711	216.58.212.132	192.168.2.5
Oct 23, 2024 18:42:10.568660975 CEST	49711	443	192.168.2.5	216.58.212.132
Oct 23, 2024 18:42:10.568675041 CEST	443	49711	216.58.212.132	192.168.2.5
Oct 23, 2024 18:42:10.570139885 CEST	443	49711	216.58.212.132	192.168.2.5
Oct 23, 2024 18:42:10.570218086 CEST	49711	443	192.168.2.5	216.58.212.132
Oct 23, 2024 18:42:10.571494102 CEST	49711	443	192.168.2.5	216.58.212.132
Oct 23, 2024 18:42:10.571580887 CEST	443	49711	216.58.212.132	192.168.2.5
Oct 23, 2024 18:42:10.623318911 CEST	49711	443	192.168.2.5	216.58.212.132
Oct 23, 2024 18:42:10.623328924 CEST	443	49711	216.58.212.132	192.168.2.5
Oct 23, 2024 18:42:10.670176983 CEST	49711	443	192.168.2.5	216.58.212.132
Oct 23, 2024 18:42:11.097675085 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:11.097714901 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:11.097800016 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:11.107225895 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:11.107242107 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:11.966183901 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:11.966365099 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:11.970567942 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:11.970573902 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:11.970973015 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:12.015546083 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:12.024779081 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:12.067336082 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:12.268798113 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:12.268876076 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:12.268954039 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:12.269104958 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:12.269104958 CEST	49712	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:12.269117117 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:12.269124031 CEST	443	49712	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:12.313955069 CEST	49713	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:12.314044952 CEST	443	49713	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:12.314148903 CEST	49713	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:12.314435959 CEST	49713	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:12.314483881 CEST	443	49713	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:13.182363033 CEST	443	49713	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:13.182460070 CEST	49713	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:13.183765888 CEST	49713	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:13.183784008 CEST	443	49713	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:13.184029102 CEST	443	49713	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:13.185412884 CEST	49713	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:13.227336884 CEST	443	49713	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:13.428442001 CEST	443	49713	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:13.428493023 CEST	443	49713	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:13.428608894 CEST	49713	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:13.429325104 CEST	49713	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:13.429351091 CEST	443	49713	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:13.429359913 CEST	49713	443	192.168.2.5	184.28.90.27
Oct 23, 2024 18:42:13.429368019 CEST	443	49713	184.28.90.27	192.168.2.5
Oct 23, 2024 18:42:16.699811935 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:16.699852943 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:16.699908972 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:16.700223923 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:16.700238943 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.476957083 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.477210999 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:17.493860960 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:17.493881941 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.494784117 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.511265993 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:17.551352978 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.722179890 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.722204924 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.722244024 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.722269058 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:17.722281933 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.722301006 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:17.722322941 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:17.768955946 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.768982887 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.769021034 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:17.769030094 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.769102097 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:17.888115883 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.888144016 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.888209105 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:17.888222933 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:17.888298035 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:17.888500929 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.007848024 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.007875919 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.007968903 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.007985115 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.008049965 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.048656940 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.048680067 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.048728943 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.048743010 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.048847914 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.127978086 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.128001928 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.128077984 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.128087997 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.128106117 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.128125906 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.247350931 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.247376919 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.247469902 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.247492075 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.247592926 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.248858929 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.248879910 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.248923063 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.248930931 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.248960972 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.249191999 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.367717981 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.367764950 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.367804050 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.367821932 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.367861032 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.367963076 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.408006907 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.408063889 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.408096075 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.408111095 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.408153057 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.408180952 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.487859011 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.487920046 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.487976074 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.487991095 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.488020897 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.488096952 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.561419964 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.561472893 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.561513901 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.561526060 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.561548948 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.561568975 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.608023882 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.608083963 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.608114958 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.608123064 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.608146906 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.608192921 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.608860970 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.608939886 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.608946085 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.609024048 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.609100103 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.609169960 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.609184980 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.609195948 CEST	49714	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.609204054 CEST	443	49714	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.651014090 CEST	49716	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.651017904 CEST	49717	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.651038885 CEST	443	49716	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.651098013 CEST	49716	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.651104927 CEST	443	49717	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.651160002 CEST	49717	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.651494026 CEST	49716	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.651503086 CEST	443	49716	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.651716948 CEST	49717	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.651752949 CEST	443	49717	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.652875900 CEST	49718	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.652884007 CEST	443	49718	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.652992010 CEST	49718	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.653096914 CEST	49718	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.653101921 CEST	443	49718	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.654257059 CEST	49719	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.654278040 CEST	443	49719	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.654581070 CEST	49719	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.655333042 CEST	49720	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.655369043 CEST	443	49720	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.655425072 CEST	49720	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.655428886 CEST	49719	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.655467987 CEST	443	49719	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:18.655630112 CEST	49720	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:18.655643940 CEST	443	49720	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.397602081 CEST	443	49718	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.413990974 CEST	443	49716	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.414243937 CEST	443	49719	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.415987015 CEST	443	49717	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.418914080 CEST	443	49720	