Edit tour

Windows Analysis Report
https://c219111adfa947eeab6af09dce063831.svc.dynamics.com/t/t/ztXJZMj9rZ8iYS3npIzRkXSAIA5ADBvD3N1VaHd5qBcx/JiMNNsNZGlecgfVUxFYeQjS0MvF0EESkB89ns4tVPv8x

Overview

General Information

Sample URL:	https://c219111adfa947eeab6af09dce063831.svc.dynamics.com/t/t/ztXJZMj9rZ8iYS3npIzRkXSAIA5ADBvD3N1VaHd5qBcx/JiMNNsNZGlecgfVUxFYeQjS0MvF0EESkB89ns4tVPv8x
Analysis ID:	1562872
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2136 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2036,i,1867157703621612913,8993123151590466767,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6384 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://c219111adfa947eeab6af09dce063831.svc.dynamics.com/t/t/ztXJZMj9rZ8iYS3npIzRkXSAIA5ADBvD3N1VaHd5qBcx/JiMNNsNZGlecgfVUxFYeQjS0MvF0EESkB89ns4tVPv8x" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://c219111adfa947eeab6af09dce063831.svc.dynamics.com/t/t/ztXJZMj9rZ8iYS3npIzRkXSAIA5ADBvD3N1VaHd5qBcx/JiMNNsNZGlecgfVUxFYeQjS0MvF0EESkB89ns4tVPv8x

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49770 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 69.192.160.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kKcg+DVNDBsFEkK&MD=FpkWMFgD HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kKcg+DVNDBsFEkK&MD=FpkWMFgD HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: c219111adfa947eeab6af09dce063831.svc.dynamics.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: assets.onestore.ms
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com
Source: global traffic	DNS traffic detected: DNS query: c.s-microsoft.com

Source: chromecache_60.2.dr, chromecache_68.2.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: chromecache_58.2.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_58.2.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Source: chromecache_58.2.dr	String found in binary or memory: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c
Source: chromecache_58.2.dr	String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: chromecache_58.2.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: chromecache_58.2.dr	String found in binary or memory: https://onedrive.live.com/about/en-us/
Source: chromecache_58.2.dr	String found in binary or memory: https://outlook.live.com/owa/
Source: chromecache_58.2.dr	String found in binary or memory: https://products.office.com/en-us/home
Source: chromecache_58.2.dr	String found in binary or memory: https://products.office.com/en-us/microsoft-teams/free?icid=SSM_AS_Promo_Apps_MicrosoftTeams
Source: chromecache_58.2.dr	String found in binary or memory: https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7
Source: chromecache_58.2.dr	String found in binary or memory: https://www.onenote.com/
Source: chromecache_58.2.dr	String found in binary or memory: https://www.skype.com/en/
Source: chromecache_58.2.dr	String found in binary or memory: https://www.xbox.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.192.160.109:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49770 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@17/30@14/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2036,i,1867157703621612913,8993123151590466767,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://c219111adfa947eeab6af09dce063831.svc.dynamics.com/t/t/ztXJZMj9rZ8iYS3npIzRkXSAIA5ADBvD3N1VaHd5qBcx/JiMNNsNZGlecgfVUxFYeQjS0MvF0EESkB89ns4tVPv8x"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2036,i,1867157703621612913,8993123151590466767,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://c219111adfa947eeab6af09dce063831.svc.dynamics.com/t/t/ztXJZMj9rZ8iYS3npIzRkXSAIA5ADBvD3N1VaHd5qBcx/JiMNNsNZGlecgfVUxFYeQjS0MvF0EESkB89ns4tVPv8x	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.181.100	true	false	high
c.s-microsoft.com	unknown	unknown	false	high
c219111adfa947eeab6af09dce063831.svc.dynamics.com	unknown	unknown	false	high
assets.onestore.ms	unknown	unknown	false	high
ajax.aspnetcdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://c219111adfa947eeab6af09dce063831.svc.dynamics.com/t/t/ztXJZMj9rZ8iYS3npIzRkXSAIA5ADBvD3N1VaHd5qBcx/JiMNNsNZGlecgfVUxFYeQjS0MvF0EESkB89ns4tVPv8x	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://onedrive.live.com/about/en-us/	chromecache_58.2.dr	false	high
https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c	chromecache_58.2.dr	false	high
https://outlook.live.com/owa/	chromecache_58.2.dr	false	high
https://products.office.com/en-us/microsoft-teams/free?icid=SSM_AS_Promo_Apps_MicrosoftTeams	chromecache_58.2.dr	false	high
https://www.onenote.com/	chromecache_58.2.dr	false	high
https://www.xbox.com/	chromecache_58.2.dr	false	high
http://schema.org/Organization	chromecache_58.2.dr	false	high
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js	chromecache_58.2.dr	false	high
http://github.com/requirejs/almond/LICENSE	chromecache_60.2.dr, chromecache_68.2.dr	false	high
https://www.skype.com/en/	chromecache_58.2.dr	false	high
https://products.office.com/en-us/home	chromecache_58.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.181.100	www.google.com	United States		15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false

Private

IP
192.168.2.4
192.168.2.10

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562872
Start date and time:	2024-11-26 08:14:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://c219111adfa947eeab6af09dce063831.svc.dynamics.com/t/t/ztXJZMj9rZ8iYS3npIzRkXSAIA5ADBvD3N1VaHd5qBcx/JiMNNsNZGlecgfVUxFYeQjS0MvF0EESkB89ns4tVPv8x
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@17/30@14/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.19.238, 74.125.205.84, 52.183.87.159, 34.104.35.123, 152.199.19.161, 2.20.41.218, 152.199.19.160, 23.32.239.81, 2.19.198.33, 23.217.249.187, 93.184.221.240, 23.32.239.43, 23.32.239.59, 69.192.161.161, 192.229.221.95, 172.217.17.35
Excluded domains from analysis (whitelisted): mktsvcp102wu001.westus2.cloudapp.azure.com, assets.onestore.ms.edgekey.net, slscr.update.microsoft.com, e13678.dscb.akamaiedge.net, clientservices.googleapis.com, a1449.dscg2.akamai.net, www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net, www.microsoft.com-c-3.edgekey.net, clients2.google.com, mscomajax.vo.msecnd.net, ocsp.digicert.com, update.googleapis.com, img-prod-cms-rt-microsoft-com.akamaized.net, mktdplp102cdn.azureedge.net, a1778.g2.akamai.net, e10583.dspg.akamaiedge.net, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, cs22.wpc.v0cdn.net, mktdplp102cdn.ec.azureedge.net, ctldl.windowsupdate.com, statics-marketingsites-wcus-ms-com.akamaized.net, assets.onestore.ms.akadns.net, fe3cr.delivery.mp.microsoft.com, c-s.cms.ms.akadns.net, edgedl.me.gvt1.com, c.s-microsoft.com-c.edgekey.net, e13678.dscg.akamaiedge.net, clients.l.google.com, az725175.vo.msecnd.net, www.microsoft.com, cs9.wpc.v0cdn.net
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: https://c219111adfa947eeab6af09dce063831.svc.dynamics.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": true, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://c219111adfa947eeab6af09dce063831.svc.dynamics.com
URL: https://www.microsoft.com/#msdynttrid=JgmbvduWIG4j8omIo6XFRaL-w0xPZnNzUwZfg-uRcIU Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:", "prominent_button_name": "United States English Microsoft Homepage", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false }

