Edit tour

Windows Analysis Report
http://52.209.78.88/raphael_data_v8

Overview

General Information

Sample URL:	http://52.209.78.88/raphael_data_v8
Analysis ID:	1562501
Infos:

Errors URL not reachable

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected suspicious URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 4892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2012,i,5949725106249625321,7293182894652153858,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://52.209.78.88/raphael_data_v8" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious URL

Source: Email

Joe Sandbox AI: AI detected IP in URL: http://52.209.78.88

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.10:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.10:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.10:49730 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 52.209.78.88
Source: unknown	TCP traffic detected without corresponding DNS query: 52.209.78.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 52.209.78.88
Source: unknown	TCP traffic detected without corresponding DNS query: 52.209.78.88
Source: unknown	TCP traffic detected without corresponding DNS query: 52.209.78.88
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /raphael_data_v8 HTTP/1.1Host: 52.209.78.88Connection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /raphael_data_v8 HTTP/1.1Host: 52.209.78.88Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic

DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.10:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.10:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.10:49730 version: TLS 1.2

Source: classification engine

Classification label: sus20.win@18/6@2/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2012,i,5949725106249625321,7293182894652153858,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://52.209.78.88/raphael_data_v8"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2012,i,5949725106249625321,7293182894652153858,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://52.209.78.88/raphael_data_v8	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	172.217.21.36	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://52.209.78.88/raphael_data_v8	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.209.78.88	unknown	United States	16509	AMAZON-02US	true
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.10

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562501
Start date and time:	2024-11-25 16:32:43 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://52.209.78.88/raphael_data_v8
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus20.win@18/6@2/4
Cookbook Comments:	URL browsing timeout or error

Errors

URL not reachable

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, Sgrmuserer.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.238, 64.233.165.84, 172.217.19.227, 34.104.35.123, 4.245.163.56, 2.20.68.201, 2.20.68.210, 52.165.164.15
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://52.209.78.88/raphael_data_v8

Simulations

Behavior and APIs

⊘No simulations

Input	Output
URL: http://52.209.78.88 Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": true, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: http://52.209.78.88

