Edit tour

Windows Analysis Report
http://127.0.0.1/

Overview

General Information

Sample URL:	http://127.0.0.1/
Analysis ID:	1562205
Infos:

Errors URL not reachable

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected suspicious URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6120 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2200,i,983471930472294540,10932090612570421008,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://127.0.0.1/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious URL

Source: Email

Joe Sandbox AI: AI detected IP in URL: http://127.0.0.1

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49787 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.4
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2pFB64Gy7Hd6F54&MD=3ysS4L65 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic

DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49787 version: TLS 1.2

Source: classification engine

Classification label: sus20.win@19/0@2/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2200,i,983471930472294540,10932090612570421008,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://127.0.0.1/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2200,i,983471930472294540,10932090612570421008,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://127.0.0.1/	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
www.google.com	142.250.181.100	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved		unknown	unknown	false
142.250.181.100	www.google.com	United States		15169	GOOGLEUS	false

Private

IP
127.0.0.1
192.168.2.6

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562205
Start date and time:	2024-11-25 10:48:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://127.0.0.1/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus20.win@19/0@2/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	URL browsing timeout or error

Errors

URL not reachable

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.19.238, 74.125.205.84, 34.104.35.123, 192.229.221.95, 199.232.214.172
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, wu-b-net.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://127.0.0.1/

Simulations

Behavior and APIs

⊘No simulations

Input	Output
URL: http://127.0.0.1 Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": true, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: http://127.0.0.1