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.450628996 CEST	49718	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.466248035 CEST	49716	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.466267109 CEST	49719	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.466336966 CEST	49717	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.466377020 CEST	49720	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.503334999 CEST	49720	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.503360033 CEST	443	49720	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.511082888 CEST	49720	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.511090994 CEST	443	49720	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.511610985 CEST	49717	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.511667013 CEST	443	49717	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.512072086 CEST	49717	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.512087107 CEST	443	49717	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.512445927 CEST	49718	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.512454033 CEST	443	49718	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.512804985 CEST	49718	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.512809038 CEST	443	49718	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.541925907 CEST	49716	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.541929960 CEST	443	49716	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.566981077 CEST	49716	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.566986084 CEST	443	49716	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.579109907 CEST	49719	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.579127073 CEST	443	49719	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.579902887 CEST	49719	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.579921007 CEST	443	49719	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.642393112 CEST	443	49718	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.642426014 CEST	443	49718	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.642492056 CEST	49718	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.642501116 CEST	443	49718	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.642565966 CEST	49718	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.642580986 CEST	443	49718	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.642664909 CEST	49718	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.644032955 CEST	49718	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.644046068 CEST	443	49718	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.644047976 CEST	49718	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.644059896 CEST	443	49718	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.645587921 CEST	443	49717	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.645653009 CEST	443	49717	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.645831108 CEST	49717	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.646192074 CEST	443	49720	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.646203995 CEST	443	49720	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.646269083 CEST	49720	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.646296024 CEST	443	49720	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.646437883 CEST	443	49720	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.646552086 CEST	49720	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.647505045 CEST	49720	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.647505045 CEST	49720	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.647526026 CEST	443	49720	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.647547007 CEST	443	49720	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.651823997 CEST	49717	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.651865959 CEST	443	49717	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.664908886 CEST	49722	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.664940119 CEST	443	49722	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.665026903 CEST	49722	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.667740107 CEST	49723	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.667757988 CEST	443	49723	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.667841911 CEST	49723	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.668133020 CEST	49722	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.668164968 CEST	443	49722	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.668869019 CEST	49723	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.668879986 CEST	443	49723	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.675288916 CEST	49724	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.675327063 CEST	443	49724	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.675395966 CEST	49724	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.675776958 CEST	49724	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.675791979 CEST	443	49724	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.701092005 CEST	443	49716	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.701149940 CEST	443	49716	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.701206923 CEST	49716	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.701214075 CEST	443	49716	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.701355934 CEST	443	49716	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.701390982 CEST	49716	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.701421976 CEST	49716	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.701891899 CEST	49716	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.701895952 CEST	443	49716	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.701913118 CEST	49716	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.701916933 CEST	443	49716	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.706892967 CEST	49726	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.706918001 CEST	443	49726	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.707014084 CEST	49726	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.707119942 CEST	49726	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.707127094 CEST	443	49726	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.713588953 CEST	443	49719	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.713676929 CEST	443	49719	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.713754892 CEST	49719	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.714013100 CEST	49719	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.714013100 CEST	49719	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.714057922 CEST	443	49719	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.714087963 CEST	443	49719	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.720616102 CEST	49728	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.720639944 CEST	443	49728	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:19.720714092 CEST	49728	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.720873117 CEST	49728	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:19.720884085 CEST	443	49728	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.449748039 CEST	443	49722	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.450309038 CEST	49722	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.450325012 CEST	443	49722	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.450843096 CEST	49722	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.450861931 CEST	443	49722	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.456682920 CEST	443	49723	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.457050085 CEST	49723	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.457073927 CEST	443	49723	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.457482100 CEST	49723	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.457488060 CEST	443	49723	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.458386898 CEST	443	49724	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.458779097 CEST	49724	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.458794117 CEST	443	49724	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.459181070 CEST	49724	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.459186077 CEST	443	49724	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.480564117 CEST	443	49726	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.480906963 CEST	49726	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.480916977 CEST	443	49726	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.481172085 CEST	443	49728	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.481314898 CEST	49726	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.481322050 CEST	443	49726	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.481580973 CEST	49728	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.481601000 CEST	443	49728	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.482024908 CEST	49728	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.482031107 CEST	443	49728	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.561573029 CEST	443	49711	216.58.212.132	192.168.2.5
Oct 23, 2024 18:42:20.561723948 CEST	443	49711	216.58.212.132	192.168.2.5
Oct 23, 2024 18:42:20.561803102 CEST	49711	443	192.168.2.5	216.58.212.132
Oct 23, 2024 18:42:20.587284088 CEST	443	49722	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.587364912 CEST	443	49722	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.587455034 CEST	49722	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.587646961 CEST	49722	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.587646961 CEST	49722	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.587666988 CEST	443	49722	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.587681055 CEST	443	49722	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.589976072 CEST	49730	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.590045929 CEST	443	49730	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.590240955 CEST	49730	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.590385914 CEST	49730	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.590396881 CEST	443	49730	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.592900991 CEST	49711	443	192.168.2.5	216.58.212.132
Oct 23, 2024 18:42:20.592916012 CEST	443	49711	216.58.212.132	192.168.2.5