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 14:33:41 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.981343316091695
Encrypted:	false
SSDEEP:	48:8AObdqVThC7zH7tleidAKZdA1uehwiZUklqehRdy+3:8A9whlPwdy
MD5:	4797BBD55DC08CE7C511DCE48CF9F1A2
SHA1:	7A5EBC483C6431A7AFC2A16D7A5C91A5D31863FF
SHA-256:	56700F921E2A89830E02E4C0F3A76B9A9312D39AEBAF0BDD3E055F29809D6EC5
SHA-512:	0EE8BE3511A8155C4C081672551A181884F4E0A3BA0F69EBA5E792340CEB3D96611EB1DE7CEDD46E137FB226014AFFA6DDA234A48DA580D60C12799306CB28C3
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....'..gO?......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IyY3\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY3\|....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VyY3\|....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VyY3\|...........................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VyY5\|....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............i......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 14:33:41 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9977335863916896
Encrypted:	false
SSDEEP:	48:8aObdqVThC7zH7tleidAKZdA1Heh/iZUkAQkqehgdy+2:8a9whlp9Q/dy
MD5:	8525A187AF6A078C70034FD0F6EAFB45
SHA1:	E008B783166B2AC908D80D41F1AF644A400BF21D
SHA-256:	3DF87F68484B7A5CDF60B8F2E3E12B942D757464A073D4FE010BB639868EEC2E
SHA-512:	4B1DFE982B1BEB70187E1E6301B1FAE4A9BCB6D20DC742DB29DECD132EA1CF8C6A1861A0570B77D501DDB00987D42738008644CDCC2AA23295F75E66A067A127
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....><.gO?......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IyY3\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY3\|....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VyY3\|....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VyY3\|...........................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VyY5\|....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............i......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 08:59:33 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.007827248597959
Encrypted:	false
SSDEEP:	48:8FObdqVThCbH7tleidAKZdA149eh7sFiZUkmgqeh7sGdy+BX:8F9wdlFncdy
MD5:	D51D2771DEF299CAC58D5BD477FE2786
SHA1:	55016C0CFE046A42245214D2A9282C1113386DC0
SHA-256:	0FFDB0FF1E46BA6E7AF86E3057453E352F216121EDB77E368DE7142B4C3654E4
SHA-512:	1EFCAEEA4D07F801B80640D60747354968029BAFB4BFD9D6D6C749250D92934F98B468D10F94E16158F5A206EE22CDCBA7E549FAB8BFEAE803EBD4B6F81F1AC4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....K..r.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IyY3\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY3\|....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VyY3\|....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VyY3\|...........................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VEW.L....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............i......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 14:33:41 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9972179362333584
Encrypted:	false
SSDEEP:	48:86/ObdqVThC7zH7tleidAKZdA14ehDiZUkwqehEdy+R:86/9whl6udy
MD5:	D8B240FE5AA1C54F09DB6127BC53FD92
SHA1:	8EF2D26765B7DC577F3B7B9C27B4AA0509816CDB
SHA-256:	827DEEC08F66848A27831DA66ADEBFADB2D6A40F1F78E09D68424E26FD69249D
SHA-512:	6ADA73F8EC8EBB5DB3D20282676E825EBDD40AD0B0FB0ABAFA3A11416D7A6996F3FF2DF77C18E5DD69215A39EC9D112F6661DB3FBE55AE67BC0287986D4B0DB4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....v..gO?......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IyY3\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY3\|....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VyY3\|....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VyY3\|...........................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VyY5\|....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............i......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 14:33:41 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9857490137103437
Encrypted:	false
SSDEEP:	48:8uObdqVThC7zH7tleidAKZdA1mehBiZUk1W1qehCdy+C:8u9whlq9idy
MD5:	5A2A5A9B597BBFCAF471128B1BE24341
SHA1:	0A6561D71B70CBE3E8BD9697149858E61E5C5717
SHA-256:	D7359D792FDB1A6294DA7F498610347B399AA7A90A05655DD7439448BA4E2D45
SHA-512:	CFF8B7BF8C7D11E6E81757067B47C4D74070287FF66DD86E4EBD502AE907B57E9074C7D55FE862946E2954616777A60C84B3030597F6692345FB5DBB41B541E9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....B..gO?......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IyY3\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY3\|....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VyY3\|....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VyY3\|...........................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VyY5\|....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............i......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 14:33:41 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.992095262710714
Encrypted:	false
SSDEEP:	48:8kObdqVThC7zH7tleidAKZdA1duT1ehOuTbbiZUk5OjqehOuTbcdy+yT+:8k9whlRTyTbxWOvTbcdy7T
MD5:	7401435E35B779C15FDCF2EB6488B173
SHA1:	9AC8909971BEED0DB574773FB4577DB4BFB3B3B1
SHA-256:	8FAE2B236E62E3E763B1F11DA6C51EB8F50524C534544CB7EF599DF238A403B0
SHA-512:	3AD5AA808B66DCA3A98E6AAB178AC42A7A908E96DF4A27A4446D57E6A1957133F4934A47351F9D08EF20948CABE4D7BE6671DFEC8D098CBB6CA41E490C1E7C5B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......gO?......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IyY3\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY3\|....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VyY3\|....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VyY3\|...........................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VyY5\|....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............i......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 16:33:30.705625057 CET	49671	443	192.168.2.10	204.79.197.203
Nov 25, 2024 16:33:33.096132994 CET	49674	443	192.168.2.10	173.222.162.55
Nov 25, 2024 16:33:33.096354008 CET	49675	443	192.168.2.10	173.222.162.55
Nov 25, 2024 16:33:35.518014908 CET	49671	443	192.168.2.10	204.79.197.203
Nov 25, 2024 16:33:36.636746883 CET	49677	443	192.168.2.10	20.42.65.85
Nov 25, 2024 16:33:36.939940929 CET	49677	443	192.168.2.10	20.42.65.85
Nov 25, 2024 16:33:37.549300909 CET	49677	443	192.168.2.10	20.42.65.85
Nov 25, 2024 16:33:38.861773968 CET	49677	443	192.168.2.10	20.42.65.85
Nov 25, 2024 16:33:39.278722048 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:39.278778076 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:39.278851032 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:39.279584885 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:39.279593945 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.099186897 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.099267006 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:41.103342056 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:41.103358984 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.103606939 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.113322020 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:41.159332991 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.330528021 CET	49709	80	192.168.2.10	52.209.78.88
Nov 25, 2024 16:33:41.330725908 CET	49710	80	192.168.2.10	52.209.78.88
Nov 25, 2024 16:33:41.351007938 CET	49677	443	192.168.2.10	20.42.65.85
Nov 25, 2024 16:33:41.452356100 CET	80	49709	52.209.78.88	192.168.2.10
Nov 25, 2024 16:33:41.452395916 CET	80	49710	52.209.78.88	192.168.2.10
Nov 25, 2024 16:33:41.452506065 CET	49709	80	192.168.2.10	52.209.78.88
Nov 25, 2024 16:33:41.454379082 CET	49710	80	192.168.2.10	52.209.78.88
Nov 25, 2024 16:33:41.465878010 CET	49710	80	192.168.2.10	52.209.78.88
Nov 25, 2024 16:33:41.583837986 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.583864927 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.583879948 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.583937883 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:41.583970070 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.584017992 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:41.586808920 CET	80	49710	52.209.78.88	192.168.2.10
Nov 25, 2024 16:33:41.780308962 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.780344963 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.780461073 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:41.780486107 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.780524969 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:41.821445942 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.821479082 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.821595907 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:41.821609020 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.821651936 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:41.962538004 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.962579966 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.962613106 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:41.962647915 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.962662935 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:41.962690115 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:41.993566036 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.993603945 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.993644953 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:41.993666887 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:41.993691921 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:41.993710995 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.010617018 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.010647058 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.010689020 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.010703087 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.010730982 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.010749102 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.031270027 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.031306028 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.031353951 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.031363964 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.031392097 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.031413078 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.164731026 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.164763927 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.164844990 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.164865017 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.164904118 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.164923906 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.185323954 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.185355902 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.185391903 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.185406923 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.185436964 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.185456038 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.203449965 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.203485966 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.203553915 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.203568935 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.203603029 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.203622103 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.218655109 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.218687057 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.218720913 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.218733072 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.218761921 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.218791962 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.237729073 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.237761974 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.237793922 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.237802029 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.237847090 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.253034115 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.253070116 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.253129005 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.253137112 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.253170967 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.253190041 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.260596037 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.260682106 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.260684013 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.260725975 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.260893106 CET	49703	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.260911942 CET	443	49703	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.497261047 CET	49712	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.497282982 CET	49711	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.497314930 CET	443	49712	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.497329950 CET	443	49711	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.497371912 CET	49712	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.497400999 CET	49711	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.498713970 CET	49713	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.498822927 CET	443	49713	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.498897076 CET	49713	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.499002934 CET	49714	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.499028921 CET	443	49714	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.499073029 CET	49714	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.500483990 CET	49715	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.500514984 CET	443	49715	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.500571966 CET	49715	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.501238108 CET	49715	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.501271009 CET	443	49715	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.501574039 CET	49712	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.501595020 CET	443	49712	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.501708031 CET	49711	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.501729965 CET	443	49711	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.501868963 CET	49714	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.501878023 CET	443	49714	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.501899958 CET	49713	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:42.501921892 CET	443	49713	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:42.705223083 CET	49674	443	192.168.2.10	173.222.162.55
Nov 25, 2024 16:33:42.705246925 CET	49675	443	192.168.2.10	173.222.162.55
Nov 25, 2024 16:33:44.289047003 CET	443	49711	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.305130959 CET	49711	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.305152893 CET	443	49711	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.310465097 CET	443	49713	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.312274933 CET	443	49712	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.323431015 CET	49711	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.323442936 CET	443	49711	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.324664116 CET	49713	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.324738026 CET	443	49713	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.325279951 CET	49713	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.325299025 CET	443	49713	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.325593948 CET	49712	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.325617075 CET	443	49712	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.326236010 CET	49712	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.326241016 CET	443	49712	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.332446098 CET	443	49715	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.332834959 CET	49715	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.332886934 CET	443	49715	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.333549023 CET	49715	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.333563089 CET	443	49715	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.354290962 CET	443	49714	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.454900026 CET	49714	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.493469954 CET	49714	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.493493080 CET	443	49714	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.494040966 CET	49714	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.494051933 CET	443	49714	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.618658066 CET	49718	443	192.168.2.10	172.217.21.36
Nov 25, 2024 16:33:44.618695974 CET	443	49718	172.217.21.36	192.168.2.10