URL: https://www.microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://www.microsoft.com
URL: https://www.microsoft.com/#msdynttrid=JgmbvduWIG4j8omIo6XFRaL-w0xPZnNzUwZfg-uRcIU Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:", "prominent_button_name": "United States English Microsoft Homepage", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://www.microsoft.com/#msdynttrid=JgmbvduWIG4j8omIo6XFRaL-w0xPZnNzUwZfg-uRcIU Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://www.microsoft.com/#msdynttrid=JgmbvduWIG4j8omIo6XFRaL-w0xPZnNzUwZfg-uRcIU Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (19601), with CRLF line terminators
Category:	downloaded
Size (bytes):	29275
Entropy (8bit):	5.777359610935254
Encrypted:	false
SSDEEP:	768:XI9CoyzrYRqwdS1Zc5OH9rsATMheTA7cp3ELcadt:XPzE42cyWELD
MD5:	629FB69A45E4E0C36FD741FBDE32CB09
SHA1:	5F194B5D54B012872469AB3173D55C188D101858
SHA-256:	84EACF3F43BF7B9177FB78C533F34C3930CD517DA0295BFD57BD5E01B2400ED8
SHA-512:	840988E321A4E08081FD33233A0C33138BC2D4E2B767DE1566FC4CEF29BDE9AEA0685AF24081103FC760B396AC76196068E5636B93B91A344F6210759BD63631
Malicious:	false
Reputation:	low
URL:	https://mktdplp102cdn.azureedge.net/public/latest/js/bot-detection.js?v=1.84.2007
Preview:	/* UAParser.js v1.0.2.. Copyright . 2012-2021 Faisal Salman <f@faisalman.com>.. MIT License */..(function(window,undefined){"use strict";var LIBVERSION="1.0.2",EMPTY="",UNKNOWN="?",FUNC_TYPE="function",UNDEF_TYPE="undefined",OBJ_TYPE="object",STR_TYPE="string",MAJOR="major",MODEL="model",NAME="name",TYPE="type",VENDOR="vendor",VERSION="version",ARCHITECTURE="architecture",CONSOLE="console",MOBILE="mobile",TABLET="tablet",SMARTTV="smarttv",WEARABLE="wearable",EMBEDDED="embedded",UA_MAX_LENGTH=255;var AMAZON="Amazon",APPLE="Apple",ASUS="ASUS",BLACKBERRY="BlackBerry",BROWSER="Browser",CHROME="Chrome",EDGE="Edge",FIREFOX="Firefox",GOOGLE="Google",HUAWEI="Huawei",LG="LG",MICROSOFT="Microsoft",MOTOROLA="Motorola",OPERA="Opera",SAMSUNG="Samsung",SONY="Sony",XIAOMI="Xiaomi",ZEBRA="Zebra",FACEBOOK="Facebook";var extend=function(regexes,extensions){var mergedRegexes={};for(var i in regexes){if(extensions[i]&&extensions[i].length%2===0){mergedRegexes[i]=extensions[i].concat(regexes[i])}else{

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (513), with no line terminators
Category:	downloaded
Size (bytes):	513
Entropy (8bit):	5.350826451115093
Encrypted:	false
SSDEEP:	12:D0rdkqmKlO30kMWznLPQspwlZpqBijDgrgLCpWRG3a0:exmwOkkMWIvv4ELsWUp
MD5:	602C381194795DFC124FACDF48492EF1
SHA1:	90D594B7B5AF217824F2974514548C95FECFBFA5
SHA-256:	BF450798FB52E2458A1E10749577E5334F3E1D7907A47FDFEA5430CB71FA19E6
SHA-512:	8837F6BD2A11387D31A866D07B66A0FF2E58D2EDC2682A582919A1896CE9B4CB683A795D91968B41FA46C31CE62D34414E1F3318D4F5DDA2999447F4BCA6133D
Malicious:	false
Reputation:	low
URL:	https://c.s-microsoft.com/en-us/CMSScripts/script.jsx?k=f65ecb70-094d-0b11-7c9d-7da1bcadfaa7
Preview:	var jsllConfig={useDefaultContentName:!0,syncMuid:!0,authMethod:AUTHMETHOD,isLoggedIn:ISLOGGEDIN===undefined\|\|ISLOGGEDIN!=="True"?!1:!0,muidDomain:MUIDDOMAIN\|\|"microsoft.com",useShortNameForContentBlob:!1,autoCapture:{pageView:!0,onLoad:!0,onUnload:!0,click:!0,scroll:!0,resize:!0,lineage:!0,jsError:!0,addin:!0,perf:!0},coreData:{appId:JSLLAPPID,market:LOCALE,pageName:PAGENAME,pageType:PAYLOADTYPE,referrerUri:document.referrer,requestUri:window.location.href},callback:{pageName:PAGENAME}};awa.init(jsllConfig)

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (955), with CRLF line terminators
Category:	downloaded
Size (bytes):	201253
Entropy (8bit):	2.661810841903416
Encrypted:	false
SSDEEP:	768:W7nJSq9GinOo20uqxjr3+AKyKEAPNPPn8P9R/3htzAVT+JcYY5WRItsWc7rQ3S01:WHGiOoHuOjr3+AKyKAXS
MD5:	85DE642E1467807F64F7E10807DF3869
SHA1:	C795B490811C0E5A1A8F3C3F620AAB9F00C34F07
SHA-256:	5965B2C5472AACA1CD66EA5B0D07A971B961FEE72FC27EB1F6C760042084B21B
SHA-512:	BF4EC56D6FC54EAAFBD57C4E4D06900D358E39CE15009FB983491B0A83ABB60A0A54F46BE86387AB837B4AE1D1F3FF99156D04207065B0F65F165B54CFAAF47B
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/
Preview:	..<!DOCTYPE html><html xmlns:mscom="http://schemas.microsoft.com/CMSvNext".. xmlns:md="http://schemas.microsoft.com/mscom-data" lang="en-us".. xmlns="http://www.w3.org/1999/xhtml"><head><link rel="shortcut icon".. href="//www.microsoft.com/favicon.ico?v2" /><link.. type="text/css" rel="stylesheet".. href="https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.css".. /><title>Your request has been blocked. This could be.. due to several reasons.</title><meta name="Title".. content="We are sorry, the page you requested cannot be.. found" /><meta name="CorrelationVector".. content="VbLZYbRlhU2hyedN.1" /><meta name="Description".. content="" /><meta name="MscomContentLocale".. content="en-us" /><meta name="

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (513), with no line terminators
Category:	dropped
Size (bytes):	513
Entropy (8bit):	5.350826451115093
Encrypted:	false
SSDEEP:	12:D0rdkqmKlO30kMWznLPQspwlZpqBijDgrgLCpWRG3a0:exmwOkkMWIvv4ELsWUp
MD5:	602C381194795DFC124FACDF48492EF1
SHA1:	90D594B7B5AF217824F2974514548C95FECFBFA5
SHA-256:	BF450798FB52E2458A1E10749577E5334F3E1D7907A47FDFEA5430CB71FA19E6
SHA-512:	8837F6BD2A11387D31A866D07B66A0FF2E58D2EDC2682A582919A1896CE9B4CB683A795D91968B41FA46C31CE62D34414E1F3318D4F5DDA2999447F4BCA6133D
Malicious:	false
Reputation:	low
Preview:	var jsllConfig={useDefaultContentName:!0,syncMuid:!0,authMethod:AUTHMETHOD,isLoggedIn:ISLOGGEDIN===undefined\|\|ISLOGGEDIN!=="True"?!1:!0,muidDomain:MUIDDOMAIN\|\|"microsoft.com",useShortNameForContentBlob:!1,autoCapture:{pageView:!0,onLoad:!0,onUnload:!0,click:!0,scroll:!0,resize:!0,lineage:!0,jsError:!0,addin:!0,perf:!0},coreData:{appId:JSLLAPPID,market:LOCALE,pageName:PAGENAME,pageType:PAYLOADTYPE,referrerUri:document.referrer,requestUri:window.location.href},callback:{pageName:PAGENAME}};awa.init(jsllConfig)