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 10:49:34.946553946 CET	443	49710	20.190.147.4	192.168.2.6
Nov 25, 2024 10:49:34.946744919 CET	49710	443	192.168.2.6	20.190.147.4
Nov 25, 2024 10:49:34.947338104 CET	49712	443	192.168.2.6	20.198.119.84
Nov 25, 2024 10:49:34.947387934 CET	443	49712	20.198.119.84	192.168.2.6
Nov 25, 2024 10:49:34.947464943 CET	49712	443	192.168.2.6	20.198.119.84
Nov 25, 2024 10:49:34.948103905 CET	49712	443	192.168.2.6	20.198.119.84
Nov 25, 2024 10:49:34.948120117 CET	443	49712	20.198.119.84	192.168.2.6
Nov 25, 2024 10:49:34.991781950 CET	443	49711	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:34.993107080 CET	49711	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:34.993165016 CET	49711	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:34.993300915 CET	49711	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:35.112729073 CET	443	49711	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:35.112742901 CET	443	49711	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:35.112754107 CET	443	49711	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:35.546158075 CET	443	49711	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:35.596793890 CET	49711	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:35.747409105 CET	443	49711	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:35.799818993 CET	49711	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:35.948717117 CET	443	49711	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:35.949825048 CET	49711	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:36.069680929 CET	443	49711	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:36.503343105 CET	443	49711	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:36.550127029 CET	49711	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:37.460122108 CET	443	49712	20.198.119.84	192.168.2.6
Nov 25, 2024 10:49:37.460222960 CET	49712	443	192.168.2.6	20.198.119.84
Nov 25, 2024 10:49:37.466598988 CET	49712	443	192.168.2.6	20.198.119.84
Nov 25, 2024 10:49:37.466612101 CET	443	49712	20.198.119.84	192.168.2.6
Nov 25, 2024 10:49:37.467044115 CET	443	49712	20.198.119.84	192.168.2.6
Nov 25, 2024 10:49:37.469037056 CET	49712	443	192.168.2.6	20.198.119.84
Nov 25, 2024 10:49:37.469106913 CET	49712	443	192.168.2.6	20.198.119.84
Nov 25, 2024 10:49:37.469116926 CET	443	49712	20.198.119.84	192.168.2.6
Nov 25, 2024 10:49:37.469286919 CET	49712	443	192.168.2.6	20.198.119.84
Nov 25, 2024 10:49:37.511328936 CET	443	49712	20.198.119.84	192.168.2.6
Nov 25, 2024 10:49:37.916549921 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:37.916596889 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:37.916678905 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:37.916964054 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:37.916981936 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:38.146622896 CET	443	49712	20.198.119.84	192.168.2.6
Nov 25, 2024 10:49:38.147758961 CET	49712	443	192.168.2.6	20.198.119.84
Nov 25, 2024 10:49:38.147795916 CET	443	49712	20.198.119.84	192.168.2.6
Nov 25, 2024 10:49:38.147819042 CET	49712	443	192.168.2.6	20.198.119.84
Nov 25, 2024 10:49:38.147845984 CET	49712	443	192.168.2.6	20.198.119.84
Nov 25, 2024 10:49:38.596690893 CET	49673	443	192.168.2.6	173.222.162.64
Nov 25, 2024 10:49:38.596714973 CET	49674	443	192.168.2.6	173.222.162.64
Nov 25, 2024 10:49:38.924841881 CET	49672	443	192.168.2.6	173.222.162.64
Nov 25, 2024 10:49:39.703207016 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:39.703289986 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:39.710802078 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:39.710833073 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:39.711065054 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:39.752931118 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:39.764142036 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:39.811332941 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.188124895 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.188144922 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.188155890 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.188210964 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.188252926 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.188342094 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.188342094 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.188379049 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.188467026 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.371740103 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.371810913 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.371907949 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.371923923 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.371963978 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.371963978 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.422853947 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.422924042 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.423008919 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.423023939 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.423065901 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.423100948 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.560091972 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.560127974 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.560271978 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.560286045 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.560403109 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.592073917 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.592107058 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.592236996 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.592261076 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.592303038 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.592328072 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.613605022 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.613636971 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.613704920 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.613729954 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.613755941 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.613774061 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.633647919 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.633677006 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.633760929 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.633768082 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.633810997 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.750744104 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.750777960 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.750884056 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.750895023 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.750938892 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.767098904 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.767124891 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.767206907 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.767215967 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.767271042 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.782433987 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.782459021 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.782517910 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.782524109 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.782552004 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.782567024 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.797972918 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.797997952 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.798281908 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.798286915 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.798331022 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.812365055 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.812396049 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.812485933 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.812491894 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.812531948 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.825742006 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.825766087 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.825828075 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.825834036 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.825875998 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.832317114 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.832385063 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.832391024 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.832406998 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.832438946 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.832470894 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.901434898 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.901727915 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.903331995 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.903346062 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:40.903357029 CET	49713	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:40.903362036 CET	443	49713	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:41.126888990 CET	49714	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.126945019 CET	443	49714	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:41.127012968 CET	49714	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.137494087 CET	49715	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.137542009 CET	443	49715	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:41.137592077 CET	49715	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.137943983 CET	49716	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.137985945 CET	443	49716	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:41.138055086 CET	49716	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.141391039 CET	49717	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.141453981 CET	443	49717	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:41.141506910 CET	49717	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.142508984 CET	49718	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.142520905 CET	443	49718	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:41.142568111 CET	49718	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.151032925 CET	49718	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.151046991 CET	443	49718	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:41.151259899 CET	49717	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.151299953 CET	443	49717	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:41.151354074 CET	49716	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.151362896 CET	443	49716	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:41.151431084 CET	49714	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.151446104 CET	443	49714	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:41.151531935 CET	49715	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:41.151545048 CET	443	49715	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:42.878828049 CET	443	49717	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:42.879538059 CET	49717	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:42.879585981 CET	443	49717	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:42.880160093 CET	49717	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:42.880170107 CET	443	49717	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:42.936680079 CET	443	49714	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:42.938611031 CET	443	49718	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:42.992810011 CET	49714	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:42.992832899 CET	443	49714	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:42.993640900 CET	49714	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:42.993647099 CET	443	49714	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:42.994400978 CET	49718	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:42.994424105 CET	443	49718	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:42.994978905 CET	49718	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:42.994986057 CET	443	49718	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.000690937 CET	443	49716	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.001143932 CET	49716	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.001166105 CET	443	49716	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.002073050 CET	49716	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.002079010 CET	443	49716	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.003103018 CET	443	49715	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.003655910 CET	49715	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.003684998 CET	443	49715	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.004369020 CET	49715	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.004380941 CET	443	49715	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.316710949 CET	443	49717	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.316745043 CET	443	49717	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.316809893 CET	49717	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.316833019 CET	443	49717	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.317440033 CET	443	49717	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.317492008 CET	49717	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.382905960 CET	443	49718	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.382975101 CET	443	49718	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.383032084 CET	49718	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.383925915 CET	443	49714	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.383949041 CET	443	49714	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.383990049 CET	49714	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.384002924 CET	443	49714	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.384042025 CET	49714	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.390014887 CET	443	49714	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.390063047 CET	443	49714	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.390125990 CET	49714	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.454828978 CET	443	49715	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.455063105 CET	443	49715	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.455128908 CET	49715	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.457912922 CET	443	49716	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.457936049 CET	443	49716	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.457989931 CET	49716	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.458008051 CET	443	49716	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.458050966 CET	49716	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.461440086 CET	443	49716	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.461487055 CET	443	49716	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.461525917 CET	49716	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.628909111 CET	49717	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.628956079 CET	443	49717	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.628981113 CET	49717	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.628989935 CET	443	49717	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.630091906 CET	49714	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.630115986 CET	443	49714	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.630127907 CET	49714	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.630135059 CET	443	49714	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.632227898 CET	49715	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.632253885 CET	443	49715	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.632267952 CET	49715	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.632275105 CET	443	49715	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.632658005 CET	49716	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.632658005 CET	49716	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.632677078 CET	443	49716	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.632685900 CET	