Nov 25, 2024 16:33:44.618756056 CET	49718	443	192.168.2.10	172.217.21.36
Nov 25, 2024 16:33:44.619057894 CET	49718	443	192.168.2.10	172.217.21.36
Nov 25, 2024 16:33:44.619071960 CET	443	49718	172.217.21.36	192.168.2.10
Nov 25, 2024 16:33:44.737755060 CET	443	49711	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.737828970 CET	443	49711	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.737879038 CET	49711	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.738095999 CET	49711	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.738118887 CET	443	49711	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.738153934 CET	49711	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.738162041 CET	443	49711	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.740871906 CET	49719	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.740914106 CET	443	49719	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.740986109 CET	49719	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.741167068 CET	49719	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.741190910 CET	443	49719	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.763592005 CET	443	49713	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.763617039 CET	443	49713	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.763674021 CET	49713	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.763742924 CET	443	49713	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.763916016 CET	49713	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.763953924 CET	443	49713	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.763977051 CET	49713	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.764101028 CET	443	49713	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.764134884 CET	443	49713	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.764177084 CET	49713	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.766560078 CET	49720	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.766586065 CET	443	49720	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.766648054 CET	49720	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.766817093 CET	49720	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.766830921 CET	443	49720	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.792027950 CET	443	49712	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.792090893 CET	443	49712	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.792150974 CET	49712	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.792176962 CET	443	49712	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.792218924 CET	49712	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.792248964 CET	443	49712	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.792294025 CET	49712	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.792427063 CET	49712	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.792445898 CET	443	49712	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.792458057 CET	49712	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.792463064 CET	443	49712	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.794770956 CET	49721	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.794817924 CET	443	49721	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.794884920 CET	49721	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.795037031 CET	49721	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.795049906 CET	443	49721	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.803415060 CET	443	49715	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.803484917 CET	443	49715	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.803530931 CET	49715	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.803633928 CET	49715	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.803675890 CET	443	49715	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.803700924 CET	49715	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.803716898 CET	443	49715	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.805701971 CET	49722	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.805713892 CET	443	49722	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.805764914 CET	49722	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.805949926 CET	49722	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.805959940 CET	443	49722	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.849895000 CET	443	49714	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.849922895 CET	443	49714	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.849977970 CET	443	49714	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.849989891 CET	49714	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.850043058 CET	49714	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.856040955 CET	49714	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.856050014 CET	443	49714	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.859771967 CET	49723	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.859817028 CET	443	49723	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:44.859875917 CET	49723	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.860232115 CET	49723	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:44.860246897 CET	443	49723	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:45.129041910 CET	49671	443	192.168.2.10	204.79.197.203
Nov 25, 2024 16:33:45.193026066 CET	49724	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:45.193129063 CET	443	49724	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:45.193238020 CET	49724	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:45.195297003 CET	49724	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:45.195369959 CET	443	49724	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:46.155174017 CET	49677	443	192.168.2.10	20.42.65.85
Nov 25, 2024 16:33:46.365762949 CET	443	49718	172.217.21.36	192.168.2.10
Nov 25, 2024 16:33:46.366027117 CET	49718	443	192.168.2.10	172.217.21.36
Nov 25, 2024 16:33:46.366055965 CET	443	49718	172.217.21.36	192.168.2.10
Nov 25, 2024 16:33:46.367604017 CET	443	49718	172.217.21.36	192.168.2.10
Nov 25, 2024 16:33:46.367662907 CET	49718	443	192.168.2.10	172.217.21.36
Nov 25, 2024 16:33:46.368702888 CET	49718	443	192.168.2.10	172.217.21.36
Nov 25, 2024 16:33:46.368789911 CET	443	49718	172.217.21.36	192.168.2.10
Nov 25, 2024 16:33:46.409946918 CET	49718	443	192.168.2.10	172.217.21.36
Nov 25, 2024 16:33:46.409957886 CET	443	49718	172.217.21.36	192.168.2.10
Nov 25, 2024 16:33:46.456676960 CET	49718	443	192.168.2.10	172.217.21.36
Nov 25, 2024 16:33:46.522080898 CET	443	49721	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.522677898 CET	49721	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.522707939 CET	443	49721	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.523232937 CET	49721	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.523238897 CET	443	49721	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.528861046 CET	443	49719	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.529295921 CET	49719	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.529316902 CET	443	49719	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.529680967 CET	49719	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.529686928 CET	443	49719	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.611737013 CET	443	49722	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.612879038 CET	49722	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.612905979 CET	443	49722	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.613600969 CET	49722	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.613606930 CET	443	49722	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.617897987 CET	443	49720	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.618333101 CET	49720	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.618349075 CET	443	49720	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.618729115 CET	49720	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.618733883 CET	443	49720	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.672461033 CET	443	49724	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:46.672543049 CET	49724	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:46.676296949 CET	49724	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:46.676333904 CET	443	49724	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:46.676580906 CET	443	49724	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:46.710140944 CET	443	49723	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.710671902 CET	49723	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.710694075 CET	443	49723	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.711101055 CET	49723	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.711107016 CET	443	49723	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.718709946 CET	49724	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:46.722316980 CET	49724	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:46.767334938 CET	443	49724	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:46.958784103 CET	443	49721	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.958961010 CET	443	49721	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.959019899 CET	49721	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.959090948 CET	49721	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.959120989 CET	443	49721	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.959131956 CET	49721	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.959137917 CET	443	49721	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.961963892 CET	49725	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.962063074 CET	443	49725	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.962153912 CET	49725	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.962287903 CET	49725	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.962311983 CET	443	49725	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.972687960 CET	443	49719	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.972768068 CET	443	49719	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.972902060 CET	49719	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.972946882 CET	49719	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.972946882 CET	49719	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.972966909 CET	443	49719	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.972976923 CET	443	49719	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.975223064 CET	49726	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.975282907 CET	443	49726	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:46.975351095 CET	49726	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.975486994 CET	49726	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:46.975502968 CET	443	49726	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.070903063 CET	443	49720	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.070986032 CET	443	49720	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.071059942 CET	49720	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.071192980 CET	49720	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.071208000 CET	443	49720	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.071218014 CET	49720	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.071223974 CET	443	49720	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.071506023 CET	443	49722	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.071573019 CET	443	49722	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.071645021 CET	49722	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.072174072 CET	49722	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.072180033 CET	443	49722	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.072208881 CET	49722	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.072212934 CET	443	49722	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.073704004 CET	49727	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.073751926 CET	443	49727	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.073846102 CET	49727	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.073971033 CET	49727	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.074002981 CET	443	49727	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.074470043 CET	49728	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.074491978 CET	443	49728	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.074561119 CET	49728	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.074661016 CET	49728	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.074681997 CET	443	49728	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.164307117 CET	443	49723	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.164374113 CET	443	49723	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.164526939 CET	49723	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.164586067 CET	49723	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.164603949 CET	443	49723	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.164613962 CET	49723	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.164621115 CET	443	49723	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.167176962 CET	49729	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.167216063 CET	443	49729	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.167413950 CET	49729	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.167469978 CET	49729	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:47.167479038 CET	443	49729	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:47.204809904 CET	443	49724	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:47.204873085 CET	443	49724	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:47.205019951 CET	49724	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:47.205141068 CET	49724	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:47.205208063 CET	443	49724	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:47.205239058 CET	49724	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:47.205259085 CET	443	49724	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:47.243774891 CET	49730	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:47.243814945 CET	443	49730	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:47.243896961 CET	49730	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:47.244246960 CET	49730	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:47.244260073 CET	443	49730	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:48.625962019 CET	443	49730	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:48.626178026 CET	49730	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:48.642313957 CET	49730	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:48.642328978 CET	443	49730	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:48.642545938 CET	443	49730	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:48.643910885 CET	49730	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:48.691329002 CET	443	49730	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:48.700074911 CET	443	49726	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:48.700618982 CET	49726	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:48.700656891 CET	443	49726	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:48.701056957 CET	49726	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:48.701065063 CET	443	49726	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:48.759675980 CET	443	49725	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:48.760262966 CET	49725	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:48.760338068 CET	443	49725	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:48.760682106 CET	49725	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:48.760695934 CET	443	49725	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:48.965054035 CET	443	49729	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:48.965478897 CET	49729	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:48.965513945 CET	443	49729	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:48.965970039 CET	49729	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:48.965979099 CET	443	49729	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:48.978537083 CET	443	49728	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:48.985037088 CET	49728	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:48.985146046 CET	443	49728	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:48.985424042 CET	49728	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:48.985440016 CET	443	49728	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.137747049 CET	443	49726	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.137928009 CET	443	49726	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.138062954 CET	49726	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.138165951 CET	49726	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.138185024 CET	443	49726	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.138220072 CET	49726	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.138227940 CET	443	49726	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.141248941 CET	49731	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.141274929 CET	443	49731	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.141352892 CET	49731	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.141474009 CET	49731	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.141482115 CET	443	49731	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.145986080 CET	443	49730	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:49.146056890 CET	443	49730	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:49.146410942 CET	49730	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:49.146776915 CET	49730	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:49.146797895 CET	443	49730	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:49.146807909 CET	49730	443	192.168.2.10	23.218.208.109