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (41651)
Category:	dropped
Size (bytes):	131537
Entropy (8bit):	5.2237799798561975
Encrypted:	false
SSDEEP:	3072:1f/HuF3CpxEIqQ0/9d1EwgXAnKxnKKviV:1f/HuZ1ILGV
MD5:	30B7C335C62E5269E2D35B8E8B9F44B4
SHA1:	C6D92B1516EB8F6D44AAF171FB24A1B2AADD0C4C
SHA-256:	10733A5D876108F81C5F78EEE5C9760A739D89C52FA6180C4290B7F909F24346
SHA-512:	5BCE247C84C88F993A857CE2F1E8540C648672DEB6D92A55BC808C33394B784C52866D635BEC8B7CD5E62A7EA4109569AC8BCD1381571B84592ACD6C5901D7A8
Malicious:	false
Reputation:	low
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (574), with no line terminators
Category:	downloaded
Size (bytes):	574
Entropy (8bit):	5.481735991986907
Encrypted:	false
SSDEEP:	12:kxVkMqGDGahIrMxSaWaFDGahIrlR8rChIrpSUVHx4VI:kHkMqG/jWaF/NrCgR4VI
MD5:	3BE78F17BC7CC23C0AB1CB14FAF90934
SHA1:	04229C9C7B9274EAE13F961EAFD48B66EB83C146
SHA-256:	14A0C5C0F293D1A6615AE1BE03CAF8EECD6C6C428415DE60AA3AF9973048A99E
SHA-512:	8B1854014CAD3E8B6C8DB0F9325D06CF99E3B45D6E4872816C76459F50EB4F44C043123EDE2DC105F2CD74FC4605C468F6295DEE2F5C68E20935ACFBA00F55F2
Malicious:	false
Reputation:	low
URL:	https://c219111adfa947eeab6af09dce063831.svc.dynamics.com/t/t/ztXJZMj9rZ8iYS3npIzRkXSAIA5ADBvD3N1VaHd5qBcx/JiMNNsNZGlecgfVUxFYeQjS0MvF0EESkB89ns4tVPv8x
Preview:	<html><head><meta http-equiv="refresh" content="5; url=https://www.microsoft.com/#msdynttrid=JgmbvduWIG4j8omIo6XFRaL-w0xPZnNzUwZfg-uRcIU"/></head><body><div class="d365-mkt-config" style="display:none" data-original-url="https://www.microsoft.com/#msdynttrid=JgmbvduWIG4j8omIo6XFRaL-w0xPZnNzUwZfg-uRcIU" data-callback-url="https://c219111adfa947eeab6af09dce063831.svc.dynamics.com/t/cp" data-session-id="JgmbvduWIG4j8omIo6XFRaL-w0xPZnNzUwZfg-uRcIU"></div><script src="https://mktdplp102cdn.azureedge.net/public/latest/js/bot-detection.js?v=1.84.2007"></script></body></html>

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/favicon.ico?v2
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	15
Entropy (8bit):	3.189898095464287
Encrypted:	false
SSDEEP:	3:Uh1Kn:UDKn
MD5:	39A19D0882684989864FA50BCED6A2D1
SHA1:	5CED55DAC2E0427E9DC605CEC1FEDAB0949EB15E
SHA-256:	8FBEDED073249C3611742297EE96A976A95EE113F33B9A422A5D3A7A2DEB63E5
SHA-512:	E795CB7DE27B42948B7DDFF19F3B401A8F95753AC7D37D9B5F52D8DACD2AA43A2AD9EACEC29F77D28080E20C21C48B9FA88A733FAC108939FB2F0EB036C7AEEE
Malicious:	false
Reputation:	low
URL:	https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7
Preview:	/* empty css */

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32089)
Category:	dropped
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:	1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
Reputation:	low
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (19601), with CRLF line terminators
Category:	dropped
Size (bytes):	29275
Entropy (8bit):	5.777359610935254
Encrypted:	false
SSDEEP:	768:XI9CoyzrYRqwdS1Zc5OH9rsATMheTA7cp3ELcadt:XPzE42cyWELD
MD5:	629FB69A45E4E0C36FD741FBDE32CB09
SHA1:	5F194B5D54B012872469AB3173D55C188D101858
SHA-256:	84EACF3F43BF7B9177FB78C533F34C3930CD517DA0295BFD57BD5E01B2400ED8
SHA-512:	840988E321A4E08081FD33233A0C33138BC2D4E2B767DE1566FC4CEF29BDE9AEA0685AF24081103FC760B396AC76196068E5636B93B91A344F6210759BD63631
Malicious:	false
Reputation:	low
Preview:	/* UAParser.js v1.0.2.. Copyright . 2012-2021 Faisal Salman <f@faisalman.com>.. MIT License */..(function(window,undefined){"use strict";var LIBVERSION="1.0.2",EMPTY="",UNKNOWN="?",FUNC_TYPE="function",UNDEF_TYPE="undefined",OBJ_TYPE="object",STR_TYPE="string",MAJOR="major",MODEL="model",NAME="name",TYPE="type",VENDOR="vendor",VERSION="version",ARCHITECTURE="architecture",CONSOLE="console",MOBILE="mobile",TABLET="tablet",SMARTTV="smarttv",WEARABLE="wearable",EMBEDDED="embedded",UA_MAX_LENGTH=255;var AMAZON="Amazon",APPLE="Apple",ASUS="ASUS",BLACKBERRY="BlackBerry",BROWSER="Browser",CHROME="Chrome",EDGE="Edge",FIREFOX="Firefox",GOOGLE="Google",HUAWEI="Huawei",LG="LG",MICROSOFT="Microsoft",MOTOROLA="Motorola",OPERA="Opera",SAMSUNG="Samsung",SONY="Sony",XIAOMI="Xiaomi",ZEBRA="Zebra",FACEBOOK="Facebook";var extend=function(regexes,extensions){var mergedRegexes={};for(var i in regexes){if(extensions[i]&&extensions[i].length%2===0){mergedRegexes[i]=extensions[i].concat(regexes[i])}else{