Oct 23, 2024 18:42:20.593395948 CEST	443	49724	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.593535900 CEST	443	49724	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.593594074 CEST	49724	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.593688965 CEST	443	49723	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.593858004 CEST	49724	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.593858004 CEST	49724	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.593867064 CEST	443	49724	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.593874931 CEST	443	49724	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.594252110 CEST	443	49723	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.594319105 CEST	49723	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.594711065 CEST	49723	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.594724894 CEST	443	49723	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.594736099 CEST	49723	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.594743967 CEST	443	49723	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.597029924 CEST	49731	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.597054005 CEST	443	49731	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.597178936 CEST	49731	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.597296000 CEST	49732	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.597299099 CEST	49731	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.597311974 CEST	443	49732	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.597313881 CEST	443	49731	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.597373962 CEST	49732	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.597453117 CEST	49732	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.597457886 CEST	443	49732	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.622948885 CEST	443	49726	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.623100996 CEST	443	49728	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.623167038 CEST	443	49726	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.623172998 CEST	443	49728	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.623248100 CEST	49728	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.623270035 CEST	49726	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.623270035 CEST	49726	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.623294115 CEST	49726	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.623296976 CEST	49728	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.623306990 CEST	443	49726	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.623341084 CEST	443	49728	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.625749111 CEST	49734	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.625762939 CEST	443	49734	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.625785112 CEST	49733	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.625822067 CEST	443	49733	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.625849009 CEST	49734	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.625881910 CEST	49733	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.625986099 CEST	49733	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.626005888 CEST	49734	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:20.626012087 CEST	443	49733	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:20.626015902 CEST	443	49734	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.337125063 CEST	443	49731	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.337532997 CEST	49731	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.337544918 CEST	443	49731	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.339310884 CEST	49731	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.339315891 CEST	443	49731	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.352720022 CEST	443	49732	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.353123903 CEST	49732	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.353141069 CEST	443	49732	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.353581905 CEST	49732	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.353586912 CEST	443	49732	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.372956991 CEST	443	49734	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.373419046 CEST	49734	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.373426914 CEST	443	49734	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.373852015 CEST	49734	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.373856068 CEST	443	49734	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.382277966 CEST	443	49733	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.382900953 CEST	49733	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.382914066 CEST	443	49733	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.383095026 CEST	49733	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.383100033 CEST	443	49733	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.470489979 CEST	443	49731	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.470575094 CEST	443	49731	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.470635891 CEST	49731	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.470802069 CEST	49731	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.470818043 CEST	443	49731	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.470829010 CEST	49731	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.470834970 CEST	443	49731	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.473726034 CEST	49736	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.473754883 CEST	443	49736	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.473823071 CEST	49736	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.474000931 CEST	49736	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.474014997 CEST	443	49736	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.488265038 CEST	443	49732	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.488416910 CEST	443	49732	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.488487959 CEST	49732	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.488610029 CEST	49732	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.488626003 CEST	443	49732	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.488640070 CEST	49732	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.488645077 CEST	443	49732	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.491451979 CEST	49737	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.491482019 CEST	443	49737	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.491535902 CEST	49737	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.491761923 CEST	49737	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.491772890 CEST	443	49737	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.507088900 CEST	443	49734	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.507262945 CEST	443	49734	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.507379055 CEST	49734	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.507446051 CEST	49734	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.507446051 CEST	49734	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.507456064 CEST	443	49734	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.507462978 CEST	443	49734	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.510329962 CEST	49738	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.510373116 CEST	443	49738	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.510466099 CEST	49738	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.510608912 CEST	49738	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.510636091 CEST	443	49738	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.519714117 CEST	443	49733	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.519890070 CEST	443	49733	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.519994974 CEST	49733	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.520042896 CEST	49733	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.520042896 CEST	49733	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.520061016 CEST	443	49733	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.520070076 CEST	443	49733	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.522392988 CEST	49739	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.522409916 CEST	443	49739	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.522473097 CEST	49739	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.522588968 CEST	49739	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.522598982 CEST	443	49739	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.692488909 CEST	443	49730	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.692962885 CEST	49730	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.692996025 CEST	443	49730	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.693424940 CEST	49730	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.693437099 CEST	443	49730	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.828077078 CEST	443	49730	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.828763008 CEST	443	49730	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.828886032 CEST	49730	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.828948021 CEST	49730	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.828948021 CEST	49730	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.828988075 CEST	443	49730	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.829022884 CEST	443	49730	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.831614971 CEST	49741	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.831646919 CEST	443	49741	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:21.831717968 CEST	49741	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.831887007 CEST	49741	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:21.831902027 CEST	443	49741	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.248501062 CEST	443	49736	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.248955011 CEST	49736	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.248975039 CEST	443	49736	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.250773907 CEST	49736	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.250778913 CEST	443	49736	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.252563953 CEST	443	49737	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.252948046 CEST	49737	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.252963066 CEST	443	49737	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.253410101 CEST	49737	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.253416061 CEST	443	49737	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.256716013 CEST	443	49738	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.257172108 CEST	49738	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.257184982 CEST	443	49738	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.257556915 CEST	49738	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.257561922 CEST	443	49738	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.275733948 CEST	443	49739	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.276096106 CEST	49739	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.276115894 CEST	443	49739	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.276503086 CEST	49739	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.276506901 CEST	443	49739	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.389332056 CEST	443	49736	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.389472961 CEST	443	49736	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.389565945 CEST	49736	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.389630079 CEST	49736	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.389638901 CEST	443	49736	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.389669895 CEST	49736	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.389674902 CEST	443	49736	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.389847994 CEST	443	49737	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.389915943 CEST	443	49737	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.389998913 CEST	49737	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.390117884 CEST	49737	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.390131950 CEST	443	49737	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.390141964 CEST	49737	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.390146971 CEST	443	49737	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.390304089 CEST	443	49738	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.390444994 CEST	443	49738	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.390495062 CEST	49738	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.390687943 CEST	49738	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.390691996 CEST	443	49738	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.393174887 CEST	49742	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.393265963 CEST	443	49742	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.393351078 CEST	49742	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.393810034 CEST	49743	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.393812895 CEST	49742	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.393841982 CEST	443	49743	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.393848896 CEST	443	49742	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.393893003 CEST	49744	