443	49716	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.633727074 CET	49718	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.633727074 CET	49718	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.633733988 CET	443	49718	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.633740902 CET	443	49718	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.789566040 CET	49719	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.789618969 CET	443	49719	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.789691925 CET	49719	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.816977978 CET	49719	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.816998005 CET	443	49719	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.822179079 CET	49720	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.822231054 CET	443	49720	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.822290897 CET	49720	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.822483063 CET	49720	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.822498083 CET	443	49720	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.824311972 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.824342966 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.824398994 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.825196981 CET	49722	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.825210094 CET	443	49722	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.825258017 CET	49722	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.825438023 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.825453043 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.826170921 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.826179981 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.826229095 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.826385975 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.826395035 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:43.826452971 CET	49722	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:43.826459885 CET	443	49722	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.537391901 CET	443	49719	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.538096905 CET	49719	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.538157940 CET	443	49719	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.538722992 CET	49719	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.538737059 CET	443	49719	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.565778971 CET	443	49720	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.566164017 CET	49720	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.566188097 CET	443	49720	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.567035913 CET	49720	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.567042112 CET	443	49720	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.606697083 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.607194901 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.607224941 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.607642889 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.607656956 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.609082937 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.609477043 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.609505892 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.609858990 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.609869957 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.679354906 CET	443	49722	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.679853916 CET	49722	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.679872990 CET	443	49722	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.680284977 CET	49722	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.680293083 CET	443	49722	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.974287033 CET	443	49719	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.974476099 CET	443	49719	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.974524975 CET	49719	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.974709034 CET	49719	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.974730968 CET	443	49719	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.979562998 CET	49729	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.979614019 CET	443	49729	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.979684114 CET	49729	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.979870081 CET	49729	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.979878902 CET	443	49729	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.998419046 CET	443	49720	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.998491049 CET	443	49720	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.998564005 CET	49720	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.998836994 CET	49720	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.998886108 CET	443	49720	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:45.998915911 CET	49720	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:45.998931885 CET	443	49720	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.002008915 CET	49730	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.002053976 CET	443	49730	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.002115011 CET	49730	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.002638102 CET	49730	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.002651930 CET	443	49730	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.051569939 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.051636934 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.051697969 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.059163094 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.059226990 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.059288025 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.074309111 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.074331999 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.074345112 CET	49721	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.074350119 CET	443	49721	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.078489065 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.078493118 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.078510046 CET	49723	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.078514099 CET	443	49723	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.085011005 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.085058928 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.085124969 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.086476088 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.086518049 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.086580992 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.086690903 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.086703062 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.086869001 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.086885929 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.132261992 CET	443	49722	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.132332087 CET	443	49722	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.132374048 CET	49722	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.132746935 CET	49722	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.132759094 CET	443	49722	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.132774115 CET	49722	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.132778883 CET	443	49722	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.136596918 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.136620045 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:46.136677027 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.136853933 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:46.136862040 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.717751026 CET	443	49730	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.763281107 CET	49730	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:47.801464081 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.843389034 CET	49730	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:47.843405962 CET	443	49730	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.843718052 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:47.843732119 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.843873024 CET	49730	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:47.843880892 CET	443	49730	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.844264984 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:47.844269991 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.853404999 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.853821993 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:47.853842974 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.854250908 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:47.854255915 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.868731022 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.869232893 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:47.869261980 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.869775057 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:47.869780064 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.884222984 CET	443	49729	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.884695053 CET	49729	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:47.884733915 CET	443	49729	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:47.885154009 CET	49729	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:47.885163069 CET	443	49729	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.005124092 CET	49739	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:48.005165100 CET	443	49739	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:48.005270004 CET	49739	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:48.006042004 CET	49739	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:48.006059885 CET	443	49739	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:48.159392118 CET	443	49730	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.159466028 CET	443	49730	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.159617901 CET	49730	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.162231922 CET	49730	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.162231922 CET	49730	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.162250042 CET	443	49730	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.162261963 CET	443	49730	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.168771029 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.168795109 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.168848991 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.171744108 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.171757936 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.199032068 CET	49741	443	192.168.2.6	142.250.181.100
Nov 25, 2024 10:49:48.199067116 CET	443	49741	142.250.181.100	192.168.2.6
Nov 25, 2024 10:49:48.199234009 CET	49741	443	192.168.2.6	142.250.181.100
Nov 25, 2024 10:49:48.199613094 CET	49674	443	192.168.2.6	173.222.162.64
Nov 25, 2024 10:49:48.199641943 CET	49673	443	192.168.2.6	173.222.162.64
Nov 25, 2024 10:49:48.200449944 CET	49741	443	192.168.2.6	142.250.181.100
Nov 25, 2024 10:49:48.200468063 CET	443	49741	142.250.181.100	192.168.2.6
Nov 25, 2024 10:49:48.238811016 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.238878965 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.238960981 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.239180088 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.239190102 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.239202023 CET	49734	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.239207029 CET	443	49734	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.242969036 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.242984056 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.243068933 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.243623018 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.243637085 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.289664030 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.289730072 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.289891958 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.289963007 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.289974928 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.289988041 CET	49735	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.289993048 CET	443	49735	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.292687893 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.292723894 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.292886019 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.293207884 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.293229103 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.314304113 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.314388037 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.314446926 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.314508915 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.314522028 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.314532042 CET	49733	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.314537048 CET	443	49733	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.317037106 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.317080021 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.317318916 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.317511082 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.317522049 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.339930058 CET	443	49729	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.339987993 CET	443	49729	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.340230942 CET	49729	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.340296984 CET	49729	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.340320110 CET	443	49729	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.340334892 CET	49729	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.340342999 CET	443	49729	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.342606068 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.342700005 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.342997074 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.343175888 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:48.343225002 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:48.534131050 CET	49672	443	192.168.2.6	173.222.162.64
Nov 25, 2024 10:49:49.840643883 CET	49749	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:49.840684891 CET	443	49749	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:49.840835094 CET	49749	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:49.842762947 CET	49749	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:49.842782021 CET	443	49749	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:49.942276955 CET	443	49741	142.250.181.100	192.168.2.6
Nov 25, 2024 10:49:49.942643881 CET	49741	443	192.168.2.6	142.250.181.100
Nov 25, 2024 10:49:49.942656994 CET	443	49741	142.250.181.100	192.168.2.6
Nov 25, 2024 10:49:49.943722010 CET	443	49741	142.250.181.100	192.168.2.6
Nov 25, 2024 10:49:49.943800926 CET	49741	443	192.168.2.6	142.250.181.100
Nov 25, 2024 10:49:49.945821047 CET	49741	443	192.168.2.6	142.250.181.100
Nov 25, 2024 10:49:49.945893049 CET	443	49741	142.250.181.100	192.168.2.6
Nov 25, 2024 10:49:49.950372934 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:49.951050043 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:49.951070070 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:49.951802015 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:49.951807976 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:49.987399101 CET	49741	443	192.168.2.6	142.250.181.100
Nov 25, 2024 10:49:49.987417936 CET	443	49741	142.250.181.100	192.168.2.6
Nov 25, 2024 10:49:50.029048920 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.029587030 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.029643059 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.030257940 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.030272007 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.033221960 CET	49741	443	192.168.2.6	142.250.181.100