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Reputation:	low
URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (41651)
Category:	downloaded
Size (bytes):	131537
Entropy (8bit):	5.2237799798561975
Encrypted:	false
SSDEEP:	3072:1f/HuF3CpxEIqQ0/9d1EwgXAnKxnKKviV:1f/HuZ1ILGV
MD5:	30B7C335C62E5269E2D35B8E8B9F44B4
SHA1:	C6D92B1516EB8F6D44AAF171FB24A1B2AADD0C4C
SHA-256:	10733A5D876108F81C5F78EEE5C9760A739D89C52FA6180C4290B7F909F24346
SHA-512:	5BCE247C84C88F993A857CE2F1E8540C648672DEB6D92A55BC808C33394B784C52866D635BEC8B7CD5E62A7EA4109569AC8BCD1381571B84592ACD6C5901D7A8
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4-34de62/1b-c96630/db-bc0148/dc-7e9864/78-4c7d22/e1-c35781/40-7b7803/cd-23d3b0/6d-1e7ed0/b7-cadaa7/ca-40b7b0/4e-ee3a55/3e-f5c39b/c3-6454d7/f9-7592d3/92-10345d/79-499886/7e-cda2d3/db-f3b1fd/93-283c2d/e0-3c9860/91-97a04f/1f-100dea/33-abe4df/19-c0fae7?ver=2.0&iife=1
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32089)
Category:	downloaded
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:	1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
Reputation:	low
URL:	https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
Category:	downloaded
Size (bytes):	563851
Entropy (8bit):	5.221453271093944
Encrypted:	false
SSDEEP:	6144:2VR57iqbPXlB5UR5vWenR5xWeMFdBjL+ks0EcU0MWEsuWe5fXbHfxlN/FNCn/Lpl:tTP0BKYtf
MD5:	12DD1E4D0485A80184B36D158018DE81
SHA1:	EB2594062E90E3DCD5127679F9C369D3BF39D61C
SHA-256:	A04B5B8B345E79987621008E6CC9BEF2B684663F9A820A0C7460E727A2A4DDC3
SHA-512:	F3A92BF0C681E6D2198970F43B966ABDF8CCBFF3F9BD5136A1CA911747369C49F8C36C69A7E98E0F2AED3163D9D1C5D44EFCE67A178DE479196845721219E12C
Malicious:	false
Reputation:	low
URL:	https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.css
Preview:	@charset "UTF-8";/! @ms-mwf/mwf - v1.25.0+6321934 \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise.//! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 26288, version 0.0
Category:	downloaded
Size (bytes):	26288
Entropy (8bit):	7.984195877171481
Encrypted:	false
SSDEEP:	768:56JqQaQphRbTHiKNF5z/02h5KpJW3pPOA8Y9g/:gdTTH5XKpJWdH1W/
MD5:	D0263DC03BE4C393A90BDA733C57D6DB
SHA1:	8A032B6DEAB53A33234C735133B48518F8643B92
SHA-256:	22B4DF5C33045B645CAFA45B04685F4752E471A2E933BFF5BF14324D87DEEE12
SHA-512:	9511BEF269AE0797ADDF4CD6F2FEC4AD0C4A4E06B3E5BF6138C7678A203022AC4818C7D446D154594504C947DA3061030E82472D2708149C0709B1A070FDD0E3
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff
Preview:	wOFF......f........D........................OS/2...X...H...`JM.FVDMX.............^.qcmap..............9cvt ...4... .......fpgm...T.......Y...gasp...D............glyf...P..U5.......head..]....2...6...Chhea..]........$$...hmtx..]..........ye'loca..^............Gmaxp..`.... ... ./..name..`....8....]..Rpost..f........ .Q.wprep..f$........x...x.c`.Pf......:....Q.B3_dHc..`e.bdb... .`@..`......./9.\|...V...)00...-.Wx...S......._..m.m.m.m.m;e..y.~.......<p..a.0t.&...a.pa.0B.1..F...Q.ha.0F.3.....q.xa.0A.0L.&...I.da.0E.2L....i.ta.0C.1..f...Y.la.0G.3.....y.\|a..@X0,.....E.ba.DX2,....e.ra..BX1..V...U.ja..FX3.....u.za..A.0l.6...M.fa.E.2l....m.va..C.1..v...].na..G.3......}.~a.p@80......C.a..pD82.....c.q..pB81..N...S.i..pF83.....s.y..pA.0\.....K.e..pE.2\....k.u..pC.1..n...[.m..pG.3......{.}...@x0<.....G.c...Dx2<....g.s...Bx1..^...W.k...Fx3.....w.{...A.0\|.>...O.g...E.2\|....o.w...C.1..~..._.o..08........?..0$........x...mL.U.............9.x.`[...&BF@X...V.h.Z..h......`n....[..U

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64241)
Category:	downloaded
Size (bytes):	167730
Entropy (8bit):	5.045981547409661
Encrypted:	false
SSDEEP:	3072:OzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCxW:clZAP+keedJ
MD5:	AFB5C64B13342F6E568093548D0A2A9F
SHA1:	95FC121CCCFDBA12443CF87A9C823486065A14AB
SHA-256:	238DB52476BF8107E2E851CD3299B071ED5944B570C1603A1EA758A4FADF5F29
SHA-512:	6FE8BADD1B94E81464C0808383A4CC77F779BF226A3C13B58B2BCB36332995EFBC7711373EE8AB2A8BC52675884F9885D168CB2DE9535E39E71B0B72940691E1
Malicious:	false
Reputation:	low
URL:	https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/2b-7ae144/7e-3283eb/69-8122fc/86-016699/72-2b1d8c/80-6461e7/2a-d9be59/51-40faf7?ver=2.0
Preview:	@charset "UTF-8";./! \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise././! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css /.body{margin:0}.context-uh