Nov 25, 2024 16:33:49.146814108 CET	443	49730	23.218.208.109	192.168.2.10
Nov 25, 2024 16:33:49.203567982 CET	443	49725	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.203646898 CET	443	49725	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.203744888 CET	49725	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.203927040 CET	49725	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.203927040 CET	49725	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.203985929 CET	443	49725	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.204011917 CET	443	49725	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.206484079 CET	49732	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.206525087 CET	443	49732	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.206593990 CET	49732	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.206743002 CET	49732	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.206753969 CET	443	49732	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.409964085 CET	443	49729	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.410026073 CET	443	49729	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.410239935 CET	49729	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.410273075 CET	49729	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.410285950 CET	443	49729	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.410300016 CET	49729	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.410306931 CET	443	49729	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.412980080 CET	49733	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.413008928 CET	443	49733	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.413209915 CET	49733	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.413209915 CET	49733	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.413239002 CET	443	49733	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.435825109 CET	443	49728	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.435883045 CET	443	49728	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.436049938 CET	49728	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.436110973 CET	49728	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.436110973 CET	49728	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.436140060 CET	443	49728	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.436177015 CET	443	49728	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.438230991 CET	49734	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.438257933 CET	443	49734	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:49.438328981 CET	49734	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.438466072 CET	49734	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:49.438477039 CET	443	49734	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:50.877665997 CET	443	49731	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:50.878197908 CET	49731	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:50.878236055 CET	443	49731	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:50.878746986 CET	49731	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:50.878753901 CET	443	49731	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:50.948781967 CET	443	49732	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:50.949455023 CET	49732	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:50.949489117 CET	443	49732	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:50.949923992 CET	49732	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:50.949930906 CET	443	49732	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.215979099 CET	443	49733	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.223140001 CET	49733	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.223180056 CET	443	49733	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.223572016 CET	49733	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.223577976 CET	443	49733	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.227238894 CET	443	49734	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.227502108 CET	49734	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.227557898 CET	443	49734	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.227983952 CET	49734	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.227994919 CET	443	49734	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.338360071 CET	443	49731	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.338464975 CET	443	49731	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.338522911 CET	49731	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.338663101 CET	49731	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.338690042 CET	443	49731	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.338706017 CET	49731	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.338713884 CET	443	49731	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.341080904 CET	49735	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.341130972 CET	443	49735	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.341196060 CET	49735	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.341337919 CET	49735	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.341357946 CET	443	49735	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.394678116 CET	443	49732	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.394843102 CET	443	49732	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.394902945 CET	49732	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.394964933 CET	49732	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.394985914 CET	443	49732	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.394995928 CET	49732	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.395000935 CET	443	49732	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.397425890 CET	49736	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.397458076 CET	443	49736	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.397578001 CET	49736	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.397758961 CET	49736	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.397777081 CET	443	49736	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.755048990 CET	443	49733	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.755126953 CET	443	49733	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.755178928 CET	49733	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.755302906 CET	443	49734	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.755386114 CET	49733	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.755404949 CET	443	49733	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.755479097 CET	443	49734	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.755537987 CET	49734	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.755572081 CET	49734	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.755588055 CET	443	49734	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.755598068 CET	49734	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.755604029 CET	443	49734	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.759485960 CET	49739	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.759521961 CET	443	49739	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.759530067 CET	49738	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.759572029 CET	443	49738	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.759599924 CET	49739	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.759648085 CET	49738	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.759788990 CET	49739	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.759799004 CET	443	49739	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.759818077 CET	49738	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.759834051 CET	443	49738	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.929075003 CET	443	49727	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.929688931 CET	49727	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.929733992 CET	443	49727	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:51.930133104 CET	49727	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:51.930141926 CET	443	49727	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:52.385754108 CET	443	49727	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:52.385922909 CET	443	49727	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:52.386087894 CET	49727	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:52.386162996 CET	49727	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:52.386194944 CET	443	49727	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:52.386209965 CET	49727	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:52.386219025 CET	443	49727	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:52.389869928 CET	49740	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:52.389967918 CET	443	49740	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:52.390053034 CET	49740	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:52.390224934 CET	49740	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:52.390261889 CET	443	49740	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.193516970 CET	443	49735	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.194353104 CET	49735	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.194379091 CET	443	49735	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.194803953 CET	49735	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.194811106 CET	443	49735	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.281583071 CET	443	49736	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.282361031 CET	49736	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.282391071 CET	443	49736	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.283004999 CET	49736	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.283014059 CET	443	49736	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.500060081 CET	443	49739	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.500596046 CET	49739	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.500627041 CET	443	49739	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.501069069 CET	49739	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.501075029 CET	443	49739	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.548993111 CET	443	49738	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.553178072 CET	49738	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.553215027 CET	443	49738	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.553731918 CET	49738	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.553739071 CET	443	49738	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.658957958 CET	443	49735	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.659049034 CET	443	49735	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.659198046 CET	49735	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.661475897 CET	49735	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.661493063 CET	443	49735	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.661504984 CET	49735	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.661509991 CET	443	49735	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.672091007 CET	49741	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.672137976 CET	443	49741	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.672302961 CET	49741	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.673605919 CET	49741	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.673623085 CET	443	49741	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.846813917 CET	443	49736	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.846997976 CET	443	49736	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.847060919 CET	49736	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.847371101 CET	49736	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.847371101 CET	49736	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.847394943 CET	443	49736	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.847409010 CET	443	49736	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.849530935 CET	49743	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.849580050 CET	443	49743	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.849669933 CET	49743	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.849788904 CET	49743	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.849800110 CET	443	49743	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.939131021 CET	443	49739	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.939301968 CET	443	49739	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.939414978 CET	49739	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.940975904 CET	49739	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.940994978 CET	443	49739	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.941009045 CET	49739	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.941015005 CET	443	49739	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.943232059 CET	49744	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.943253994 CET	443	49744	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.943321943 CET	49744	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.943451881 CET	49744	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.943464041 CET	443	49744	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.994052887 CET	443	49738	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.994118929 CET	443	49738	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.994168043 CET	49738	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.994564056 CET	49738	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.994592905 CET	443	49738	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.994606018 CET	49738	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.994613886 CET	443	49738	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.997260094 CET	49745	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.997297049 CET	443	49745	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:53.997376919 CET	49745	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.998069048 CET	49745	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:53.998086929 CET	443	49745	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:54.112431049 CET	443	49740	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:54.113198996 CET	49740	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:54.113308907 CET	443	49740	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:54.113903046 CET	49740	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:54.113919020 CET	443	49740	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:54.571628094 CET	443	49740	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:54.571805954 CET	443	49740	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:54.571881056 CET	49740	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:54.571968079 CET	49740	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:54.571968079 CET	49740	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:54.572031021 CET	443	49740	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:54.572060108 CET	443	49740	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:54.574495077 CET	49746	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:54.574537039 CET	443	49746	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:54.574609041 CET	49746	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:54.574728966 CET	49746	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:54.574736118 CET	443	49746	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.463882923 CET	443	49741	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.464427948 CET	49741	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:55.464457035 CET	443	49741	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.464973927 CET	49741	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:55.464979887 CET	443	49741	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.699035883 CET	443	49743	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.699590921 CET	49743	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:55.699616909 CET	443	49743	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.700057983 CET	49743	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:55.700064898 CET	443	49743	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.725305080 CET	443	49744	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.725838900 CET	49744	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:55.725872993 CET	443	49744	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.726388931 CET	49744	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:55.726396084 CET	443	49744	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.755577087 CET	49677	443	192.168.2.10	20.42.65.85