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.393912077 CEST	443	49744	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.393928051 CEST	49743	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.393956900 CEST	49744	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.394064903 CEST	49743	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.394083977 CEST	443	49743	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.394153118 CEST	49744	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.394165993 CEST	443	49744	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.414321899 CEST	443	49739	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.414386988 CEST	443	49739	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.414450884 CEST	49739	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.414556026 CEST	49739	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.414565086 CEST	443	49739	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.414587021 CEST	49739	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.414591074 CEST	443	49739	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.416713953 CEST	49745	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.416729927 CEST	443	49745	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.416949034 CEST	49745	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.417109966 CEST	49745	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.417120934 CEST	443	49745	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.590054989 CEST	443	49741	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.590570927 CEST	49741	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.590583086 CEST	443	49741	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.591012955 CEST	49741	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.591017962 CEST	443	49741	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.728355885 CEST	443	49741	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.728476048 CEST	443	49741	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.728579998 CEST	49741	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.728645086 CEST	49741	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.728658915 CEST	443	49741	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.728663921 CEST	49741	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.728668928 CEST	443	49741	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.731379032 CEST	49746	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.731404066 CEST	443	49746	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:22.731530905 CEST	49746	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.731704950 CEST	49746	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:22.731718063 CEST	443	49746	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.141988039 CEST	443	49743	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.142695904 CEST	49743	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.142719984 CEST	443	49743	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.144562006 CEST	49743	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.144567966 CEST	443	49743	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.145680904 CEST	443	49744	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.146125078 CEST	49744	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.146147966 CEST	443	49744	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.146466017 CEST	49744	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.146471024 CEST	443	49744	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.167823076 CEST	443	49742	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.168405056 CEST	49742	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.168452978 CEST	443	49742	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.168979883 CEST	49742	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.168992996 CEST	443	49742	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.175724983 CEST	443	49745	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.176168919 CEST	49745	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.176189899 CEST	443	49745	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.176531076 CEST	49745	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.176536083 CEST	443	49745	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.278887033 CEST	443	49743	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.279045105 CEST	443	49743	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.279541016 CEST	49743	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.279732943 CEST	49743	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.279732943 CEST	49743	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.279748917 CEST	443	49743	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.279757023 CEST	443	49743	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.282851934 CEST	443	49744	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.282905102 CEST	49747	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.282924891 CEST	443	49744	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.282943010 CEST	443	49747	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.282982111 CEST	49744	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.283016920 CEST	49747	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.283117056 CEST	49744	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.283138990 CEST	443	49744	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.283150911 CEST	49744	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.283155918 CEST	443	49744	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.283329964 CEST	49747	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.283339977 CEST	443	49747	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.285890102 CEST	49748	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.285922050 CEST	443	49748	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.286135912 CEST	49748	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.286135912 CEST	49748	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.286164045 CEST	443	49748	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.304786921 CEST	443	49742	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.304929972 CEST	443	49742	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.305049896 CEST	49742	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.305133104 CEST	49742	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.305133104 CEST	49742	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.305176020 CEST	443	49742	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.305203915 CEST	443	49742	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.307904005 CEST	49749	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.307952881 CEST	443	49749	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.308037996 CEST	49749	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.308199883 CEST	49749	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.308229923 CEST	443	49749	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.317398071 CEST	443	49745	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.317470074 CEST	443	49745	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.317636013 CEST	49745	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.317661047 CEST	49745	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.317677021 CEST	443	49745	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.317691088 CEST	49745	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.317696095 CEST	443	49745	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.320314884 CEST	49750	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.320337057 CEST	443	49750	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.320892096 CEST	49750	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.321093082 CEST	49750	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.321105003 CEST	443	49750	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.494498014 CEST	443	49746	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.495060921 CEST	49746	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.495080948 CEST	443	49746	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.495739937 CEST	49746	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.495743990 CEST	443	49746	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.630635977 CEST	443	49746	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.630794048 CEST	443	49746	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.630845070 CEST	49746	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.630937099 CEST	49746	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.630949974 CEST	443	49746	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.633234024 CEST	49751	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.633308887 CEST	443	49751	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:23.633403063 CEST	49751	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.633574963 CEST	49751	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:23.633610010 CEST	443	49751	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.047272921 CEST	443	49748	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.047920942 CEST	49748	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.047936916 CEST	443	49748	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.048418045 CEST	49748	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.048424006 CEST	443	49748	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.088938951 CEST	443	49747	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.089448929 CEST	49747	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.089510918 CEST	443	49747	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.089936018 CEST	49747	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.089948893 CEST	443	49747	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.096574068 CEST	443	49750	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.097131014 CEST	49750	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.097145081 CEST	443	49750	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.097796917 CEST	49750	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.097801924 CEST	443	49750	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.098357916 CEST	443	49749	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.098953962 CEST	49749	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.098992109 CEST	443	49749	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.099350929 CEST	49749	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.099365950 CEST	443	49749	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.184034109 CEST	443	49748	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.184376955 CEST	443	49748	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.184468031 CEST	49748	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.184468031 CEST	49748	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.184504986 CEST	49748	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.184519053 CEST	443	49748	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.187449932 CEST	49752	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.187491894 CEST	443	49752	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.187567949 CEST	49752	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.187724113 CEST	49752	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.187735081 CEST	443	49752	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.225954056 CEST	443	49747	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.226607084 CEST	443	49747	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.226677895 CEST	49747	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.226732016 CEST	49747	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.226757050 CEST	443	49747	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.226774931 CEST	49747	