Nov 25, 2024 10:49:50.081159115 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.114635944 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.114659071 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.115417957 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.115422010 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.126661062 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.154665947 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.154750109 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.155275106 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.155289888 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.162421942 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.184855938 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.184878111 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.185476065 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.185481071 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.271364927 CET	443	49739	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:50.271457911 CET	49739	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:50.322513103 CET	49739	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:50.322550058 CET	443	49739	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:50.322964907 CET	443	49739	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:50.325449944 CET	49739	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:50.325592041 CET	49739	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:50.325599909 CET	443	49739	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:50.325723886 CET	49739	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:50.371335030 CET	443	49739	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:50.393294096 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.393374920 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.393501043 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.393682003 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.393707991 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.393722057 CET	49740	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.393739939 CET	443	49740	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.396442890 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.396497011 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.396648884 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.396845102 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.396857977 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.471916914 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.472007990 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.472074032 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.472244978 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.472244978 CET	49742	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.472270966 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.472285032 CET	443	49742	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.475155115 CET	49751	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.475197077 CET	443	49751	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.475263119 CET	49751	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.475424051 CET	49751	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.475440025 CET	443	49751	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.524823904 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.524981022 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.525038004 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.525131941 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.525131941 CET	49743	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.525152922 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.525171995 CET	443	49743	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.528048992 CET	49752	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.528119087 CET	443	49752	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.528403997 CET	49752	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.528580904 CET	49752	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.528600931 CET	443	49752	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.569133997 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.569322109 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.569392920 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.569647074 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.569690943 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.569721937 CET	49745	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.569756031 CET	443	49745	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.573832035 CET	49753	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.573878050 CET	443	49753	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.574146986 CET	49753	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.574497938 CET	49753	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.574520111 CET	443	49753	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.615304947 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.615392923 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.615566969 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.616116047 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.616134882 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.616183043 CET	49744	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.616189957 CET	443	49744	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.619218111 CET	49754	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.619261026 CET	443	49754	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.619405985 CET	49754	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.619683027 CET	49754	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:50.619700909 CET	443	49754	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:50.964864969 CET	443	49708	173.222.162.64	192.168.2.6
Nov 25, 2024 10:49:50.964961052 CET	49708	443	192.168.2.6	173.222.162.64
Nov 25, 2024 10:49:50.995567083 CET	443	49739	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:50.995661974 CET	443	49739	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:50.995743990 CET	49739	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:50.995882034 CET	49739	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:49:50.995908976 CET	443	49739	20.198.119.143	192.168.2.6
Nov 25, 2024 10:49:51.224359989 CET	443	49749	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:51.224443913 CET	49749	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:51.228758097 CET	49749	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:51.228785038 CET	443	49749	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:51.229116917 CET	443	49749	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:51.272099972 CET	49749	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:51.319327116 CET	443	49749	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:51.745901108 CET	443	49749	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:51.745980024 CET	443	49749	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:51.746104002 CET	49749	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:51.746172905 CET	49749	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:51.746196985 CET	443	49749	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:51.746213913 CET	49749	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:51.746221066 CET	443	49749	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:51.786860943 CET	49755	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:51.786895037 CET	443	49755	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:51.787050009 CET	49755	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:51.787398100 CET	49755	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:51.787405968 CET	443	49755	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:52.179728985 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.180260897 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.180280924 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.180695057 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.180701017 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.294909954 CET	443	49753	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.295403004 CET	49753	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.295438051 CET	443	49753	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.295856953 CET	49753	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.295862913 CET	443	49753	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.306715965 CET	443	49752	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.307121038 CET	49752	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.307157993 CET	443	49752	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.307547092 CET	49752	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.307554960 CET	443	49752	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.323448896 CET	443	49751	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.323847055 CET	49751	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.323873997 CET	443	49751	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.324270010 CET	49751	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.324278116 CET	443	49751	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.463284969 CET	443	49754	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.463753939 CET	49754	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.463808060 CET	443	49754	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.464524984 CET	49754	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.464534998 CET	443	49754	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.625984907 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.626174927 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.626333952 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.626532078 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.626532078 CET	49750	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.626554012 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.626564026 CET	443	49750	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.699528933 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.699584007 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.699665070 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.699942112 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.699956894 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.727713108 CET	443	49753	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.727787971 CET	443	49753	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.727880001 CET	49753	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.728369951 CET	49753	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.728394985 CET	443	49753	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.728408098 CET	49753	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.728414059 CET	443	49753	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.750725985 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.750768900 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.750863075 CET	443	49752	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.750876904 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.750931025 CET	443	49752	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.751029968 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.751059055 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.751066923 CET	49752	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.751161098 CET	49752	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.751209021 CET	443	49752	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.751241922 CET	49752	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.751256943 CET	443	49752	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.777507067 CET	443	49751	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.777589083 CET	443	49751	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.778146982 CET	49751	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.780241013 CET	49751	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.780241013 CET	49751	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.780272007 CET	443	49751	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.780287981 CET	443	49751	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.806257963 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.806315899 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.806400061 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.816554070 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.816590071 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.816689014 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.816735029 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.816747904 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.816814899 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.816832066 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.916605949 CET	443	49754	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.916683912 CET	443	49754	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.916743994 CET	49754	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.916981936 CET	49754	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.917006016 CET	443	49754	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.917025089 CET	49754	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.917032957 CET	443	49754	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.919976950 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.920013905 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:52.920171022 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.920291901 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:52.920303106 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:53.211262941 CET	443	49755	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:53.211347103 CET	49755	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:53.212825060 CET	49755	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:53.212837934 CET	443	49755	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:53.213078976 CET	443	49755	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:53.214181900 CET	49755	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:53.259331942 CET	443	49755	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:53.787487984 CET	443	49755	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:53.787561893 CET	443	49755	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:53.787605047 CET	49755	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:53.788497925 CET	49755	443	192.168.2.6	23.218.208.109
Nov 25, 2024 10:49:53.788517952 CET	443	49755	23.218.208.109	192.168.2.6