Nov 25, 2024 16:33:55.780591965 CET	443	49745	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.781156063 CET	49745	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:55.781187057 CET	443	49745	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.781678915 CET	49745	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:55.781686068 CET	443	49745	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.908463955 CET	443	49741	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.908534050 CET	443	49741	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.908723116 CET	49741	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:55.908772945 CET	49741	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:55.908799887 CET	443	49741	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.908819914 CET	49741	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:55.908828020 CET	443	49741	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.911809921 CET	49748	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:55.911851883 CET	443	49748	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:55.911986113 CET	49748	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:55.912168026 CET	49748	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:55.912182093 CET	443	49748	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.043849945 CET	443	49718	172.217.21.36	192.168.2.10
Nov 25, 2024 16:33:56.043910027 CET	443	49718	172.217.21.36	192.168.2.10
Nov 25, 2024 16:33:56.044209003 CET	49718	443	192.168.2.10	172.217.21.36
Nov 25, 2024 16:33:56.153345108 CET	443	49743	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.153453112 CET	443	49743	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.153506041 CET	49743	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.153779030 CET	49743	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.153801918 CET	443	49743	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.153814077 CET	49743	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.153819084 CET	443	49743	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.164069891 CET	49750	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.164113998 CET	443	49750	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.164199114 CET	49750	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.164330959 CET	49750	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.164345980 CET	443	49750	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.171412945 CET	443	49744	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.171485901 CET	443	49744	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.171567917 CET	49744	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.171653986 CET	49744	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.171672106 CET	443	49744	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.171684027 CET	49744	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.171690941 CET	443	49744	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.174052000 CET	49751	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.174166918 CET	443	49751	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.174256086 CET	49751	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.174432993 CET	49751	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.174463987 CET	443	49751	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.225421906 CET	443	49745	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.225490093 CET	443	49745	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.225572109 CET	49745	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.225780010 CET	49745	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.225780010 CET	49745	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.225804090 CET	443	49745	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.225816965 CET	443	49745	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.228496075 CET	49752	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.228533983 CET	443	49752	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.228609085 CET	49752	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.228765011 CET	49752	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.228773117 CET	443	49752	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.378463030 CET	443	49746	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.379039049 CET	49746	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.379070044 CET	443	49746	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.379579067 CET	49746	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.379584074 CET	443	49746	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.460519075 CET	49718	443	192.168.2.10	172.217.21.36
Nov 25, 2024 16:33:56.460546970 CET	443	49718	172.217.21.36	192.168.2.10
Nov 25, 2024 16:33:56.845458984 CET	443	49746	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.845629930 CET	443	49746	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.845715046 CET	49746	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.845802069 CET	49746	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.845823050 CET	443	49746	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.845834017 CET	49746	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.845839024 CET	443	49746	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.848726034 CET	49753	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.848802090 CET	443	49753	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:56.848876953 CET	49753	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.849051952 CET	49753	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:56.849070072 CET	443	49753	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:57.879468918 CET	443	49748	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:57.879914999 CET	49748	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:57.879951000 CET	443	49748	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:57.887063026 CET	49748	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:57.887074947 CET	443	49748	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:57.921222925 CET	443	49751	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:57.921776056 CET	49751	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:57.921817064 CET	443	49751	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:57.922317028 CET	49751	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:57.922326088 CET	443	49751	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.046145916 CET	443	49752	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.046700954 CET	49752	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.046734095 CET	443	49752	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.047141075 CET	49752	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.047144890 CET	443	49752	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.064234018 CET	443	49750	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.065530062 CET	49750	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.065551996 CET	443	49750	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.066215038 CET	49750	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.066219091 CET	443	49750	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.337728024 CET	443	49748	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.337789059 CET	443	49748	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.337966919 CET	49748	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.337999105 CET	49748	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.338015079 CET	443	49748	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.338027954 CET	49748	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.338032961 CET	443	49748	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.340727091 CET	49754	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.340769053 CET	443	49754	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.340871096 CET	49754	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.341007948 CET	49754	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.341015100 CET	443	49754	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.357002020 CET	443	49751	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.357045889 CET	443	49751	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.357218981 CET	49751	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.357266903 CET	49751	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.357266903 CET	49751	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.357290030 CET	443	49751	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.357305050 CET	443	49751	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.359612942 CET	49755	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.359663963 CET	443	49755	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.359755039 CET	49755	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.359909058 CET	49755	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.359921932 CET	443	49755	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.491405010 CET	443	49752	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.491472960 CET	443	49752	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.491693974 CET	49752	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.491729975 CET	49752	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.491744995 CET	443	49752	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.491755009 CET	49752	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.491760015 CET	443	49752	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.494565964 CET	49756	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.494612932 CET	443	49756	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.494719028 CET	49756	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.494882107 CET	49756	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.494893074 CET	443	49756	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.517491102 CET	443	49750	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.517544031 CET	443	49750	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.517613888 CET	49750	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.517849922 CET	49750	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.517865896 CET	443	49750	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.517877102 CET	49750	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.517882109 CET	443	49750	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.520620108 CET	49757	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.520682096 CET	443	49757	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.520766973 CET	49757	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.520966053 CET	49757	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.520979881 CET	443	49757	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.642499924 CET	443	49753	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.643156052 CET	49753	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.643201113 CET	443	49753	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:58.643703938 CET	49753	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:58.643713951 CET	443	49753	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:59.098028898 CET	443	49753	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:59.098140955 CET	443	49753	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:59.098335981 CET	49753	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:59.098385096 CET	49753	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:59.098385096 CET	49753	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:59.098409891 CET	443	49753	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:59.098423958 CET	443	49753	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:59.101216078 CET	49758	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:59.101248980 CET	443	49758	13.107.246.63	192.168.2.10
Nov 25, 2024 16:33:59.101349115 CET	49758	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:59.101536036 CET	49758	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:33:59.101547003 CET	443	49758	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.057670116 CET	443	49754	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.058244944 CET	49754	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.058268070 CET	443	49754	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.058701992 CET	49754	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.058706999 CET	443	49754	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.223014116 CET	443	49755	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.223843098 CET	49755	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.223896980 CET	443	49755	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.224280119 CET	49755	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.224287987 CET	443	49755	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.291716099 CET	443	49756	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.292351961 CET	49756	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.292373896 CET	443	49756	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.292790890 CET	49756	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.292798042 CET	443	49756	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.404048920 CET	443	49757	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.404681921 CET	49757	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.404716969 CET	443	49757	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.405250072 CET	49757	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.405263901 CET	443	49757	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.492898941 CET	443	49754	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.492968082 CET	443	49754	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.493022919 CET	49754	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.493201971 CET	49754	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.493221045 CET	443	49754	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.493233919 CET	49754	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.493240118 CET	443	49754	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.496120930 CET	49759	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.496164083 CET	443	49759	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.496257067 CET	49759	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.496396065 CET	49759	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.496408939 CET	443	49759	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.679728985 CET	443	49758	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.680327892 CET	49758	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.680351973 CET	443	49758	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.680800915 CET	49758	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.680805922 CET	443	49758	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.695413113 CET	443	49755	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.695472956 CET	443	49755	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.695542097 CET	49755	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.695782900 CET	49755	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.695810080 CET	443	49755	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.695825100 CET	49755	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.695832968 CET	443	49755	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.698534012 CET	49760	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.698575020 CET	443	49760	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.698831081 CET	49760	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.698831081 CET	49760	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.698859930 CET	443	49760	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.746840000 CET	443	49756	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.746901035 CET	443	49756	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.746969938 CET	49756	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.747159004 CET	49756	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.747178078 CET	443	49756	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.747194052 CET	49756	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.747199059 CET	443	49756	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.750066996 CET	49761	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.750118971 CET	443	49761	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.750375032 CET	49761	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.750375032 CET	49761	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.750417948 CET	443	49761	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.860518932 CET	443	49757	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.860586882 CET	443	49757	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.860718966 