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.226782084 CEST	443	49747	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.229553938 CEST	49753	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.229598999 CEST	443	49753	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.229672909 CEST	49753	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.229789972 CEST	49753	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.229806900 CEST	443	49753	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.231237888 CEST	443	49750	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.231391907 CEST	443	49750	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.231493950 CEST	49750	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.231493950 CEST	49750	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.231512070 CEST	49750	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.231518984 CEST	443	49750	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.233607054 CEST	49754	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.233634949 CEST	443	49754	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.233700037 CEST	49754	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.233807087 CEST	49754	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.233824015 CEST	443	49754	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.234110117 CEST	443	49749	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.234299898 CEST	443	49749	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.234430075 CEST	49749	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.234524965 CEST	49749	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.234524965 CEST	49749	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.234541893 CEST	443	49749	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.234546900 CEST	443	49749	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.236438036 CEST	49755	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.236450911 CEST	443	49755	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.236537933 CEST	49755	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.236650944 CEST	49755	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.236663103 CEST	443	49755	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.948587894 CEST	443	49752	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.950041056 CEST	49752	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.950041056 CEST	49752	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.950061083 CEST	443	49752	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.950076103 CEST	443	49752	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.993315935 CEST	443	49755	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.993421078 CEST	443	49753	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.993470907 CEST	443	49754	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.994220972 CEST	49755	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.994220972 CEST	49755	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.994230986 CEST	443	49755	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.994240046 CEST	443	49755	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.994848967 CEST	49753	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.994862080 CEST	443	49753	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.995055914 CEST	49754	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.995055914 CEST	49754	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.995064974 CEST	49753	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:24.995069027 CEST	443	49753	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.995073080 CEST	443	49754	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:24.995090961 CEST	443	49754	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.084151030 CEST	443	49752	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.084229946 CEST	443	49752	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.084662914 CEST	49752	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.084662914 CEST	49752	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.084692001 CEST	49752	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.084709883 CEST	443	49752	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.087032080 CEST	49756	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.087064981 CEST	443	49756	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.087193966 CEST	49756	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.087335110 CEST	49756	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.087341070 CEST	443	49756	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.130115986 CEST	443	49754	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.130218029 CEST	443	49753	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.130356073 CEST	443	49753	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.130482912 CEST	443	49754	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.130510092 CEST	49753	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.130510092 CEST	49753	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.130528927 CEST	49753	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.130537987 CEST	443	49753	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.130575895 CEST	49754	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.130667925 CEST	49754	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.130667925 CEST	49754	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.130685091 CEST	443	49754	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.130696058 CEST	443	49754	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.131782055 CEST	443	49755	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.131918907 CEST	443	49755	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.132122040 CEST	49755	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.132277966 CEST	49755	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.132282019 CEST	443	49755	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.132386923 CEST	49755	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.132391930 CEST	443	49755	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.133811951 CEST	49757	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.133847952 CEST	443	49757	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.133971930 CEST	49758	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.134011030 CEST	443	49758	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.134085894 CEST	49757	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.134270906 CEST	49758	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.134272099 CEST	49758	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.134278059 CEST	49757	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.134294987 CEST	443	49757	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.134310961 CEST	443	49758	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.134970903 CEST	49759	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.134982109 CEST	443	49759	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.135199070 CEST	49759	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.135199070 CEST	49759	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.135220051 CEST	443	49759	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.427213907 CEST	443	49751	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.427803993 CEST	49751	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.427824974 CEST	443	49751	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.428414106 CEST	49751	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.428423882 CEST	443	49751	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.564598083 CEST	443	49751	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.564757109 CEST	443	49751	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.564966917 CEST	49751	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.564966917 CEST	49751	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.565419912 CEST	49751	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.565460920 CEST	443	49751	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.567626953 CEST	49760	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.567672014 CEST	443	49760	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.567770958 CEST	49760	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.567989111 CEST	49760	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.568006039 CEST	443	49760	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.858537912 CEST	443	49756	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.859030008 CEST	49756	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.859050035 CEST	443	49756	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.859715939 CEST	49756	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.859724045 CEST	443	49756	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.903846979 CEST	443	49758	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.904625893 CEST	49758	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.904645920 CEST	443	49758	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.905278921 CEST	49758	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.905294895 CEST	443	49758	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.917237997 CEST	443	49759	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.917661905 CEST	443	49757	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.917723894 CEST	49759	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.917746067 CEST	443	49759	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.918121099 CEST	49757	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.918121099 CEST	49759	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.918132067 CEST	443	49757	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.918143034 CEST	443	49759	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.918642998 CEST	49757	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.918648958 CEST	443	49757	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.997886896 CEST	443	49756	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.997972965 CEST	443	49756	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.998102903 CEST	49756	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.998256922 CEST	49756	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.998256922 CEST	49756	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:25.998282909 CEST	443	49756	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:25.998291969 CEST	443	49756	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.003387928 CEST	49761	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.003448963 CEST	443	49761	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.003640890 CEST	49761	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.003756046 CEST	49761	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.003770113 CEST	443	49761	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.040571928 CEST	443	49758	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.041903019 CEST	443	49758	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.042009115 CEST	49758	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.042009115 CEST	49758	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.043096066 CEST	49758	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.043127060 CEST	443	49758	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.044603109 CEST	49762	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.044625998 CEST	443	49762	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.044728041 CEST	49762	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.044953108 CEST	49762	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.044959068 CEST	443	49762	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.075184107 CEST	443	49757	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.075411081 CEST	443	49757	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.075545073 