Nov 25, 2024 10:49:54.539890051 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.540390015 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.540445089 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.540853977 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.540860891 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.579660892 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.580379009 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.580415010 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.580836058 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.580842018 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.603707075 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.604227066 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.604264021 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.604672909 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.604677916 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.660974979 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.661463022 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.661478996 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.661917925 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.661923885 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.765062094 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.765562057 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.765584946 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.766016960 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.766026974 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.974097967 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.974287987 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.974611998 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.974718094 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.974718094 CET	49759	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.974767923 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.974797010 CET	443	49759	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.977617025 CET	49761	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.977673054 CET	443	49761	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:54.977746964 CET	49761	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.977879047 CET	49761	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:54.977899075 CET	443	49761	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.031862020 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.031939030 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.032004118 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.032243013 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.032267094 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.032277107 CET	49756	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.032284021 CET	443	49756	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.035284996 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.035331964 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.035407066 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.035543919 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.035556078 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.056082964 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.056252956 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.056332111 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.056376934 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.056377888 CET	49757	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.056397915 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.056408882 CET	443	49757	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.059041023 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.059103966 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.059185982 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.059372902 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.059397936 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.114358902 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.114435911 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.114501953 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.114682913 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.114696980 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.114710093 CET	49758	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.114715099 CET	443	49758	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.117520094 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.117558002 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.117794991 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.117944002 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.117960930 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.219434977 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.219518900 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.219722986 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.219774961 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.219774961 CET	49760	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.219794989 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.219803095 CET	443	49760	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.223334074 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.223375082 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:55.223524094 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.223898888 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:55.223912954 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:56.701621056 CET	443	49761	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:56.702126980 CET	49761	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:56.702153921 CET	443	49761	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:56.702577114 CET	49761	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:56.702585936 CET	443	49761	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:56.817137957 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:56.817631960 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:56.817663908 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:56.818150043 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:56.818157911 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:56.889384031 CET	49769	443	192.168.2.6	172.202.163.200
Nov 25, 2024 10:49:56.889442921 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:56.889527082 CET	49769	443	192.168.2.6	172.202.163.200
Nov 25, 2024 10:49:56.890624046 CET	49769	443	192.168.2.6	172.202.163.200
Nov 25, 2024 10:49:56.890646935 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:56.913002968 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:56.913665056 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:56.913683891 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:56.913999081 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:56.914004087 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.002553940 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.004245996 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.004273891 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.004925013 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.004930019 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.135852098 CET	443	49761	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.135998011 CET	443	49761	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.136070013 CET	49761	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.136363029 CET	49761	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.136384010 CET	443	49761	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.136418104 CET	49761	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.136426926 CET	443	49761	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.141334057 CET	49770	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.141375065 CET	443	49770	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.141448021 CET	49770	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.141666889 CET	49770	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.141681910 CET	443	49770	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.244537115 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.245054960 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.245066881 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.245704889 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.245727062 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.260946989 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.261020899 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.261096954 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.265218019 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.265239954 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.265252113 CET	49762	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.265258074 CET	443	49762	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.365319967 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.365425110 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.365539074 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.433711052 CET	49763	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.433731079 CET	443	49763	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.436100006 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.436146975 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.436413050 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.436554909 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.436570883 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.437973022 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.438008070 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.438087940 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.438286066 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.438297033 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.447371960 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.447439909 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.447680950 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.448216915 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.448216915 CET	49765	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.448225021 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.448234081 CET	443	49765	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.460819006 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.460838079 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.460901022 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.461185932 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.461196899 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.678857088 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.678920031 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.679053068 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.679222107 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.679222107 CET	49764	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.679229975 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.679238081 CET	443	49764	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.682334900 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.682374954 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:57.682439089 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.682615042 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:57.682624102 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:58.602411032 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:58.602480888 CET	49769	443	192.168.2.6	172.202.163.200
Nov 25, 2024 10:49:58.604510069 CET	49769	443	192.168.2.6	172.202.163.200
Nov 25, 2024 10:49:58.604526043 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:58.605151892 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:58.657846928 CET	49769	443	192.168.2.6	172.202.163.200
Nov 25, 2024 10:49:58.667380095 CET	49769	443	192.168.2.6	172.202.163.200
Nov 25, 2024 10:49:58.715328932 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:58.921665907 CET	443	49770	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:58.922228098 CET	49770	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:58.922252893 CET	443	49770	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:58.922630072 CET	49770	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:58.922635078 CET	443	49770	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.220639944 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.221843958 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.221870899 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.222558022 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.222565889 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.248779058 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.249283075 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.249300957 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.249766111 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.249772072 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.281229019 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:59.281246901 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:59.281255007 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:59.281272888 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:59.281286955 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:59.281296968 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:59.281333923 CET	49769	443	192.168.2.6	172.202.163.200
Nov 25, 2024 10:49:59.281353951 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:59.281392097 CET	49769	443	192.168.2.6	172.202.163.200
Nov 25, 2024 10:49:59.281409979 CET	49769	443	192.168.2.6	172.202.163.200
Nov 25, 2024 10:49:59.284178972 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.292165041 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.292215109 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.292655945 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.292665005 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.302119970 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:59.302196980 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:59.302217960 CET	49769	443	192.168.2.6	172.202.163.200
Nov 25, 2024 10:49:59.302264929 CET	49769	443	192.168.2.6	172.202.163.200
Nov 25, 2024 10:49:59.302594900 CET	49769	443	192.168.2.6	172.202.163.200
Nov 25, 2024 10:49:59.302594900 CET	49769	443	192.168.2.6	172.202.163.200
Nov 25, 2024 10:49:59.302623987 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:59.302634001 CET	443	49769	172.202.163.200	192.168.2.6
Nov 25, 2024 10:49:59.366138935 CET	443	49770	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.366216898 CET	443	49770	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.366266012 CET	49770	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.394423962 CET	49770	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.394423962 CET	49770	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.394490957 CET	443	49770	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.394519091 CET	443	49770	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.407450914 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.407495975 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.407885075 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.419991970 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.420013905 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.461366892 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.465929985 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.465953112 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.466464996 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.466470957 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.626748085 CET	443	49741	142.250.181.100	192.168.2.6
Nov 25, 2024 10:49:59.626818895 CET	443	49741	142.250.181.100	192.168.2.6
Nov 25, 2024 10:49:59.627048969 CET	49741	443	192.168.2.6	142.250.181.100
Nov 25, 2024 10:49:59.670515060 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.670677900 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.670783997 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.670831919 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.670850039 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.670855999 CET	49772	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.670861006 CET	443	49772	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.673706055 CET	49777	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.673733950 CET	443	49777	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.673815012 CET	49777	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.673975945 CET	49777	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.673986912 CET	443	49777	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.693743944 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.693799973 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.693869114 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.694086075 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.694087029 CET	49773	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.694128036 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.694147110 CET	443	49773	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.696548939 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.696584940 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.696763039 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.696894884 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.696911097 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.736871958 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.736939907 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.737109900 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.737847090 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.737878084 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.737893105 CET	49771	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.737900019 CET	443	49771	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.740320921 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.740348101 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.740456104 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.740592957 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.740600109 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.905988932 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.906054974 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.906112909 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.906330109 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.906344891 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.906354904 CET	49774	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.906359911 CET	443	49774	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.909317017 CET	49780	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.909358025 CET	443	49780	13.107.246.63	192.168.2.6