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 08:15:34.325825930 CET	49675	443	192.168.2.4	173.222.162.32
Nov 26, 2024 08:15:40.436178923 CET	49739	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:15:40.436219931 CET	443	49739	142.250.181.100	192.168.2.4
Nov 26, 2024 08:15:40.436327934 CET	49739	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:15:40.436538935 CET	49739	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:15:40.436551094 CET	443	49739	142.250.181.100	192.168.2.4
Nov 26, 2024 08:15:41.381527901 CET	49740	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:41.381586075 CET	443	49740	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:41.381743908 CET	49740	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:41.383955956 CET	49740	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:41.383970976 CET	443	49740	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:42.197057009 CET	443	49739	142.250.181.100	192.168.2.4
Nov 26, 2024 08:15:42.197381020 CET	49739	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:15:42.197403908 CET	443	49739	142.250.181.100	192.168.2.4
Nov 26, 2024 08:15:42.198607922 CET	443	49739	142.250.181.100	192.168.2.4
Nov 26, 2024 08:15:42.198664904 CET	49739	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:15:42.201689959 CET	49739	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:15:42.201792955 CET	443	49739	142.250.181.100	192.168.2.4
Nov 26, 2024 08:15:42.246747017 CET	49739	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:15:42.246768951 CET	443	49739	142.250.181.100	192.168.2.4
Nov 26, 2024 08:15:42.294409037 CET	49739	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:15:42.819173098 CET	443	49740	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:42.819246054 CET	49740	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:42.822904110 CET	49740	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:42.822916031 CET	443	49740	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:42.823188066 CET	443	49740	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:42.865334988 CET	49740	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:42.907330990 CET	443	49740	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:43.355405092 CET	443	49740	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:43.355479956 CET	443	49740	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:43.355556011 CET	49740	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:43.355645895 CET	49740	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:43.355659962 CET	443	49740	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:43.355670929 CET	49740	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:43.355676889 CET	443	49740	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:43.398922920 CET	49742	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:43.398972988 CET	443	49742	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:43.399060011 CET	49742	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:43.399380922 CET	49742	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:43.399390936 CET	443	49742	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:44.830288887 CET	443	49742	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:44.830387115 CET	49742	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:44.831653118 CET	49742	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:44.831660986 CET	443	49742	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:44.831911087 CET	443	49742	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:44.835294008 CET	49742	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:44.879333019 CET	443	49742	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:45.360626936 CET	443	49742	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:45.360702038 CET	443	49742	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:45.360755920 CET	49742	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:45.361557007 CET	49742	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:45.361572981 CET	443	49742	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:45.361588955 CET	49742	443	192.168.2.4	69.192.160.109
Nov 26, 2024 08:15:45.361594915 CET	443	49742	69.192.160.109	192.168.2.4
Nov 26, 2024 08:15:47.305604935 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:47.305660963 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:47.305722952 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:47.307174921 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:47.307187080 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:48.936043978 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:48.936137915 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:48.946911097 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:48.946932077 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:48.947348118 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:48.999881029 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:50.925622940 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:50.971330881 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:51.464194059 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:51.464252949 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:51.464294910 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:51.464307070 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:51.464315891 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:51.464344025 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:51.464344978 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:51.464378119 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:51.464394093 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:51.464452982 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:51.464466095 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:51.482952118 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:51.483017921 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:51.483047009 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:51.483225107 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:51.483334064 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:51.912993908 CET	443	49739	142.250.181.100	192.168.2.4
Nov 26, 2024 08:15:51.913033962 CET	443	49739	142.250.181.100	192.168.2.4
Nov 26, 2024 08:15:51.913084030 CET	49739	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:15:51.926487923 CET	49739	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:15:51.926507950 CET	443	49739	142.250.181.100	192.168.2.4
Nov 26, 2024 08:15:52.907493114 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:52.907531023 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:15:52.907556057 CET	49748	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:15:52.907562971 CET	443	49748	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:29.266845942 CET	49768	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:16:29.266887903 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:29.267040968 CET	49768	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:16:29.267414093 CET	49768	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:16:29.267425060 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:29.760936022 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:29.760983944 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:29.761074066 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:29.761437893 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:29.761447906 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:30.879568100 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:30.879641056 CET	49768	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:16:30.886631966 CET	49768	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:16:30.886650085 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:30.887001038 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:30.903403044 CET	49768	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:16:30.947331905 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:31.533586979 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:31.533618927 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:31.533633947 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:31.533787012 CET	49768	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:16:31.533804893 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:31.533900023 CET	49768	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:16:31.585406065 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:31.585469007 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:31.585499048 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:31.585580111 CET	49768	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:16:31.585580111 CET	49768	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:16:31.585838079 CET	49768	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:16:31.585838079 CET	49768	443	192.168.2.4	20.12.23.50
Nov 26, 2024 08:16:31.585853100 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:31.585860968 CET	443	49768	20.12.23.50	192.168.2.4
Nov 26, 2024 08:16:31.612257004 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:31.612348080 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:31.614001036 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:31.614017010 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:31.614260912 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:31.622503042 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:31.667345047 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.107695103 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.107722998 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.107738972 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.107810020 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.107836008 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.107883930 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.305663109 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.305697918 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.305808067 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.305836916 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.306036949 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.349473000 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.349493980 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.349592924 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.349601030 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.349644899 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.495816946 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.495846033 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.495919943 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.495944023 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.495990038 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.529064894 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.529086113 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.529223919 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.529241085 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.529408932 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.550867081 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.550889969 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.550966024 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.550995111 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.551095963 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.569569111 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.569602966 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.569669008 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.569693089 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.569803953 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.704904079 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.704932928 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.705039978 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.705068111 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.705293894 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.721679926 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.721703053 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.721815109 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.721836090 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.721992016 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.739064932 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.739082098 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.739145041 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.739165068 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.739202023 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.756334066 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.756370068 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.756424904 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.756448984 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.756488085 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.772377014 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.772399902 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.772475958 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.772492886 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.772531986 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.903425932 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.903455973 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.903552055 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.903584003 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.903598070 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.903630018 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.907246113 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.907335997 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.907361031 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.907458067 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.907686949 CET	49769	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.907701015 CET	443	49769	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.960791111 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.960863113 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.960937977 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.961157084 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.961200953 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.961253881 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.961848974 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.961862087 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.962414980 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.962426901 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.963566065 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.963623047 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.963685989 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.963820934 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.963835001 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.964804888 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.964848995 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.964925051 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.965480089 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.965502977 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.965563059 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.966382027 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.966401100 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:32.966475964 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:32.966499090 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:34.744426012 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:34.745037079 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:34.745071888 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:34.745538950 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:34.745546103 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:34.747705936 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:34.747853994 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:34.747992039 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:34.748027086 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:34.748224020 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:34.748250008 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:34.748372078 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:34.748380899 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:34.748719931 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:34.748728991 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:34.809657097 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:34.810211897 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:34.810246944 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:34.810733080 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:34.810739040 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.189023972 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.189090014 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.189352036 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.189399958 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.189399958 CET	49770	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.189420938 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.189438105 CET	443	49770	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.192259073 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.192303896 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.192354918 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.192370892 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.192424059 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.192564964 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.192574024 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.192585945 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.192646980 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.192653894 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.192665100 CET	49773	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.192668915 CET	443	49773	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.194698095 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.194736958 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.194792986 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.195003986 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.195015907 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.197534084 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.197556973 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.197612047 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.197643042 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.197782993 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.197799921 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.197809935 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.197927952 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.197957993 CET	443	49774	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.199409008 CET	49774	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.199907064 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.199945927 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.200005054 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.200113058 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.200124979 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.268990040 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.269016981 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.269123077 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.269157887 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.269205093 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.269444942 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.269450903 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.269464970 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.269615889 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.269644022 CET	443	49771	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.269695997 CET	49771	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.272145987 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.272181034 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:35.272245884 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.272378922 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:35.272386074 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:36.909568071 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:36.910156965 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:36.910218954 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:36.910603046 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:36.910618067 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.083190918 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.083235979 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.087296963 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.087335110 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.087655067 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.087681055 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.087753057 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.087759018 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.088366032 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.088378906 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.098905087 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.099549055 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.099575996 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.100223064 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.100228071 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.353854895 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.353919983 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.353986025 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.354300976 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.354350090 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.354382992 CET	49775	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.354399920 CET	443	49775	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.357609034 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.357686996 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.357768059 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.357925892 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.357955933 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.538063049 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.538136959 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.538150072 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.538204908 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.538218021 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.538264990 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.538464069 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.538475037 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.538482904 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.538491011 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.538492918 CET	49777	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.538497925 CET	443	49777	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.538506985 CET	49776	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.538512945 CET	443	49776	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.541361094 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.541413069 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.541460037 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.541487932 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.541502953 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.541569948 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.541712999 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.541726112 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.541731119 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.541743040 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.543276072 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.543333054 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.543373108 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.543543100 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.543549061 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.543566942 CET	49778	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.543570995 CET	443	49778	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.546051979 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.546080112 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:37.546143055 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.546272993 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:37.546287060 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:38.457314968 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:38.457833052 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:38.457863092 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:38.458280087 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:38.458290100 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:38.896990061 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:38.897020102 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:38.897083044 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:38.897104979 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:38.897156954 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:38.897378922 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:38.897383928 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:38.897399902 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:38.897543907 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:38.897576094 