CEST	49757	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.075572968 CEST	49757	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.075589895 CEST	443	49757	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.075623035 CEST	49757	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.075630903 CEST	443	49757	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.076188087 CEST	443	49759	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.076255083 CEST	443	49759	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.076479912 CEST	49759	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.076720953 CEST	49759	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.076721907 CEST	49759	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.076730013 CEST	443	49759	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.076740980 CEST	443	49759	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.078699112 CEST	49763	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.078735113 CEST	443	49763	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.078984976 CEST	49763	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.078984976 CEST	49763	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.079044104 CEST	443	49763	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.080189943 CEST	49764	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.080224991 CEST	443	49764	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.080425978 CEST	49764	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.080426931 CEST	49764	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.080462933 CEST	443	49764	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.338006020 CEST	443	49760	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.339088917 CEST	49760	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.339088917 CEST	49760	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.339118958 CEST	443	49760	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.339138985 CEST	443	49760	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.476418972 CEST	443	49760	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.476525068 CEST	443	49760	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.476711988 CEST	49760	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.476711988 CEST	49760	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.478009939 CEST	49760	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.478029966 CEST	443	49760	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.479875088 CEST	49765	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.479927063 CEST	443	49765	13.107.253.51	192.168.2.5
Oct 23, 2024 18:42:26.480099916 CEST	49765	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.480200052 CEST	49765	443	192.168.2.5	13.107.253.51
Oct 23, 2024 18:42:26.480222940 CEST	443	49765	13.107.253.51	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2024 18:42:06.414547920 CEST	53	54257	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:06.423297882 CEST	53	57963	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:07.692766905 CEST	53	56436	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:07.823333979 CEST	64266	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:07.823544979 CEST	57235	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:07.830602884 CEST	53	64266	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:07.831680059 CEST	53	57235	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:07.846664906 CEST	61751	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:07.857249022 CEST	53	61751	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:07.941685915 CEST	56377	53	192.168.2.5	8.8.8.8
Oct 23, 2024 18:42:07.942218065 CEST	53993	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:07.950287104 CEST	53	56377	8.8.8.8	192.168.2.5
Oct 23, 2024 18:42:07.950488091 CEST	53	53993	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:08.944452047 CEST	60254	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:08.944669008 CEST	61476	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:08.951711893 CEST	53	60254	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:08.952090979 CEST	53	61476	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:08.953872919 CEST	60504	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:08.954121113 CEST	59228	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:08.961405039 CEST	53	59228	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:08.961590052 CEST	53	60504	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:09.680433035 CEST	61958	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:09.680535078 CEST	63858	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:09.687732935 CEST	53	63858	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:09.688013077 CEST	53	61958	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:13.315407991 CEST	49226	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:13.315593004 CEST	62311	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:13.322973967 CEST	53	62311	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:13.323386908 CEST	53	49226	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:13.324501038 CEST	60280	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:13.333345890 CEST	53	60280	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:13.364547014 CEST	52810	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:13.364828110 CEST	55745	53	192.168.2.5	8.8.8.8
Oct 23, 2024 18:42:13.372114897 CEST	53	52810	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:13.372172117 CEST	53	55745	8.8.8.8	192.168.2.5
Oct 23, 2024 18:42:18.767699003 CEST	64941	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:18.768026114 CEST	51677	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:18.775154114 CEST	53	64941	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:18.776122093 CEST	53	51677	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:18.808871031 CEST	56454	53	192.168.2.5	1.1.1.1
Oct 23, 2024 18:42:18.816277027 CEST	53	56454	1.1.1.1	192.168.2.5
Oct 23, 2024 18:42:24.585333109 CEST	53	61633	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 23, 2024 18:42:07.823333979 CEST	192.168.2.5	1.1.1.1	0x1c5e	Standard query (0)	sync.search.spotxchange.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:07.823544979 CEST	192.168.2.5	1.1.1.1	0xba18	Standard query (0)	sync.search.spotxchange.com	65	IN (0x0001)	false
Oct 23, 2024 18:42:07.846664906 CEST	192.168.2.5	1.1.1.1	0x2a32	Standard query (0)	sync.search.spotxchange.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:07.941685915 CEST	192.168.2.5	8.8.8.8	0x3d0	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:07.942218065 CEST	192.168.2.5	1.1.1.1	0xbdac	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:08.944452047 CEST	192.168.2.5	1.1.1.1	0x6586	Standard query (0)	sync.search.spotxchange.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:08.944669008 CEST	192.168.2.5	1.1.1.1	0x4a4b	Standard query (0)	sync.search.spotxchange.com	65	IN (0x0001)	false
Oct 23, 2024 18:42:08.953872919 CEST	192.168.2.5	1.1.1.1	0x2143	Standard query (0)	sync.search.spotxchange.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:08.954121113 CEST	192.168.2.5	1.1.1.1	0x2c32	Standard query (0)	sync.search.spotxchange.com	65	IN (0x0001)	false
Oct 23, 2024 18:42:09.680433035 CEST	192.168.2.5	1.1.1.1	0xa11d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:09.680535078 CEST	192.168.2.5	1.1.1.1	0xc4b1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 23, 2024 18:42:13.315407991 CEST	192.168.2.5	1.1.1.1	0xf69e	Standard query (0)	sync.search.spotxchange.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:13.315593004 CEST	192.168.2.5	1.1.1.1	0x6d7d	Standard query (0)	sync.search.spotxchange.com	65	IN (0x0001)	false
Oct 23, 2024 18:42:13.324501038 CEST	192.168.2.5	1.1.1.1	0xfd11	Standard query (0)	sync.search.spotxchange.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:13.364547014 CEST	192.168.2.5	1.1.1.1	0x8a63	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:13.364828110 CEST	192.168.2.5	8.8.8.8	0xd953	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:18.767699003 CEST	192.168.2.5	1.1.1.1	0xf974	Standard query (0)	sync.search.spotxchange.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:18.768026114 CEST	192.168.2.5	1.1.1.1	0x80f1	Standard query (0)	sync.search.spotxchange.com	65	IN (0x0001)	false
Oct 23, 2024 18:42:18.808871031 CEST	192.168.2.5	1.1.1.1	0xb512	Standard query (0)	sync.search.spotxchange.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 23, 2024 18:42:07.830602884 CEST	1.1.1.1	192.168.2.5	0x1c5e	Name error (3)	sync.search.spotxchange.com	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:07.831680059 CEST	1.1.1.1	192.168.2.5	0xba18	Name error (3)	sync.search.spotxchange.com	none	none	65	IN (0x0001)	false
Oct 23, 2024 18:42:07.857249022 CEST	1.1.1.1	192.168.2.5	0x2a32	Name error (3)	sync.search.spotxchange.com	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:07.950287104 CEST	8.8.8.8	192.168.2.5	0x3d0	No error (0)	google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:07.950488091 CEST	1.1.1.1	192.168.2.5	0xbdac	No error (0)	google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:08.951711893 CEST	1.1.1.1	192.168.2.5	0x6586	Name error (3)	sync.search.spotxchange.com	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:08.952090979 CEST	1.1.1.1	192.168.2.5	0x4a4b	Name error (3)	sync.search.spotxchange.com	none	none	65	IN (0x0001)	false
Oct 23, 2024 18:42:08.961405039 CEST	1.1.1.1	192.168.2.5	0x2c32	Name error (3)	sync.search.spotxchange.com	none	none	65	IN (0x0001)	false
Oct 23, 2024 18:42:08.961590052 CEST	1.1.1.1	192.168.2.5	0x2143	Name error (3)	sync.search.spotxchange.com	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:09.687732935 CEST	1.1.1.1	192.168.2.5	0xc4b1	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 23, 2024 18:42:09.688013077 CEST	1.1.1.1	192.168.2.5	0xa11d	No error (0)	www.google.com		216.58.212.132	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:13.322973967 CEST	1.1.1.1	192.168.2.5	0x6d7d	Name error (3)	sync.search.spotxchange.com	none	none	65	IN (0x0001)	false
Oct 23, 2024 18:42:13.323386908 CEST	1.1.1.1	192.168.2.5	0xf69e	Name error (3)	sync.search.spotxchange.com	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:13.333345890 CEST	1.1.1.1	192.168.2.5	0xfd11	Name error (3)	sync.search.spotxchange.com	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:13.372114897 CEST	1.1.1.1	192.168.2.5	0x8a63	No error (0)	google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:13.372172117 CEST	8.8.8.8	192.168.2.5	0xd953	No error (0)	google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:16.699081898 CEST	1.1.1.1	192.168.2.5	0xf703	No error (0)	shed.dual-low.s-part-0023.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 18:42:16.699081898 CEST	1.1.1.1	192.168.2.5	0xf703	No error (0)	dual.s-part-0023.t-0009.fb-t-msedge.net	s-part-0023.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 18:42:16.699081898 CEST	1.1.1.1	192.168.2.5	0xf703	No error (0)	s-part-0023.t-0009.fb-t-msedge.net		13.107.253.51	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:18.712645054 CEST	1.1.1.1	192.168.2.5	0xd04d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:18.712645054 CEST	1.1.1.1	192.168.2.5	0xd04d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:18.775154114 CEST	1.1.1.1	192.168.2.5	0xf974	Name error (3)	sync.search.spotxchange.com	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:18.776122093 CEST	1.1.1.1	192.168.2.5	0x80f1	Name error (3)	sync.search.spotxchange.com	none	none	65	IN (0x0001)	false
Oct 23, 2024 18:42:18.816277027 CEST	1.1.1.1	192.168.2.5	0xb512	Name error (3)	sync.search.spotxchange.com	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 18:42:19.702809095 CEST	1.1.1.1	192.168.2.5	0x8a26	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 18:42:19.702809095 CEST	1.1.1.1	192.168.2.5	0x8a26	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