Nov 25, 2024 10:49:59.910140038 CET	49780	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.910278082 CET	49780	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:49:59.910296917 CET	443	49780	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.272902012 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.273452997 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.273478985 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.273873091 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.273880959 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.362663984 CET	49741	443	192.168.2.6	142.250.181.100
Nov 25, 2024 10:50:01.362749100 CET	443	49741	142.250.181.100	192.168.2.6
Nov 25, 2024 10:50:01.412025928 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.412658930 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.412688971 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.413058996 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.413065910 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.464385986 CET	443	49777	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.464900017 CET	49777	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.464941025 CET	443	49777	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.465625048 CET	49777	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.465631962 CET	443	49777	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.593815088 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.594373941 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.594441891 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.594897985 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.594913006 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.628341913 CET	443	49780	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.628875971 CET	49780	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.628909111 CET	443	49780	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.629368067 CET	49780	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.629374027 CET	443	49780	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.730364084 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.730439901 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.730691910 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.730691910 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.730751038 CET	49776	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.730768919 CET	443	49776	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.733513117 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.733552933 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.733668089 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.733880043 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.733900070 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.845681906 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.845772982 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.845953941 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.845990896 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.845999002 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.846019030 CET	49778	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.846024036 CET	443	49778	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.848648071 CET	49783	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.848705053 CET	443	49783	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.848786116 CET	49783	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.848973036 CET	49783	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.848984003 CET	443	49783	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.908847094 CET	443	49777	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.908911943 CET	443	49777	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.909084082 CET	49777	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.909286976 CET	49777	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.909306049 CET	443	49777	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.909322023 CET	49777	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.909332991 CET	443	49777	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.912484884 CET	49784	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.912523985 CET	443	49784	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:01.912623882 CET	49784	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.912813902 CET	49784	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:01.912825108 CET	443	49784	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:02.045869112 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:02.045922995 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:02.046009064 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:02.046153069 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:02.046181917 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:02.046206951 CET	49779	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:02.046220064 CET	443	49779	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:02.049269915 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:02.049309015 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:02.049413919 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:02.049571991 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:02.049587965 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:02.062624931 CET	443	49780	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:02.062688112 CET	443	49780	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:02.062819004 CET	49780	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:02.062876940 CET	49780	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:02.062896013 CET	443	49780	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:02.062912941 CET	49780	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:02.062921047 CET	443	49780	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:02.065124035 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:02.065156937 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:02.065212011 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:02.065349102 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:02.065365076 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:02.213531017 CET	49787	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:50:02.213568926 CET	443	49787	20.198.119.143	192.168.2.6
Nov 25, 2024 10:50:02.213665009 CET	49787	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:50:02.214381933 CET	49787	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:50:02.214396000 CET	443	49787	20.198.119.143	192.168.2.6
Nov 25, 2024 10:50:03.516344070 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.517003059 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:03.517049074 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.520215034 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:03.520229101 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.573657990 CET	443	49783	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.574306011 CET	49783	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:03.574325085 CET	443	49783	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.576029062 CET	49783	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:03.576035023 CET	443	49783	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.692656040 CET	443	49784	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.693155050 CET	49784	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:03.693192005 CET	443	49784	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.696285963 CET	49784	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:03.696291924 CET	443	49784	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.762306929 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.763262033 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:03.763262033 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:03.763289928 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.763297081 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.962177038 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.962246895 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.962349892 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:03.962572098 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:03.962572098 CET	49782	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:03.962620974 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.962663889 CET	443	49782	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.966110945 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:03.966147900 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:03.966335058 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:03.966487885 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:03.966501951 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.007807016 CET	443	49783	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.007870913 CET	443	49783	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.008217096 CET	49783	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.008217096 CET	49783	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.008249998 CET	49783	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.008263111 CET	443	49783	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.011332989 CET	49790	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.011377096 CET	443	49790	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.011581898 CET	49790	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.011832952 CET	49790	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.011847019 CET	443	49790	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.084836960 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.085294962 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.085341930 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.085784912 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.085802078 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.141479015 CET	443	49784	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.141544104 CET	443	49784	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.141632080 CET	49784	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.141827106 CET	49784	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.141827106 CET	49784	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.141860962 CET	443	49784	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.141896963 CET	443	49784	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.146094084 CET	49791	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.146130085 CET	443	49791	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.146238089 CET	49791	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.146445990 CET	49791	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.146461010 CET	443	49791	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.196997881 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.197056055 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.197170973 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.197329044 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.197329998 CET	49785	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.197352886 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.197357893 CET	443	49785	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.200253963 CET	49792	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.200288057 CET	443	49792	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.204575062 CET	49792	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.205265045 CET	49792	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.205277920 CET	443	49792	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.444117069 CET	443	49787	20.198.119.143	192.168.2.6
Nov 25, 2024 10:50:04.444219112 CET	49787	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:50:04.449512959 CET	49787	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:50:04.449521065 CET	443	49787	20.198.119.143	192.168.2.6
Nov 25, 2024 10:50:04.449769974 CET	443	49787	20.198.119.143	192.168.2.6
Nov 25, 2024 10:50:04.451409101 CET	49787	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:50:04.451512098 CET	49787	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:50:04.451520920 CET	443	49787	20.198.119.143	192.168.2.6
Nov 25, 2024 10:50:04.451656103 CET	49787	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:50:04.499330044 CET	443	49787	20.198.119.143	192.168.2.6
Nov 25, 2024 10:50:04.541522026 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.541587114 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.541785002 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.541863918 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.541898966 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.541934967 CET	49786	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.541950941 CET	443	49786	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.544435024 CET	49793	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.544471025 CET	443	49793	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:04.544562101 CET	49793	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.544707060 CET	49793	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:04.544718981 CET	443	49793	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:05.111159086 CET	443	49787	20.198.119.143	192.168.2.6
Nov 25, 2024 10:50:05.111377001 CET	443	49787	20.198.119.143	192.168.2.6
Nov 25, 2024 10:50:05.111505032 CET	49787	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:50:05.111779928 CET	49787	443	192.168.2.6	20.198.119.143
Nov 25, 2024 10:50:05.111793041 CET	443	49787	20.198.119.143	192.168.2.6
Nov 25, 2024 10:50:05.790843010 CET	443	49790	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:05.791510105 CET	49790	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:05.791522026 CET	443	49790	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:05.793456078 CET	49790	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:05.793462038 CET	443	49790	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:05.810736895 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:05.811397076 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:05.811413050 CET	443	49789	13.107.246.63	192.168.2.6
Nov 25, 2024 10:50:05.811717033 CET	49789	443	192.168.2.6	13.107.246.63
Nov 25, 2024 10:50:05.811724901 CET	443	49789	13.107.246.63	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 10:49:44.886854887 CET	53	56146	1.1.1.1	192.168.2.6
Nov 25, 2024 10:49:44.920882940 CET	53	62707	1.1.1.1	192.168.2.6
Nov 25, 2024 10:49:47.997252941 CET	53	51007	1.1.1.1	192.168.2.6
Nov 25, 2024 10:49:48.057090998 CET	59509	53	192.168.2.6	1.1.1.1
Nov 25, 2024 10:49:48.057301044 CET	61410	53	192.168.2.6	1.1.1.1
Nov 25, 2024 10:49:48.196886063 CET	53	59509	1.1.1.1	192.168.2.6
Nov 25, 2024 10:49:48.197197914 CET	53	61410	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 10:49:48.057090998 CET	192.168.2.6	1.1.1.1	0x4ebe	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 10:49:48.057301044 CET	192.168.2.6	1.1.1.1	0xdb8d	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 10:49:48.196886063 CET	1.1.1.1	192.168.2.6	0x4ebe	No error (0)	www.google.com	142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 25, 2024 10:49:48.197197914 CET	1.1.1.1	192.168.2.6	0xdb8d	No error (0)	www.google.com		65	IN (0x0001)	false
Nov 25, 2024 10:50:01.199390888 CET	1.1.1.1	192.168.2.6	0x7bec	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 25, 2024 10:50:01.199390888 CET	1.1.1.1	192.168.2.6	0x7bec	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.azureedge.net