CET	443	49772	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:38.897614956 CET	49772	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:38.900388002 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:38.900444984 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:38.900510073 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:38.900664091 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:38.900672913 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.138504982 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.139050007 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.139086008 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.139517069 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.139527082 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.308202028 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.309143066 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.309163094 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.309619904 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.309626102 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.321726084 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.322077990 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.322094917 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.322424889 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.322429895 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.323019028 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.323246002 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.323260069 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.323575020 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.323580980 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.583251953 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.583332062 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.583396912 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.583697081 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.583698034 CET	49780	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.583718061 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.583729029 CET	443	49780	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.586785078 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.586847067 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.587066889 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.587066889 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.587117910 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.743100882 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.743163109 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.743223906 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.743537903 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.743555069 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.743566990 CET	49783	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.743572950 CET	443	49783	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.746653080 CET	49786	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.746686935 CET	443	49786	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.746766090 CET	49786	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.746947050 CET	49786	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.746954918 CET	443	49786	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.766199112 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.766258955 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.766314983 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.766515970 CET	49782	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.766531944 CET	443	49782	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.769064903 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.769125938 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.769274950 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.769299030 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.769359112 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.769397974 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.769504070 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.769504070 CET	49781	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.769516945 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.769529104 CET	443	49781	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.769530058 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.769546032 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.771394968 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.771425009 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:39.771601915 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.771620035 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:39.771625042 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:40.357703924 CET	49789	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:16:40.357748985 CET	443	49789	142.250.181.100	192.168.2.4
Nov 26, 2024 08:16:40.357809067 CET	49789	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:16:40.358190060 CET	49789	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:16:40.358205080 CET	443	49789	142.250.181.100	192.168.2.4
Nov 26, 2024 08:16:40.616442919 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:40.617382050 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:40.617407084 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:40.617856979 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:40.617861986 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.051323891 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.051484108 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.051739931 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.051739931 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.051739931 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.054415941 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.054455042 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.054522038 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.054665089 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.054672956 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.277590036 CET	49784	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.277635098 CET	443	49784	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.373346090 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.374166965 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.374192953 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.374665022 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.374675989 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.465257883 CET	443	49786	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.466142893 CET	49786	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.466181993 CET	443	49786	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.466608047 CET	49786	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.466617107 CET	443	49786	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.487018108 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.487827063 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.487848997 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.488224030 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.488231897 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.616260052 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.619971991 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.619991064 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.620439053 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.620445013 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.817884922 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.817966938 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.818042040 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.818273067 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.818273067 CET	49785	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.818303108 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.818319082 CET	443	49785	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.821250916 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.821285963 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.821557999 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.821557999 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.821588039 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.901233912 CET	443	49786	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.901316881 CET	443	49786	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.901364088 CET	49786	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.901566982 CET	49786	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.901591063 CET	443	49786	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.901602983 CET	49786	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.901608944 CET	443	49786	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.904536009 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.904562950 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.904617071 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.904773951 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.904783010 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.922559023 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.922720909 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.922791004 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.923098087 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.923098087 CET	49787	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.923116922 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.923125982 CET	443	49787	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.925422907 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.925453901 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:41.925534964 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.925672054 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:41.925689936 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:42.069880962 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:42.069950104 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:42.070214987 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:42.070242882 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:42.070242882 CET	49788	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:42.070261955 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:42.070270061 CET	443	49788	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:42.073426962 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:42.073467970 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:42.073574066 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:42.073755026 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:42.073766947 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:42.142945051 CET	443	49789	142.250.181.100	192.168.2.4
Nov 26, 2024 08:16:42.143381119 CET	49789	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:16:42.143400908 CET	443	49789	142.250.181.100	192.168.2.4
Nov 26, 2024 08:16:42.143738985 CET	443	49789	142.250.181.100	192.168.2.4
Nov 26, 2024 08:16:42.144059896 CET	49789	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:16:42.144140005 CET	443	49789	142.250.181.100	192.168.2.4
Nov 26, 2024 08:16:42.184582949 CET	49789	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:16:42.839102983 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:42.839756012 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:42.839778900 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:42.840528965 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:42.840533972 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.283783913 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.283863068 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.283924103 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:43.284188986 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:43.284207106 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.284216881 CET	49790	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:43.284221888 CET	443	49790	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.287137032 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:43.287174940 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.287358046 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:43.287623882 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:43.287633896 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.641530037 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.642708063 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:43.642708063 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:43.642733097 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.642750025 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.666135073 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.666852951 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:43.666877985 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.667243004 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:43.667247057 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.695194006 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.695653915 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:43.695686102 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.696043015 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:43.696048021 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.853491068 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.854171038 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:43.854187965 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:43.854680061 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:43.854686022 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.077697992 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.077825069 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.078059912 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.078100920 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.078100920 CET	49793	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.078119040 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.078128099 CET	443	49793	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.081209898 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.081262112 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.081372976 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.081547022 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.081561089 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.119292974 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.119371891 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.119611025 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.119657040 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.119657040 CET	49791	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.119678974 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.119689941 CET	443	49791	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.123337984 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.123368979 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.123445034 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.123603106 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.123619080 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.141736031 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.141807079 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.142035961 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.142177105 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.142177105 CET	49792	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.142195940 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.142209053 CET	443	49792	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.144601107 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.144628048 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.144707918 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.144876957 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.144885063 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.298846006 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.298922062 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.299060106 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.302181005 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.302205086 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.302217960 CET	49794	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.302227974 CET	443	49794	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.305624962 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.305668116 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:44.305757046 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.305882931 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:44.305898905 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.133806944 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.134454012 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:45.134495020 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.134927988 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:45.134938002 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.587969065 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.588139057 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.588330984 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:45.588852882 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:45.588870049 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.588912964 CET	49795	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:45.588931084 CET	443	49795	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.592468023 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:45.592539072 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.592602968 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:45.592749119 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:45.592757940 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.863435030 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.864093065 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:45.864124060 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.864600897 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:45.864604950 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.929912090 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.930454016 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:45.930474043 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.931018114 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:45.931021929 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.971554041 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.972131014 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:45.972152948 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:45.972573996 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:45.972579956 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.098869085 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.099647999 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.099678993 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.100019932 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.100025892 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.308763981 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.308829069 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.308984995 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.309093952 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.309114933 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.309137106 CET	49796	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.309144974 CET	443	49796	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.312268019 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.312304974 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.312402964 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.312567949 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.312580109 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.375112057 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.375178099 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.375359058 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.375798941 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.375821114 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.375832081 CET	49798	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.375838995 CET	443	49798	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.382952929 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.383007050 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.383074045 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.383209944 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.383224010 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.425270081 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.425333977 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.425401926 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.425789118 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.425789118 CET	49797	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.425806999 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.425817013 CET	443	49797	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.428540945 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.428579092 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.428662062 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.428829908 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.428844929 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.542536020 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.542604923 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.542762041 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.542998075 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.542998075 CET	49799	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.543014050 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.543023109 CET	443	49799	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.546098948 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.546204090 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:46.546315908 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.546485901 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:46.546519995 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:47.374231100 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:47.374731064 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:47.374759912 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:47.375222921 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:47.375233889 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:47.818675041 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:47.818742990 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:47.818834066 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:47.819185972 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:47.819185972 CET	49800	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:47.819262981 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:47.819300890 CET	443	49800	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:47.821883917 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:47.821933031 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:47.821995974 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:47.822145939 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:47.822163105 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.098728895 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.099230051 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.099247932 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.099684000 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.099689960 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.209305048 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.210130930 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.210160971 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.210742950 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.210751057 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.240329027 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.241125107 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.241182089 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.241612911 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.241626978 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.391545057 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.392162085 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.392198086 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.392635107 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.392647028 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.543154001 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.543232918 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.543339014 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.543987036 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.544007063 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.544018984 CET	49801	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.544023991 CET	443	49801	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.546602011 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.546706915 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.546801090 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.546953917 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.546983004 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.654894114 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.654966116 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.655018091 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.655227900 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.655247927 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.655258894 