otelrules.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:12 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-23 16:42:12 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=86640 Date: Wed, 23 Oct 2024 16:42:12 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:13 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-23 16:42:13 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=86608 Date: Wed, 23 Oct 2024 16:42:13 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-23 16:42:13 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49714	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:17 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:17 UTC	540	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:17 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 21 Oct 2024 13:21:21 GMT ETag: "0x8DCF1D34132B902" x-ms-request-id: 84bcd95b-b01e-001e-1a38-240214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164217Z-r1755647c66nfj7t97c2qyh6zg00000005cg000000004895 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:17 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-23 16:42:17 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-23 16:42:17 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-23 16:42:18 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-23 16:42:18 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-23 16:42:18 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-23 16:42:18 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-23 16:42:18 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-23 16:42:18 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-23 16:42:18 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49720	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:19 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:19 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:19 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 3b262095-501e-0035-475d-23c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164219Z-17fbfdc98bb9dlh7es9mrdw2qc0000000610000000000e79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:19 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49717	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:19 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:19 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 52fc638d-b01e-0070-36c5-201cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164219Z-r1755647c66fnxpdavnqahfp1w00000006n000000000cydr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:19 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49718	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:19 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:19 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:19 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 509f9858-c01e-00a2-4459-232327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164219Z-17fbfdc98bbndwgn5b4pg7s8bs00000005xg0000000092np x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:19 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49716	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:19 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:19 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:19 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: b8a73167-901e-0015-0f59-23b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164219Z-17fbfdc98bbx4f4q0941cebmvs00000005x0000000009928 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:19 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49719	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:19 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:19 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 31a53d7e-801e-00a3-74f7-217cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164219Z-17fbfdc98bb6j78ntkx6e2fx4c00000005z00000000076ux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:19 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49722	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:20 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:20 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: e3ea90ed-d01e-0028-6059-237896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164220Z-17fbfdc98bb9tt772yde9rhbm80000000640000000001dru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:20 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49723	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:20 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 5322e1a1-701e-0053-4f92-1f3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164220Z-r1755647c66sn7s9kfw6gzvyp000000008f0000000009fwn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49724	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:20 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: a0191c6f-501e-0047-3c5d-23ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164220Z-17fbfdc98bb7k7m5sdc8baghes000000065g000000002cwd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49726	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:20 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:20 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: fbb8ce34-501e-0064-0cbd-201f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164220Z-r1755647c66mgrw7zd8m1pn55000000006xg00000000b58z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:20 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49728	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:20 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:20 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ad393351-301e-0099-6d59-236683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164220Z-17fbfdc98bbvwcxrk0yzwg4d5800000005zg00000000c4na x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:20 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49731	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:21 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 8659e35a-201e-005d-7d92-1fafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164221Z-r1755647c66xn9fj09y3bhxnh4000000097g00000000a70t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49732	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:21 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: a48fb397-901e-008f-6356-2367a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164221Z-17fbfdc98bbwfg2nvhsr4h37pn0000000670000000000azb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49734	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:21 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 68d87b8f-401e-0064-59c9-2054af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164221Z-r1755647c66ldfgxa3qp9d53us00000008mg000000001cgf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49733	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:21 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 7de7ed35-901e-005b-7c14-222005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164221Z-r1755647c66xn9fj09y3bhxnh40000000980000000008z9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49730	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:21 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: bac56044-101e-0079-505d-235913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164221Z-17fbfdc98bb9dlh7es9mrdw2qc0000000600000000001zyz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49736	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:22 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:22 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: bb9292ef-d01e-00ad-5d35-21e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164222Z-r1755647c66k9st9tvd58z9dg800000008gg000000006nuk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:22 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49737	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:22 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3edebaab-e01e-0033-21c8-214695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164222Z-r1755647c66wjht63r8k9qqnrs0000000730000000001aqn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49738	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:22 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 0b49af96-c01e-0079-7092-1fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164222Z-r1755647c66kmfl29f2su56tc400000009cg000000000wna x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49739	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:22 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:22 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: b1dca041-701e-0001-1ae2-20b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164222Z-r1755647c66ldfgxa3qp9d53us00000008d000000000dgf6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:22 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49741	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:22 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:22 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 1c1a6b29-f01e-0096-0e50-2310ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164222Z-r1755647c66l72xfkr6ug378ks000000078g00000000d33p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:22 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49743	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:23 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:23 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: bb725c57-501e-005b-0eab-21d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164223Z-r1755647c66zs9x4962sbyaz1w00000006p0000000009htr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:23 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49744	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:23 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 5e2b87c7-c01e-000b-17f5-20e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164223Z-r1755647c66sxs9zhy17bg185w00000009a0000000004ryn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49742	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:23 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 93d9d0c2-201e-0085-2492-1f34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164223Z-r1755647c66kmfl29f2su56tc4000000095g00000000chs5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49745	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:23 