CET	49757	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.861062050 CET	49757	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.861087084 CET	443	49757	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.861103058 CET	49757	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.861109018 CET	443	49757	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.863841057 CET	49762	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.863888025 CET	443	49762	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:00.863976002 CET	49762	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.864111900 CET	49762	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:00.864120960 CET	443	49762	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:01.120687962 CET	443	49758	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:01.120791912 CET	443	49758	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:01.120882034 CET	49758	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:01.121088982 CET	49758	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:01.121102095 CET	443	49758	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:01.121120930 CET	49758	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:01.121125937 CET	443	49758	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:01.123675108 CET	49763	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:01.123718023 CET	443	49763	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:01.123981953 CET	49763	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:01.123981953 CET	49763	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:01.124017000 CET	443	49763	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.283184052 CET	443	49759	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.288685083 CET	49759	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.288717031 CET	443	49759	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.289443016 CET	49759	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.289450884 CET	443	49759	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.481785059 CET	443	49760	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.482333899 CET	49760	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.482362032 CET	443	49760	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.482795000 CET	49760	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.482800007 CET	443	49760	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.582765102 CET	443	49762	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.583235979 CET	49762	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.583250046 CET	443	49762	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.583894968 CET	49762	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.583900928 CET	443	49762	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.610173941 CET	443	49761	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.611001015 CET	49761	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.611027956 CET	443	49761	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.611995935 CET	49761	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.612024069 CET	443	49761	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.766587019 CET	443	49759	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.766659975 CET	443	49759	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.766766071 CET	49759	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.767103910 CET	49759	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.767122984 CET	443	49759	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.767133951 CET	49759	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.767139912 CET	443	49759	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.770458937 CET	49764	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.770498991 CET	443	49764	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.770606041 CET	49764	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.770797968 CET	49764	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.770811081 CET	443	49764	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.931245089 CET	443	49760	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.931322098 CET	443	49760	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.931384087 CET	49760	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.931555986 CET	49760	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.931576967 CET	443	49760	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.931587934 CET	49760	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.931592941 CET	443	49760	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.934505939 CET	49765	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.934556961 CET	443	49765	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.934650898 CET	49765	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.934817076 CET	49765	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.934835911 CET	443	49765	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.977020025 CET	443	49763	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.977591991 CET	49763	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.977617979 CET	443	49763	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:02.978113890 CET	49763	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:02.978121042 CET	443	49763	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.019087076 CET	443	49762	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.019179106 CET	443	49762	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.019263983 CET	49762	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.019531965 CET	49762	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.019552946 CET	443	49762	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.019565105 CET	49762	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.019571066 CET	443	49762	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.022535086 CET	49766	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.022591114 CET	443	49766	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.022694111 CET	49766	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.022852898 CET	49766	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.022866964 CET	443	49766	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.065140963 CET	443	49761	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.065227032 CET	443	49761	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.065337896 CET	49761	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.065735102 CET	49761	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.065735102 CET	49761	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.065756083 CET	443	49761	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.065766096 CET	443	49761	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.068942070 CET	49767	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.068994045 CET	443	49767	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.069082022 CET	49767	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.069307089 CET	49767	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.069325924 CET	443	49767	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.386740923 CET	80	49709	52.209.78.88	192.168.2.10
Nov 25, 2024 16:34:03.387069941 CET	49709	80	192.168.2.10	52.209.78.88
Nov 25, 2024 16:34:03.411627054 CET	80	49710	52.209.78.88	192.168.2.10
Nov 25, 2024 16:34:03.411711931 CET	49710	80	192.168.2.10	52.209.78.88
Nov 25, 2024 16:34:03.412086964 CET	49710	80	192.168.2.10	52.209.78.88
Nov 25, 2024 16:34:03.467005968 CET	49709	80	192.168.2.10	52.209.78.88
Nov 25, 2024 16:34:03.533236027 CET	80	49710	52.209.78.88	192.168.2.10
Nov 25, 2024 16:34:03.552911997 CET	443	49763	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.553004980 CET	443	49763	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.553060055 CET	49763	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.553313971 CET	49763	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.553334951 CET	443	49763	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.553347111 CET	49763	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.553354025 CET	443	49763	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.556437969 CET	49768	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.556472063 CET	443	49768	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.556561947 CET	49768	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.556781054 CET	49768	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:03.556791067 CET	443	49768	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:03.592185974 CET	80	49709	52.209.78.88	192.168.2.10
Nov 25, 2024 16:34:04.450139999 CET	49769	80	192.168.2.10	52.209.78.88
Nov 25, 2024 16:34:04.450334072 CET	49770	80	192.168.2.10	52.209.78.88
Nov 25, 2024 16:34:04.570337057 CET	80	49769	52.209.78.88	192.168.2.10
Nov 25, 2024 16:34:04.570355892 CET	80	49770	52.209.78.88	192.168.2.10
Nov 25, 2024 16:34:04.570491076 CET	49769	80	192.168.2.10	52.209.78.88
Nov 25, 2024 16:34:04.570712090 CET	49770	80	192.168.2.10	52.209.78.88
Nov 25, 2024 16:34:04.570712090 CET	49770	80	192.168.2.10	52.209.78.88
Nov 25, 2024 16:34:04.677948952 CET	443	49764	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:04.678766012 CET	49764	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:04.678782940 CET	443	49764	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:04.679228067 CET	49764	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:04.679234028 CET	443	49764	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:04.690979958 CET	80	49770	52.209.78.88	192.168.2.10
Nov 25, 2024 16:34:04.827203035 CET	443	49766	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:04.827409029 CET	443	49767	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:04.827912092 CET	49766	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:04.827931881 CET	443	49766	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:04.827980042 CET	49767	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:04.828027010 CET	443	49767	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:04.828588963 CET	49767	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:04.828596115 CET	443	49767	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:04.828620911 CET	49766	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:04.828627110 CET	443	49766	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:04.878462076 CET	443	49765	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:04.879195929 CET	49765	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:04.879255056 CET	443	49765	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:04.879657984 CET	49765	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:04.879664898 CET	443	49765	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.123203039 CET	443	49764	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.123277903 CET	443	49764	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.123343945 CET	49764	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.123593092 CET	49764	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.123609066 CET	443	49764	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.123626947 CET	49764	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.123631954 CET	443	49764	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.127476931 CET	49771	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.127573013 CET	443	49771	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.127681971 CET	49771	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.127950907 CET	49771	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.127989054 CET	443	49771	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.264645100 CET	443	49766	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.264710903 CET	443	49766	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.264815092 CET	49766	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.265085936 CET	49766	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.265104055 CET	443	49766	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.265115976 CET	49766	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.265120029 CET	443	49766	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.268253088 CET	443	49767	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.268309116 CET	443	49767	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.268369913 CET	49767	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.269454956 CET	49767	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.269506931 CET	443	49767	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.269539118 CET	49767	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.269555092 CET	443	49767	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.271596909 CET	49772	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.271641970 CET	443	49772	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.271704912 CET	49772	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.272152901 CET	49772	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.272166014 CET	443	49772	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.272985935 CET	49773	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.273030043 CET	443	49773	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.273098946 CET	49773	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.273207903 CET	49773	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.273220062 CET	443	49773	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.324670076 CET	443	49765	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.324728012 CET	443	49765	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.324837923 CET	49765	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.325092077 CET	49765	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.325117111 CET	443	49765	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.325154066 CET	49765	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.325166941 CET	443	49765	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.327862024 CET	49774	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.327899933 CET	443	49774	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.327992916 CET	49774	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.328116894 CET	49774	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.328125954 CET	443	49774	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.878576994 CET	443	49768	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.879307985 CET	49768	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.879348993 CET	443	49768	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:05.879755974 CET	49768	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:05.879761934 CET	443	49768	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:06.338879108 CET	443	49768	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:06.338998079 CET	443	49768	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:06.339082003 CET	49768	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:06.339323044 CET	49768	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:06.339344978 CET	443	49768	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:06.339359045 CET	49768	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:06.339365005 CET	443	49768	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:06.342724085 CET	49775	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:06.342786074 CET	443	49775	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:06.342880964 CET	49775	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:06.343132973 CET	49775	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:06.343147039 CET	443	49775	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:06.917270899 CET	443	49771	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:06.918023109 CET	49771	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:06.918056011 CET	443	49771	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:06.918472052 CET	49771	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:06.918477058 CET	443	49771	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.051186085 CET	443	49774	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.051866055 CET	49774	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.051909924 CET	443	49774	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.052310944 CET	49774	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.052319050 CET	443	49774	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.060750961 CET	443	49773	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.061156988 CET	49773	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.061184883 CET	443	49773	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.061311960 CET	443	49772	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.061532974 CET	49773	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.061537981 CET	443	49773	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.061692953 CET	49772	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.061708927 CET	443	49772	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.062345982 CET	49772	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.062350988 CET	443	49772	