CET	49803	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.655265093 CET	443	49803	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.658304930 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.658340931 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.658437967 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.658608913 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.658624887 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.694370031 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.694439888 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.694535971 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.694753885 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.694753885 CET	49802	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.694818974 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.694847107 CET	443	49802	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.697695017 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.697732925 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.697834015 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.697995901 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.698003054 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.848083973 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.848150015 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.848210096 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.848402023 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.848448038 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.848476887 CET	49804	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.848493099 CET	443	49804	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.851344109 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.851443052 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:48.851546049 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.851718903 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:48.851741076 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:49.666503906 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:49.667154074 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:49.667175055 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:49.667610884 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:49.667620897 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.120116949 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.120192051 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.120316029 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.120569944 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.120593071 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.120604992 CET	49805	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.120609999 CET	443	49805	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.123940945 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.123986006 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.124072075 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.124314070 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.124325991 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.396626949 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.397536039 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.397564888 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.397887945 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.397893906 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.439074039 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.439691067 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.439714909 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.440182924 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.440190077 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.542736053 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.543688059 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.543706894 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.544240952 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.544250965 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.567414045 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.567934990 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.567966938 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.568387032 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.568394899 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.852412939 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.852492094 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.852566957 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.852783918 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.852807045 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.852818966 CET	49806	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.852824926 CET	443	49806	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.856060028 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.856108904 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.856237888 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.856453896 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.856465101 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.883240938 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.883395910 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.883457899 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.883641958 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.883661985 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.883672953 CET	49807	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.883678913 CET	443	49807	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.886547089 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.886573076 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.886656046 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.886832952 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.886843920 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.996898890 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.996975899 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.997028112 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.997210979 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.997229099 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.997240067 CET	49808	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.997246027 CET	443	49808	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.999821901 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:50.999875069 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:50.999933004 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:51.000107050 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:51.000119925 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:51.004674911 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:51.004736900 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:51.004780054 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:51.004955053 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:51.004955053 CET	49809	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:51.004972935 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:51.004983902 CET	443	49809	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:51.007349968 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:51.007395029 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:51.007455111 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:51.007646084 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:51.007662058 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:51.816905975 CET	443	49789	142.250.181.100	192.168.2.4
Nov 26, 2024 08:16:51.816981077 CET	443	49789	142.250.181.100	192.168.2.4
Nov 26, 2024 08:16:51.817097902 CET	49789	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:16:51.905093908 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:51.907593012 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:51.907614946 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:51.908058882 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:51.908065081 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.355945110 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.356029987 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.356097937 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:52.356291056 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:52.356307030 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.356317043 CET	49810	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:52.356323004 CET	443	49810	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.359072924 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:52.359194040 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.359293938 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:52.359447956 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:52.359477997 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.572839022 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.573481083 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:52.573518991 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.573962927 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:52.573968887 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.671978951 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.672733068 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:52.672756910 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.673177958 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:52.673183918 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.788322926 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.788949966 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:52.788973093 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.789421082 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:52.789427996 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.845418930 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.846090078 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:52.846126080 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.846586943 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:52.846596003 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:52.936502934 CET	49789	443	192.168.2.4	142.250.181.100
Nov 26, 2024 08:16:52.936537027 CET	443	49789	142.250.181.100	192.168.2.4
Nov 26, 2024 08:16:53.011375904 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.011450052 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.011579990 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.011739969 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.011765003 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.011779070 CET	49811	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.011785984 CET	443	49811	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.014622927 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.014669895 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.014748096 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.014883041 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.014899969 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.115264893 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.115371943 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.115561962 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.115612030 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.115612030 CET	49812	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.115633011 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.115645885 CET	443	49812	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.118536949 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.118582010 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.118648052 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.118865013 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.118877888 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.234097958 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.234179020 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.234405994 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.234446049 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.234464884 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.234473944 CET	49814	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.234483004 CET	443	49814	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.237243891 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.237281084 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.237365961 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.237509966 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.237524033 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.300246000 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.300314903 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.300400019 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.300611019 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.300640106 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.300652981 CET	49813	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.300658941 CET	443	49813	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.303520918 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.303575993 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:53.303663969 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.303845882 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:53.303859949 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.141666889 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.142374039 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:54.142407894 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.142852068 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:54.142858028 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.586790085 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.586874008 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.586946011 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:54.587114096 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:54.587165117 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.587194920 CET	49815	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:54.587212086 CET	443	49815	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.589776993 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:54.589835882 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.589946985 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:54.590048075 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:54.590054035 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.843828917 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.845866919 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:54.845889091 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.846273899 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:54.846278906 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.859121084 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.861854076 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:54.861870050 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:54.862159014 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:54.862163067 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.018786907 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.019406080 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.019423962 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.020122051 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.020128965 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.150291920 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.151341915 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.151376963 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.151846886 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.151853085 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.279441118 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.279506922 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.279798031 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.279846907 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.279846907 CET	49817	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.279864073 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.279875040 CET	443	49817	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.282736063 CET	49821	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.282766104 CET	443	49821	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.282869101 CET	49821	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.283061981 CET	49821	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.283070087 CET	443	49821	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.312789917 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.312856913 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.312963009 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.313230991 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.313230991 CET	49816	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.313246965 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.313256025 CET	443	49816	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.316457987 CET	49822	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.316495895 CET	443	49822	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.316673994 CET	49822	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.317061901 CET	49822	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.317074060 CET	443	49822	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.462951899 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.463038921 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.463349104 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.463349104 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.463382959 CET	49818	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.463401079 CET	443	49818	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.466885090 CET	49823	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.466931105 CET	443	49823	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.467004061 CET	49823	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.467197895 CET	49823	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.467206955 CET	443	49823	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.604351044 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.604430914 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.604652882 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.604697943 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.604718924 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.604731083 CET	49819	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.604736090 CET	443	49819	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.608006954 CET	49824	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.608042002 CET	443	49824	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:55.608112097 CET	49824	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.608285904 CET	49824	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:55.608295918 CET	443	49824	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:56.306849957 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:56.307622910 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:56.307641983 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:56.307951927 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:56.307959080 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:56.742412090 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:56.742490053 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:56.742579937 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:56.742861986 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:56.742861986 CET	49820	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:56.742882967 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:56.742892981 CET	443	49820	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:56.745925903 CET	49825	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:56.745995998 CET	443	49825	13.107.246.63	192.168.2.4
Nov 26, 2024 08:16:56.746107101 CET	49825	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:56.746309042 CET	49825	443	192.168.2.4	13.107.246.63
Nov 26, 2024 08:16:56.746323109 CET	443	49825	13.107.246.63	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 08:15:36.843101978 CET	53	56609	1.1.1.1	192.168.2.4
Nov 26, 2024 08:15:36.869519949 CET	53	52985	1.1.1.1	192.168.2.4
Nov 26, 2024 08:15:38.792960882 CET	57965	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:15:38.796190977 CET	52043	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:15:39.295514107 CET	53	52043	1.1.1.1	192.168.2.4
Nov 26, 2024 08:15:39.578202963 CET	53	64601	1.1.1.1	192.168.2.4
Nov 26, 2024 08:15:40.294872046 CET	65279	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:15:40.295001984 CET	49544	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:15:40.435153008 CET	53	65279	1.1.1.1	192.168.2.4
Nov 26, 2024 08:15:40.435164928 CET	53	49544	1.1.1.1	192.168.2.4
Nov 26, 2024 08:15:47.773705959 CET	61354	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:15:47.774136066 CET	62342	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:15:47.775759935 CET	65333	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:15:47.775759935 CET	59664	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:15:50.084316015 CET	138	138	192.168.2.4	192.168.2.255
Nov 26, 2024 08:15:50.713574886 CET	64697	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:15:50.713699102 CET	50875	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:15:51.926886082 CET	64745	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:15:51.927130938 CET	59548	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:15:54.424818039 CET	60724	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:15:54.425332069 CET	63101	53	192.168.2.4	1.1.1.1
Nov 26, 2024 08:15:56.619523048 CET	53	61472	1.1.1.1	192.168.2.4
Nov 26, 2024 08:16:15.374485016 CET	53	49246	1.1.1.1	192.168.2.4
Nov 26, 2024 08:16:35.751066923 CET	53	57017	1.1.1.1	192.168.2.4
Nov 26, 2024 08:16:38.207184076 CET	53	50654	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 26, 2024 08:15:39.295578957 CET	192.168.2.4	1.1.1.1	c2a0	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 08:15:38.792960882 CET	192.168.2.4	1.1.1.1	0x5836	Standard query (0)	c219111adfa947eeab6af09dce063831.svc.dynamics.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:15:38.796190977 CET	192.168.2.4	1.1.1.1	0xa7b8	Standard query (0)	c219111adfa947eeab6af09dce063831.svc.dynamics.com	65	IN (0x0001)	false
Nov 26, 2024 08:15:40.294872046 CET	192.168.2.4	1.1.1.1	0x8c6f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:15:40.295001984 CET	192.168.2.4	1.1.1.1	0xddc3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 26, 2024 08:15:47.773705959 CET	192.168.2.4	1.1.1.1	0x3871	Standard query (0)	assets.onestore.ms	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:15:47.774136066 CET	192.168.2.4	1.1.1.1	0xa671	Standard query (0)	assets.onestore.ms	65	IN (0x0001)	false
Nov 26, 2024 08:15:47.775759935 CET	192.168.2.4	1.1.1.1	0xdde	Standard query (0)	ajax.aspnetcdn.com	65	IN (0x0001)	false
Nov 26, 2024 08:15:47.775759935 CET	192.168.2.4	1.1.1.1	0x39fc	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:15:50.713574886 CET	192.168.2.4	1.1.1.1	0x4d21	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:15:50.713699102 CET	192.168.2.4	1.1.1.1	0x27be	Standard query (0)	ajax.aspnetcdn.com	65	IN (0x0001)	false
Nov 26, 2024 08:15:51.926886082 CET	192.168.2.4	1.1.1.1	0x2287	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:15:51.927130938 CET	192.168.2.4	1.1.1.1	0xc64f	Standard query (0)	c.s-microsoft.com	65	IN (0x0001)	false
Nov 26, 2024 08:15:54.424818039 CET	192.168.2.4	1.1.1.1	0x166c	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:15:54.425332069 CET	192.168.2.4	1.1.1.1	0xd717	Standard query (0)	c.s-microsoft.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 08:15:39.200402021 CET	1.1.1.1	192.168.2.4	0x5836	No error (0)	c219111adfa947eeab6af09dce063831.svc.dynamics.com	mktsvcp102wu001.svc.dynamics.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:15:39.200402021 CET	1.1.1.1	192.168.2.4	0x5836	No error (0)	mktsvcp102wu001.svc.dynamics.com	mktsvcp102wu001.westus2.cloudapp.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:15:39.295514107 CET	1.1.1.1	192.168.2.4	0xa7b8	No error (0)	c219111adfa947eeab6af09dce063831.svc.dynamics.com	mktsvcp102wu001.svc.dynamics.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:15:39.295514107 CET	1.1.1.1	192.168.2.4	0xa7b8	No error (0)	mktsvcp102wu001.svc.dynamics.com	mktsvcp102wu001.westus2.cloudapp.azure.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:15:40.435153008 CET	1.1.1.1	192.168.2.4	0x8c6f	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 26, 2024 08:15:40.435164928 CET	1.1.1.1	192.168.2.4	0xddc3	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 26, 2024 08:15:47.922741890 CET	1.1.1.1	192.168.2.4	0xdde	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:15:47.922840118 CET	1.1.1.1	192.168.2.4	0x39fc	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:15:48.187875032 CET	1.1.1.1	192.168.2.4	0xa671	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:15:48.322211981 CET	1.1.1.1	192.168.2.4	0x3871	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:15:50.852674961 CET	1.1.1.1	192.168.2.4	0x4d21	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:15:50.855254889 CET	1.1.1.1	192.168.2.4	0x27be	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:15:52.066658974 CET	1.1.1.1	192.168.2.4	0xc64f	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:15:52.149458885 CET	1.1.1.1	192.168.2.4	0x2287	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:15:54.564537048 CET	1.1.1.1	192.168.2.4	0x166c	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 08:15:54.568275928 CET	1.1.1.1	192.168.2.4	0xd717	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