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 6949b098-b01e-0084-1a35-21d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164223Z-r1755647c66kv68zfmyfrbcqzg00000006yg000000009p2k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49746	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:23 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:23 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 8a7344d1-601e-0084-805a-236b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164223Z-r1755647c66sxs9zhy17bg185w00000009ag000000003nhw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:23 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49748	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:24 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: ba25aa5e-401e-0015-7950-230e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164224Z-17fbfdc98bbrx2rj4asdpg8sbs00000002300000000013xf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49747	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:24 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:24 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 6ff76e76-001e-002b-21c5-2099f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164224Z-17fbfdc98bblvnlh5w88rcarag00000006700000000039a7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:24 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49750	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:24 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 346ac1b5-f01e-003f-6ed5-20d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164224Z-r1755647c66j878m0wkraqty38000000071g000000003fv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49749	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:24 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 84bc9d3e-101e-007a-0792-1f047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164224Z-r1755647c66vrwbmeqw88hpesn00000008a0000000002ke5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49752	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:24 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:24 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 9e0e1983-701e-003e-2856-2379b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164224Z-r1755647c66n5bjpba5s4mu9d000000008n0000000000urm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:25 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49755	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:24 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 319a90d3-d01e-0066-4138-21ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164225Z-r1755647c66kv68zfmyfrbcqzg00000006yg000000009p3b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-23 16:42:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49753	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:24 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 5fe4afb9-d01e-008e-4659-23387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164225Z-17fbfdc98bbg2mc9qrpn009kgs000000062000000000anqe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49754	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:24 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 46af3d48-701e-0032-6627-21a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164225Z-r1755647c66kmfl29f2su56tc4000000096g00000000aue8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49751	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:25 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 265f42d2-801e-0047-38c8-207265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164225Z-r1755647c66x46wg1q56tyyk6800000007sg000000006vx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49756	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:25 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:25 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: ee1aea59-301e-0052-0750-2365d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164225Z-17fbfdc98bb9dlh7es9mrdw2qc000000060g00000000100a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:25 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49758	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:25 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e337ee23-e01e-003c-1ecf-20c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164225Z-r1755647c66k9st9tvd58z9dg800000008dg00000000cadb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:26 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49759	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:25 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: d9d4df84-d01e-00ad-0964-23e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164225Z-17fbfdc98bbqc8zsbguzmabx680000000600000000002ze0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49757	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:25 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:25 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: ad3e5457-301e-0099-155a-236683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164225Z-17fbfdc98bbnpjstwqrbe0re7n000000060g000000005z91 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:26 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49760	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:26 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:26 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 5d0ca943-801e-0067-2ecf-20fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164226Z-r1755647c66kmfl29f2su56tc400000009c0000000000w3u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:26 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49761	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:26 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:26 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 0c1e413e-701e-0021-5e50-233d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164226Z-17fbfdc98bb7qlzm4x52d2225c0000000650000000000a4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:26 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49762	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:26 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:26 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 3589f4cc-c01e-0079-731b-24e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164226Z-r1755647c66zkj29xnfn2r3bwn00000005q000000000478c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:26 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49764	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:26 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:26 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0c1e418e-701e-0021-2a50-233d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164226Z-17fbfdc98bblptj7fr9s141cpc000000060g0000000080d4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:26 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49763	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:26 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:26 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 1bb7fc0c-c01e-0046-7759-232db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164226Z-17fbfdc98bbgqz661ufkm7k13c00000005xg000000009fqg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:26 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49765	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:27 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:27 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 68ab0001-401e-0064-04b8-2054af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164227Z-r1755647c66dj7986akr8tvaw400000007pg00000000bxf3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:27 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49766	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:27 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: b92258e0-a01e-00ab-2aab-219106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164227Z-r1755647c66fnxpdavnqahfp1w00000006v000000000007q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:27 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49767	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:27 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:27 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: f651688a-e01e-0071-5b56-2308e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164227Z-17fbfdc98bb6q7cv86r4xdspkg000000060000000000c108 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:27 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49768	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:27 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0688ef78-901e-0029-5550-23274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164227Z-17fbfdc98bbcrtjhdvnfuyp2880000000680000000001wsr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49769	13.107.253.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 16:42:27 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-23 16:42:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 16:42:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 629c9caa-001e-0079-2150-2312e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241023T164227Z-17fbfdc98bbnpjstwqrbe0re7n000000062g000000002382 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-23 16:42:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 1400, Parent PID: 5768

General

Target ID:	0
Start time:	12:42:01
Start date:	23/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 1472, Parent PID: 1400

General

Target ID:	2
Start time:	12:42:03
Start date:	23/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2352,i,10113120810550939655,13818382508830664056,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 4768, Parent PID: 5768

General

Target ID:	3
Start time:	12:42:06
Start date:	23/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://sync.search.spotxchange.com"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://sync.search.spotxchange.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 1400, Parent PID: 5768

General

Chronological Activities

Analysis Process: chrome.exePID: 1472, Parent PID: 1400

General

Chronological Activities

Analysis Process: chrome.exePID: 4768, Parent PID: 5768

General

Chronological Activities

Disassembly

Windows Analysis Report
https://sync.search.spotxchange.com