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.365144968 CET	443	49771	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.365223885 CET	443	49771	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.365386009 CET	49771	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.365643024 CET	49771	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.365695953 CET	443	49771	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.365726948 CET	49771	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.365742922 CET	443	49771	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.369043112 CET	49776	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.369112015 CET	443	49776	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.369257927 CET	49776	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.369453907 CET	49776	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.369481087 CET	443	49776	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.497195959 CET	443	49774	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.497266054 CET	443	49774	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.497369051 CET	49774	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.497740030 CET	49774	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.497754097 CET	443	49774	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.497766972 CET	49774	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.497773886 CET	443	49774	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.501214027 CET	49777	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.501255989 CET	443	49777	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.501367092 CET	49777	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.501656055 CET	49777	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.501668930 CET	443	49777	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.516984940 CET	443	49773	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.517148018 CET	443	49773	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.517280102 CET	49773	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.517859936 CET	49773	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.517859936 CET	49773	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.517884970 CET	443	49773	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.517894983 CET	443	49773	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.519051075 CET	443	49772	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.519117117 CET	443	49772	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.519191027 CET	49772	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.519443989 CET	49772	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.519459963 CET	443	49772	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.521470070 CET	49778	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.521563053 CET	443	49778	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.521739006 CET	49778	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.521869898 CET	49778	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.521889925 CET	443	49778	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.522051096 CET	49779	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.522092104 CET	443	49779	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:07.522161961 CET	49779	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.522378922 CET	49779	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:07.522389889 CET	443	49779	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:08.263662100 CET	443	49775	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:08.264338970 CET	49775	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:08.264369011 CET	443	49775	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:08.264794111 CET	49775	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:08.264800072 CET	443	49775	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:08.717083931 CET	443	49775	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:08.717161894 CET	443	49775	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:08.717288017 CET	49775	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:08.717536926 CET	49775	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:08.717554092 CET	443	49775	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:08.717566967 CET	49775	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:08.717572927 CET	443	49775	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:08.721096992 CET	49780	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:08.721122980 CET	443	49780	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:08.721199989 CET	49780	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:08.721580982 CET	49780	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:08.721591949 CET	443	49780	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.182828903 CET	443	49776	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.183499098 CET	49776	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.183535099 CET	443	49776	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.183979988 CET	49776	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.183985949 CET	443	49776	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.274919033 CET	443	49778	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.275567055 CET	49778	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.275604010 CET	443	49778	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.276041031 CET	49778	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.276048899 CET	443	49778	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.280917883 CET	443	49779	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.281312943 CET	49779	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.281333923 CET	443	49779	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.281676054 CET	49779	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.281680107 CET	443	49779	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.356101036 CET	443	49777	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.356745005 CET	49777	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.356764078 CET	443	49777	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.357214928 CET	49777	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.357223988 CET	443	49777	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.628134012 CET	443	49776	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.628220081 CET	443	49776	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.628272057 CET	49776	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.628412008 CET	49776	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.628438950 CET	443	49776	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.628456116 CET	49776	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.628463030 CET	443	49776	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.631406069 CET	49781	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.631443024 CET	443	49781	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.631546021 CET	49781	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.631716967 CET	49781	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.631733894 CET	443	49781	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.710083961 CET	443	49778	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.710156918 CET	443	49778	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.710216045 CET	49778	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.710387945 CET	49778	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.710414886 CET	443	49778	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.710433006 CET	49778	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.710439920 CET	443	49778	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.713474035 CET	49782	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.713515997 CET	443	49782	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.713592052 CET	49782	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.713761091 CET	49782	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.713771105 CET	443	49782	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.716476917 CET	443	49779	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.716550112 CET	443	49779	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.716603041 CET	49779	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.716737986 CET	49779	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.716756105 CET	443	49779	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.716768980 CET	49779	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.716773987 CET	443	49779	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.719082117 CET	49783	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.719106913 CET	443	49783	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.719172955 CET	49783	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.719316959 CET	49783	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.719326019 CET	443	49783	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.813433886 CET	443	49777	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.813508987 CET	443	49777	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.813555956 CET	49777	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.814039946 CET	49777	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.814055920 CET	443	49777	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.816495895 CET	49784	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.816543102 CET	443	49784	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:09.816617012 CET	49784	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.816747904 CET	49784	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:09.816756964 CET	443	49784	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:10.510531902 CET	443	49780	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:10.516252995 CET	49780	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:10.516274929 CET	443	49780	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:10.516879082 CET	49780	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:10.516885042 CET	443	49780	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:10.955805063 CET	443	49780	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:10.955878019 CET	443	49780	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:10.955971956 CET	49780	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:10.956192017 CET	49780	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:10.956192017 CET	49780	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:10.956212997 CET	443	49780	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:10.956223965 CET	443	49780	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:10.959199905 CET	49785	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:10.959256887 CET	443	49785	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:10.959343910 CET	49785	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:10.959506989 CET	49785	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:10.959518909 CET	443	49785	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.431431055 CET	443	49782	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.432010889 CET	49782	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.432051897 CET	443	49782	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.432507038 CET	49782	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.432518959 CET	443	49782	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.462132931 CET	443	49784	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.463246107 CET	49784	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.463278055 CET	443	49784	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.463354111 CET	49784	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.463361025 CET	443	49784	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.483942032 CET	443	49781	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.484435081 CET	49781	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.484458923 CET	443	49781	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.484886885 CET	49781	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.484894037 CET	443	49781	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.508078098 CET	443	49783	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.508655071 CET	49783	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.508671999 CET	443	49783	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.509134054 CET	49783	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.509138107 CET	443	49783	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.867737055 CET	443	49782	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.867918968 CET	443	49782	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.867981911 CET	49782	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.868079901 CET	49782	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.868099928 CET	443	49782	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.868113041 CET	49782	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.868119001 CET	443	49782	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.870965004 CET	49786	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.870999098 CET	443	49786	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.871093035 CET	49786	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.871306896 CET	49786	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.871325016 CET	443	49786	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.916045904 CET	443	49784	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.916122913 CET	443	49784	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.916188002 CET	49784	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.916399002 CET	49784	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.916399002 CET	49784	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.916424036 CET	443	49784	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.916435957 CET	443	49784	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.919334888 CET	49787	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.919375896 CET	443	49787	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.919459105 CET	49787	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.919636011 CET	49787	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.919647932 CET	443	49787	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.937489986 CET	443	49781	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.937700033 CET	443	49781	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.937778950 CET	49781	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.937836885 CET	49781	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.937836885 CET	49781	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.937860966 CET	443	49781	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.937877893 CET	443	49781	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.940956116 CET	49788	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.941054106 CET	443	49788	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.941154003 CET	49788	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.941266060 CET	49788	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.941288948 CET	443	49788	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.956448078 CET	443	49783	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.956526995 CET	443	49783	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.956585884 CET	49783	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.956823111 CET	49783	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.956840038 CET	443	49783	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.956850052 CET	49783	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.956856012 CET	443	49783	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.959404945 CET	49789	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.959445000 CET	443	49789	13.107.246.63	192.168.2.10
Nov 25, 2024 16:34:11.959526062 CET	49789	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.959700108 CET	49789	443	192.168.2.10	13.107.246.63
Nov 25, 2024 16:34:11.959712982 CET	443	49789	13.107.246.63	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 16:33:40.311367035 CET	53	59304	1.1.1.1	192.168.2.10
Nov 25, 2024 16:33:40.311753988 CET	53	59927	1.1.1.1	192.168.2.10
Nov 25, 2024 16:33:43.127629042 CET	53	62785	1.1.1.1	192.168.2.10
Nov 25, 2024 16:33:44.479094982 CET	59726	53	192.168.2.10	1.1.1.1
Nov 25, 2024 16:33:44.479685068 CET	63919	53	192.168.2.10	1.1.1.1
Nov 25, 2024 16:33:44.616852045 CET	53	59726	1.1.1.1	192.168.2.10
Nov 25, 2024 16:33:44.617614031 CET	53	63919	1.1.1.1	192.168.2.10
Nov 25, 2024 16:34:00.142409086 CET	53	57066	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 16:33:44.479094982 CET	192.168.2.10	1.1.1.1	0xb9e6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:33:44.479685068 CET	192.168.2.10	1.1.1.1	0xf6ad	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 16:33:44.616852045 CET	1.1.1.1	192.168.2.10	0xb9e6	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:33:44.617614031 CET	1.1.1.1	192.168.2.10	0xf6ad	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.azureedge.net