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49712	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:37 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 48 59 41 2f 79 58 6c 2b 41 45 75 51 77 55 64 52 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 37 31 65 66 37 62 64 38 30 64 38 35 65 32 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: HYA/yXl+AEuQwUdR.1Context: d71ef7bd80d85e23
2024-11-25 09:49:37 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-25 09:49:37 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 48 59 41 2f 79 58 6c 2b 41 45 75 51 77 55 64 52 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 37 31 65 66 37 62 64 38 30 64 38 35 65 32 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: HYA/yXl+AEuQwUdR.2Context: d71ef7bd80d85e23<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-25 09:49:37 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 48 59 41 2f 79 58 6c 2b 41 45 75 51 77 55 64 52 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 37 31 65 66 37 62 64 38 30 64 38 35 65 32 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: HYA/yXl+AEuQwUdR.3Context: d71ef7bd80d85e23<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-25 09:49:38 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-25 09:49:38 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4b 4c 70 2b 72 62 47 39 33 6b 61 44 2f 52 30 6d 61 64 2f 2f 58 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: KLp+rbG93kaD/R0mad//XQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:39 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:40 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:39 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 23 Nov 2024 12:15:37 GMT ETag: "0x8DD0BB889D4282C" x-ms-request-id: 19b35b80-c01e-0049-150a-3eac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094939Z-15b8b599d88cn5thhC1TEBqxkn00000005mg00000000c6dm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:40 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-25 09:49:40 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-25 09:49:40 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-25 09:49:40 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-25 09:49:40 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-25 09:49:40 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-25 09:49:40 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-25 09:49:40 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-25 09:49:40 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-25 09:49:40 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:42 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:43 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:43 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c9502ca5-e01e-0033-0fb4-3e4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094943Z-15b8b599d88pxmdghC1TEBux9c00000005x00000000072mf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:43 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:42 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:43 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:43 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094943Z-15b8b599d882zv28hC1TEBdchn00000005kg00000000dp7a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:43 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:42 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:43 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 2eed8dc4-701e-0098-0dc6-3e395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094943Z-178bfbc474b9xljthC1NYCtw94000000076g000000005y44 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:43 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:42 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:43 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:43 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8db92378-201e-003f-2cbf-3e6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094943Z-178bfbc474brk967hC1NYCfu60000000073g0000000056ur x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:43 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:43 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:43 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 0e051980-b01e-005c-631b-3d4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094943Z-178bfbc474bfw4gbhC1NYCunf4000000076000000000bumh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:43 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:45 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:45 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4712fcc8-d01e-002b-279a-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094945Z-174c587ffdfcj798hC1TEB9bq400000005w000000000dq97 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:45 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:45 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:45 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 30601852-401e-0047-7476-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094945Z-174c587ffdfl22mzhC1TEBk40c00000006000000000024dn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:45 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:45 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:45 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 81892826-901e-00ac-7050-3cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094945Z-15b8b599d88s6mj9hC1TEBur3000000005mg0000000076d8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:46 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:45 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:46 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:45 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 6e49b968-201e-006e-4441-3ebbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094945Z-174c587ffdftv9hphC1TEBm29w00000005n000000000fxb0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 09:49:46 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:45 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:45 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da423632-601e-0002-52c6-3ea786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094945Z-178bfbc474bpscmfhC1NYCfc2c00000005vg000000007rqn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:46 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:47 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:48 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094948Z-174c587ffdfmrvb9hC1TEBtn3800000005sg00000000a46r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:48 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:47 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:48 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094948Z-178bfbc474bscnbchC1NYCe7eg00000007h0000000001gx3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:48 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:47 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:48 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 30a29eaf-701e-001e-220f-3ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094948Z-178bfbc474bw8bwphC1NYC38b40000000750000000004hmr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:48 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:47 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:48 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 3e1ce11e-901e-00ac-5292-3bb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094948Z-15b8b599d882l6clhC1TEBxd5c00000005ng000000009k5p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:48 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:47 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:48 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094948Z-174c587ffdf4zw2thC1TEBu34000000005yg0000000000y3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:48 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:49 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:50 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 000c37a0-d01e-002b-0920-3d25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094950Z-15b8b599d88qw29phC1TEB5zag00000005q000000000dd6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:50 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:50 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:50 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094950Z-174c587ffdftjz9shC1TEBsh9800000005p0000000006km7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:50 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:50 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:50 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 4834b854-301e-005d-3ab8-3ee448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094950Z-178bfbc474bv7whqhC1NYC1fg400000007b0000000003ku5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:50 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:50 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:50 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: f1d8b84e-f01e-0096-7de6-3d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094950Z-178bfbc474bnwsh4hC1NYC2ubs000000078g00000000bnsn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:50 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:50 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:50 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 3257ccc0-201e-005d-19b5-3eafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094950Z-178bfbc474b9fdhphC1NYCac0n000000077g000000005hc3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:50 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49739	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:50 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 46 43 64 2f 32 71 44 67 77 30 61 79 79 39 6d 39 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 61 65 36 32 35 65 34 33 30 35 37 64 38 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: FCd/2qDgw0ayy9m9.1Context: a6ae625e43057d8e
2024-11-25 09:49:50 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-25 09:49:50 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 46 43 64 2f 32 71 44 67 77 30 61 79 79 39 6d 39 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 61 65 36 32 35 65 34 33 30 35 37 64 38 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: FCd/2qDgw0ayy9m9.2Context: a6ae625e43057d8e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-25 09:49:50 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 46 43 64 2f 32 71 44 67 77 30 61 79 79 39 6d 39 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 61 65 36 32 35 65 34 33 30 35 37 64 38 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: FCd/2qDgw0ayy9m9.3Context: a6ae625e43057d8e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-25 09:49:50 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-25 09:49:50 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 36 4a 6a 67 34 4e 4c 6b 30 4b 4e 7a 38 57 74 6b 30 63 6e 64 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: b6Jjg4NLk0KNz8Wtk0cndA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49749	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:51 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 09:49:51 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=85420 Date: Mon, 25 Nov 2024 09:49:51 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:52 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:52 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 5931471e-001e-0046-7a23-3dda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094952Z-178bfbc474bbbqrhhC1NYCvw7400000007f0000000004vtv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:52 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:52 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:52 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 6ea5360a-801e-002a-4904-3e31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094952Z-178bfbc474bp8mkvhC1NYCzqnn000000072g00000000912a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:52 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:52 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:52 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4ec414f5-001e-0046-5fa0-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094952Z-174c587ffdf9xbcchC1TEBxkz400000005kg00000000cppq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:52 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:52 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:52 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 2b92647c-c01e-00a2-646f-3b2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094952Z-174c587ffdfldtt2hC1TEBwv9c00000005mg00000000994b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:52 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:52 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:52 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 8dcc739e-c01e-0034-371d-3e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094952Z-15b8b599d88f9wfchC1TEBm2kc00000005y0000000004td9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:52 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49755	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:53 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 09:49:53 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=85396 Date: Mon, 25 Nov 2024 09:49:53 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-25 09:49:53 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:54 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:54 