fs.microsoft.com

52.209.78.88

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49710	52.209.78.88	80	4892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 16:33:41.465878010 CET	442	OUT	GET /raphael_data_v8 HTTP/1.1 Host: 52.209.78.88 Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49770	52.209.78.88	80	4892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 16:34:04.570712090 CET	468	OUT	GET /raphael_data_v8 HTTP/1.1 Host: 52.209.78.88 Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.10	49703	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:41 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:41 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:41 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 23 Nov 2024 12:15:37 GMT ETag: "0x8DD0BB889D4282C" x-ms-request-id: 19b35b80-c01e-0049-150a-3eac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153341Z-174c587ffdf89smkhC1TEB697s000000063000000000v1m4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:41 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-25 15:33:41 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-25 15:33:41 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-25 15:33:41 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-25 15:33:41 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-25 15:33:42 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-25 15:33:42 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-25 15:33:42 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-25 15:33:42 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-25 15:33:42 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.10	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:44 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:44 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153344Z-174c587ffdfp4vpjhC1TEBybqw000000064g00000000cb66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:44 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.10	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:44 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:44 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:44 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 2bdd5943-e01e-0052-493a-3dd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153344Z-178bfbc474brk967hC1NYCfu6000000007bg00000000p3db x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:44 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.10	49712	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:44 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:44 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:44 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8db92378-201e-003f-2cbf-3e6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153344Z-178bfbc474bpscmfhC1NYCfc2c000000064g00000000rz75 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:44 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.10	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:44 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:44 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4a9b7938-301e-000c-7880-3d323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153344Z-174c587ffdf9xbcchC1TEBxkz400000006200000000043rm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:44 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.10	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:44 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:44 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:44 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1c744767-001e-0082-6060-3b5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153344Z-178bfbc474bbbqrhhC1NYCvw7400000007vg0000000070g6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:44 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.10	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:46 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:46 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: ce5ebd39-a01e-0053-183c-3c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153346Z-15b8b599d882zv28hC1TEBdchn000000063g000000003t9w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:46 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.10	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:46 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:46 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 02a2c6fa-b01e-0001-107b-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153346Z-178bfbc474b9fdhphC1NYCac0n00000007k000000000fw2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:46 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.10	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:46 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:46 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 3257c6a6-201e-005d-32b4-3eafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153346Z-178bfbc474bpnd5vhC1NYC4vr400000007qg00000000739a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:47 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.10	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:46 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:46 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 51fbd25c-e01e-0020-5e4d-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153346Z-15b8b599d88wn9hhhC1TEBry0g000000062g00000000q2ta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:47 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.10	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:46 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:47 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 4860472f-101e-0028-01d0-3e8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153347Z-178bfbc474b9fdhphC1NYCac0n00000007ng0000000073gf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:47 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49724	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:46 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 15:33:47 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=64785 Date: Mon, 25 Nov 2024 15:33:46 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	49730	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:48 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 15:33:49 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=64761 Date: Mon, 25 Nov 2024 15:33:48 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-25 15:33:49 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.10	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:48 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:48 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 5fd12e2e-e01e-0051-1fc8-3e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153348Z-178bfbc474bwh9gmhC1NYCy3rs00000007v000000000072f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:49 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.10	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:48 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:49 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: c38a0343-101e-008e-38bf-3ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153349Z-178bfbc474bp8mkvhC1NYCzqnn00000007gg00000000ayp9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:49 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.10	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:48 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:49 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 01b16b08-801e-0078-0fad-3ebac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153349Z-15b8b599d88hd9g7hC1TEBp75c000000066g0000000015ny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:49 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.10	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:48 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:49 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153349Z-178bfbc474bpscmfhC1NYCfc2c000000069g000000006mxg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:49 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.10	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:50 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:51 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: d02e2b11-101e-00a2-2d3a-3c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153351Z-178bfbc474bxkclvhC1NYC69g400000007h000000000htk1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:51 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.10	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:50 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:51 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 21648528-e01e-003c-794e-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153351Z-178bfbc474bscnbchC1NYCe7eg00000007rg00000000my39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:51 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.10	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:51 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:51 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 4834b854-301e-005d-3ab8-3ee448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153351Z-15b8b599d88n8stkhC1TEBb78n00000000wg00000000pme4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:51 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.10	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:51 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:51 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 190bcf01-801e-0078-3650-3cbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153351Z-15b8b599d882zv28hC1TEBdchn00000005z000000000ha5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:51 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.10	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:51 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:52 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: b101f067-f01e-0020-26b7-3e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153352Z-178bfbc474brk967hC1NYCfu6000000007f000000000bcnb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:52 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.10	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:53 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:53 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 44e9982d-301e-001f-6639-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153353Z-15b8b599d88hd9g7hC1TEBp75c000000060000000000p6mq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:53 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.10	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:53 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:53 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: feb62e3a-f01e-0085-1d2f-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153353Z-178bfbc474btvfdfhC1NYCa2en00000007tg0000000057q1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:53 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.10	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:53 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 2b92647c-c01e-00a2-646f-3b2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153353Z-174c587ffdf7t49mhC1TEB4qbg000000060g00000000hv6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.10	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:53 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:53 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4ec414f5-001e-0046-5fa0-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153353Z-174c587ffdfl22mzhC1TEBk40c000000067g00000000mbf7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:53 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.10	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:54 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:54 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153354Z-174c587ffdf9xbcchC1TEBxkz400000005yg00000000gvzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:54 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.10	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:55 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:55 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: a72cf994-301e-0099-6e45-3c6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153355Z-15b8b599d88l2dpthC1TEBmzr00000000660000000001sa6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:55 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.10	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:55 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:55 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153355Z-174c587ffdfdwxdvhC1TEB1c4n000000063g000000006mxk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:56 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.10	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:55 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:56 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 47ff93a4-401e-0083-0f5d-3e075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153356Z-15b8b599d882l6clhC1TEBxd5c00000005xg00000000p9cs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:56 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.10	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:55 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:56 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 9053a11e-c01e-0046-640f-3d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153356Z-15b8b599d88f9wfchC1TEBm2kc000000069g000000007mr3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:56 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.10	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:56 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:56 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: e1811c2a-201e-00aa-06c6-3e3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153356Z-178bfbc474brk967hC1NYCfu6000000007e000000000es7g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:56 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.10	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:57 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:58 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 52ac3eb7-c01e-0079-7e4e-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153358Z-15b8b599d88pxmdghC1TEBux9c000000069g000000007ebw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:58 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.10	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:57 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:58 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 413a5bf0-401e-0035-1ab5-3e82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153358Z-178bfbc474bbbqrhhC1NYCvw7400000007tg00000000ewq9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:58 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.10	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:58 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:58 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c86812d3-d01e-005a-35c0-3e7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153358Z-178bfbc474b9fdhphC1NYCac0n00000007gg00000000mewm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:58 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.10	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:58 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:58 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: df8835e2-601e-0002-5b4e-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153358Z-15b8b599d88vp97chC1TEB5pzw000000064g000000008r7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:58 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.10	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:33:58 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:33:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:33:58 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 93df3597-c01e-00a2-2d50-3e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153358Z-15b8b599d88cn5thhC1TEBqxkn00000005yg00000000mamt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:33:59 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.10	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:00 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:00 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 043e45ca-501e-0078-1031-3e06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153400Z-178bfbc474b9fdhphC1NYCac0n00000007ng000000007464 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:00 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.10	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:00 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:00 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 962f41f4-301e-0052-17bf-3e65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153400Z-15b8b599d88f9wfchC1TEBm2kc000000065g00000000mt1q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:00 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.10	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:00 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:00 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 6056d4b9-d01e-002b-71bf-3e25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153400Z-178bfbc474bv587zhC1NYCny5w00000007gg00000000ext7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:00 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.10	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:00 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:00 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 414c800a-401e-0035-7cbf-3e82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153400Z-178bfbc474bfw4gbhC1NYCunf400000007qg000000008utp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:00 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.10	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:00 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:00 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 792329fd-401e-0035-1f6c-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153400Z-178bfbc474bmqmgjhC1NYCy16c00000007v0000000000gbh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:01 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.10	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:02 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:02 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: c4b984cf-b01e-001e-2446-3c0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153402Z-15b8b599d88cn5thhC1TEBqxkn000000061000000000azyg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:02 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.10	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:02 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:02 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 97f3364e-001e-00a2-6ca6-3ed4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153402Z-178bfbc474btvfdfhC1NYCa2en00000007r000000000drg7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:02 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.10	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:02 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:02 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 8a9c0054-c01e-0046-231b-3e2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153402Z-178bfbc474bwlrhlhC1NYCy3kg00000007r00000000068vb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:03 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.10	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:02 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:02 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 974535d3-001e-002b-30bf-3e99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153402Z-178bfbc474bw8bwphC1NYC38b400000007bg00000000s3pr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:03 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.10	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:02 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:03 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: af6ae163-c01e-0082-6735-3caf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153403Z-178bfbc474bwh9gmhC1NYCy3rs00000007qg00000000gqvb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:03 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.10	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:04 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:04 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 15b7cf09-401e-0047-4de4-3e8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153404Z-174c587ffdfdwxdvhC1TEB1c4n000000063g000000006nff x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:05 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.10	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:04 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:05 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 732016c8-001e-000b-7fb8-3e15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153405Z-178bfbc474bv587zhC1NYCny5w00000007k00000000096c4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:05 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.10	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:04 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:05 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: e4abb831-101e-0046-01ea-3d91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153405Z-15b8b599d88pxmdghC1TEBux9c00000006bg000000001166 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:05 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.10	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:04 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:05 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: af3fdc2c-601e-00ab-2e0c-3f66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153405Z-15b8b599d889gj5whC1TEBfyk000000005y000000000f4kv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:05 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.10	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:05 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 3074f9d5-701e-001e-47fc-3df5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153406Z-178bfbc474bnwsh4hC1NYC2ubs00000007pg00000000kzr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.10	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:06 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 40c83c0a-001e-00ad-1e79-3b554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153407Z-174c587ffdftjz9shC1TEBsh980000000620000000003wm8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.10	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:07 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 1e280d2f-401e-0029-0d7f-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153407Z-174c587ffdf8fcgwhC1TEBnn70000000069000000000feqv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.10	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:07 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2309915e-d01e-0014-6179-3eed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153407Z-15b8b599d88n8stkhC1TEBb78n00000000x000000000mr2k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 15:34:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.10	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:07 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: b8b6ef80-e01e-0051-723f-3e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153407Z-15b8b599d88cn5thhC1TEBqxkn0000000620000000007atd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.10	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:08 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 482df903-301e-005d-4bb5-3ee448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153408Z-178bfbc474bp8mkvhC1NYCzqnn00000007cg00000000r6nf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.10	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:09 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:09 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 753d71cc-101e-0065-41b6-3e4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153409Z-178bfbc474bmqmgjhC1NYCy16c00000007s000000000ay8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:09 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.10	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:09 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:09 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 19a81fd9-501e-0078-66bc-3b06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153409Z-15b8b599d88hd9g7hC1TEBp75c000000061000000000mhqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:09 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.10	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:09 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:09 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: dea688b9-b01e-003d-136c-3dd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153409Z-15b8b599d88g5tp8hC1TEByx6w000000063000000000deg1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:09 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.10	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:09 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:09 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c63dd3a8-001e-0017-61d8-3d0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153409Z-178bfbc474bwlrhlhC1NYCy3kg00000007hg00000000skgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:09 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.10	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:10 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: ea7a0cbc-701e-001e-589c-3ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153410Z-178bfbc474bwh9gmhC1NYCy3rs00000007t0000000007dtd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.10	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:11 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:11 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 0ecd932e-001e-0066-5d4b-3c561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153411Z-15b8b599d88hr8sfhC1TEBbca40000000620000000007049 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:11 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.10	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:11 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:11 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 8d96ff29-301e-0020-36b1-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153411Z-15b8b599d88wn9hhhC1TEBry0g000000062g00000000q4ch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:11 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.10	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:11 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:11 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 2151d667-701e-0021-3e0f-3d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153411Z-178bfbc474bbcwv4hC1NYCypys00000007kg000000005h6u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:11 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.10	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:11 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:11 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: d8899c23-b01e-003e-234e-3c8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153411Z-15b8b599d882l6clhC1TEBxd5c00000006300000000057x4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:11 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.10	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:12 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:13 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 47b859ea-401e-0083-4640-3e075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153413Z-15b8b599d889fz52hC1TEB59as000000061g00000000m25v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:13 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.10	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:13 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:34:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:34:13 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T153413Z-174c587ffdf4zw2thC1TEBu340000000062000000000z84d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:34:14 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.10	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:13 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.10	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:13 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.10	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:34:13 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 4848, Parent PID: 3992

General

Target ID:	0
Start time:	10:33:32
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6c5c30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 4892, Parent PID: 4848

General

Target ID:	4
Start time:	10:33:38
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2012,i,5949725106249625321,7293182894652153858,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c5c30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6396, Parent PID: 3992

General

Target ID:	9
Start time:	10:33:40
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://52.209.78.88/raphael_data_v8"
Imagebase:	0x7ff655930000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://52.209.78.88/raphael_data_v8

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 4848, Parent PID: 3992

General

Chronological Activities

Analysis Process: chrome.exePID: 4892, Parent PID: 4848

General

Chronological Activities

Windows Analysis Report
http://52.209.78.88/raphael_data_v8