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: fe73205f-901e-0015-38e3-3eb284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094954Z-15b8b599d88qw29phC1TEB5zag00000005r000000000a7hs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:54 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:54 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:54 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: ed298b8a-a01e-0002-322d-3c5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094954Z-178bfbc474bbcwv4hC1NYCypys000000075g000000004p7r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:55 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:54 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:54 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 9a3ed3ee-501e-00a0-41c6-3e9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094954Z-178bfbc474bbbqrhhC1NYCvw7400000007h0000000001mk3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:55 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:54 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:54 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: bd408748-301e-0052-28b9-3d65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094954Z-15b8b599d886w4hzhC1TEBb4ug00000005xg000000000z5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:55 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:54 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:55 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 375df28d-601e-00ab-5b0b-3d66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094955Z-178bfbc474bpscmfhC1NYCfc2c00000005tg00000000b8h6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:55 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:56 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:56 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 2160d4c7-701e-0021-5913-3d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094956Z-178bfbc474bw8bwphC1NYC38b40000000720000000009sc7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:57 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:56 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:57 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 413a5bf0-401e-0035-1ab5-3e82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094957Z-178bfbc474brk967hC1NYCfu600000000710000000009da0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:57 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:56 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:57 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 16d74281-d01e-0066-164b-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094957Z-15b8b599d885ffrhhC1TEBtuv000000005r000000000hu7e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:57 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:57 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:57 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: d83ea369-501e-000a-040c-3d0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094957Z-178bfbc474bp8mkvhC1NYCzqnn0000000730000000007k0z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:57 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:57 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:57 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 95b9e869-801e-008c-3081-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094957Z-174c587ffdf4zw2thC1TEBu34000000005x0000000003wuq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:57 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49769	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:58 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2pFB64Gy7Hd6F54&MD=3ysS4L65 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-25 09:49:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d399a89d-2e20-4578-a5b9-6271267a0591 MS-RequestId: 3f297e84-802b-45e1-a83b-ce7ca1baf96a MS-CV: LvL0Rej1h0eq/GOT.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 25 Nov 2024 09:49:58 GMT Connection: close Content-Length: 24490
2024-11-25 09:49:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-25 09:49:59 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:58 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:59 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 35c17bb4-f01e-0052-536c-3d9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094959Z-15b8b599d889gj5whC1TEBfyk000000005ng0000000056kq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:59 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:59 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:59 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094959Z-174c587ffdf8fcgwhC1TEBnn7000000005tg00000000pdaz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:59 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:59 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:59 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:59 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 069344af-301e-0020-09c0-3e6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094959Z-178bfbc474bxkclvhC1NYC69g4000000076g000000007kr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 09:49:59 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:59 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:59 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e4221271-301e-0051-4239-3d38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094959Z-174c587ffdfb5q56hC1TEB04kg00000005k000000000kpvm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:59 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:49:59 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:49:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:49:59 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: c24f93c3-601e-00ab-62a8-3e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T094959Z-178bfbc474bscnbchC1NYCe7eg00000007c0000000008yvs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:49:59 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:01 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:01 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 97f3364e-001e-00a2-6ca6-3ed4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095001Z-178bfbc474bxkclvhC1NYC69g4000000079g000000002sff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:50:01 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:01 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:01 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 8a9c0054-c01e-0046-231b-3e2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095001Z-15b8b599d88l2dpthC1TEBmzr000000005v00000000007zx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:50:01 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:01 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:01 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7658b735-201e-0051-2a02-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095001Z-15b8b599d8885prmhC1TEBsnkw00000005u000000000dx6w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:50:01 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:01 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:01 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 2abfc2a9-b01e-003d-094d-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095001Z-15b8b599d88qw29phC1TEB5zag00000005s00000000083sq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:50:02 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:01 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:01 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 9177d9ad-001e-0028-350e-3dc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095001Z-178bfbc474bscnbchC1NYCe7eg00000007cg000000008cpw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:50:02 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:03 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:03 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: f47ed088-401e-0029-7f4d-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095003Z-15b8b599d88pxmdghC1TEBux9c00000005wg0000000089vm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:50:03 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:03 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:03 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095003Z-174c587ffdf89smkhC1TEB697s00000005sg00000000fn14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:50:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:03 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:03 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 2661dead-d01e-008e-1cf5-3e387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095003Z-174c587ffdfx984chC1TEB676g00000005r000000000bp7b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:50:04 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:03 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095004Z-15b8b599d886w4hzhC1TEBb4ug00000005w0000000004gw7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:50:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:04 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:04 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: ce4e00c6-401e-00a3-3516-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095004Z-178bfbc474bv7whqhC1NYC1fg400000007d0000000000he0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:50:04 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49787	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:04 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 78 67 36 45 46 68 49 68 44 45 65 54 47 6e 74 37 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 31 64 31 63 62 35 38 37 64 39 39 39 32 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: xg6EFhIhDEeTGnt7.1Context: 421d1cb587d9992f
2024-11-25 09:50:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-25 09:50:04 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 78 67 36 45 46 68 49 68 44 45 65 54 47 6e 74 37 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 31 64 31 63 62 35 38 37 64 39 39 39 32 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: xg6EFhIhDEeTGnt7.2Context: 421d1cb587d9992f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-25 09:50:04 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 78 67 36 45 46 68 49 68 44 45 65 54 47 6e 74 37 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 31 64 31 63 62 35 38 37 64 39 39 39 32 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: xg6EFhIhDEeTGnt7.3Context: 421d1cb587d9992f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-25 09:50:05 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-25 09:50:05 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 39 69 6f 46 79 32 54 30 50 45 61 74 47 47 7a 59 79 78 4f 56 76 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 9ioFy2T0PEatGGzYyxOVvQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:05 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:06 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:06 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 891407d0-301e-0096-28a6-3ee71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095006Z-178bfbc474b9xljthC1NYCtw940000000780000000003nb0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 09:50:06 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:05 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: b8b6ef80-e01e-0051-723f-3e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095006Z-15b8b599d885ffrhhC1TEBtuv000000005ug000000007x1q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:50:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:05 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 2315140c-801e-0015-4daf-3ef97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095006Z-178bfbc474b7cbwqhC1NYC8z4n000000076g000000006bqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:50:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:06 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 482df903-301e-005d-4bb5-3ee448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095006Z-178bfbc474bpscmfhC1NYCfc2c00000005v0000000008e16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:50:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 09:50:06 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 09:50:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 09:50:06 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 753d71cc-101e-0065-41b6-3e4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T095006Z-178bfbc474brk967hC1NYCfu600000000740000000004qxf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 09:50:06 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 6120, Parent PID: 5536

General

Target ID:	1
Start time:	04:49:39
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7004, Parent PID: 6120

General

Target ID:	3
Start time:	04:49:43
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2200,i,983471930472294540,10932090612570421008,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6948, Parent PID: 5536

General

Target ID:	4
Start time:	04:49:45
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://127.0.0.1/"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://127.0.0.1/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6120, Parent PID: 5536

General

Chronological Activities

Analysis Process: chrome.exePID: 7004, Parent PID: 6120

General

Chronological Activities

Analysis Process: chrome.exePID: 6948, Parent PID: 5536

General

Chronological Activities

Disassembly

Windows Analysis Report
http://127.0.0.1/