slscr.update.microsoft.com

otelrules.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	69.192.160.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:15:42 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 07:15:43 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=241492 Date: Tue, 26 Nov 2024 07:15:43 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	69.192.160.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:15:44 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 07:15:45 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=241509 Date: Tue, 26 Nov 2024 07:15:45 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-26 07:15:45 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49748	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:15:50 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kKcg+DVNDBsFEkK&MD=FpkWMFgD HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 07:15:51 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 286cfdd8-7e23-425a-b70b-626736332cae MS-RequestId: 9f20b3c2-1160-400d-b931-354145b315d9 MS-CV: S5p1jz5Uz02SNS40.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 07:15:50 GMT Connection: close Content-Length: 24490
2024-11-26 07:15:51 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-26 07:15:51 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49768	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:30 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kKcg+DVNDBsFEkK&MD=FpkWMFgD HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 07:16:31 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: c2560b08-1912-4598-b2f9-bb9961688d5f MS-RequestId: d439fc3e-11bf-48cd-8b3d-ce1e53fc3718 MS-CV: mtvV73SBoU6uCVci.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 07:16:31 GMT Connection: close Content-Length: 30005
2024-11-26 07:16:31 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-26 07:16:31 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:31 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:32 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:31 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 25 Nov 2024 13:17:46 GMT ETag: "0x8DD0D538D5EA1E0" x-ms-request-id: f5f75198-101e-00a2-8091-3f9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071631Z-174f7845968g6hv8hC1EWR1v2n0000000340000000000zxm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:32 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-26 07:16:32 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-26 07:16:32 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-26 07:16:32 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-26 07:16:32 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-26 07:16:32 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-26 07:16:32 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-26 07:16:32 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-26 07:16:32 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-26 07:16:32 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:34 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:34 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071634Z-174f78459685726chC1EWRsnbg0000000v8000000000133y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:35 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:34 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:35 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071635Z-174f7845968xr5c2hC1EWRd0hn0000000bxg000000007su8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:35 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:34 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:34 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071634Z-174f7845968zgtf6hC1EWRqd8s0000000mz000000000ax8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:35 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:34 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:35 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071635Z-174f7845968nxc96hC1EWRspw80000000ut0000000008un5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:35 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:36 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:37 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071637Z-174f7845968j6t2phC1EWRcfe80000000v7g000000006y53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:37 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:37 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:37 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071637Z-174f7845968frfdmhC1EWRxxbw0000000v6g000000002y2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:37 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:37 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:37 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071637Z-174f78459685m244hC1EWRgp2c0000000uz00000000048ap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:37 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:37 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:37 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071637Z-174f7845968n2hr8hC1EWR9cag0000000un000000000dp7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:37 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:38 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:38 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:38 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071638Z-174f7845968px8v7hC1EWR08ng0000000vbg000000005ecp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:38 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:39 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:39 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071639Z-174f78459685726chC1EWRsnbg0000000v5g000000004m4k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:39 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:39 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:39 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071639Z-174f7845968jrjrxhC1EWRmmrs0000000v9g0000000030a8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:39 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:39 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:39 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071639Z-174f7845968vqt9xhC1EWRgten0000000v2000000000ax06 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:39 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:39 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:39 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:39 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071639Z-174f78459685726chC1EWRsnbg0000000v1000000000dupq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:16:39 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:40 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:40 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071640Z-174f7845968j6t2phC1EWRcfe80000000va00000000031zm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:41 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:41 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:41 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071641Z-174f78459684bddphC1EWRbht40000000ur000000000ddru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:41 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:41 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:41 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071641Z-174f7845968frfdmhC1EWRxxbw0000000v8g0000000006r3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:41 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:41 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:41 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071641Z-174f78459685m244hC1EWRgp2c0000000uvg00000000bdyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:41 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:41 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:42 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071641Z-174f7845968xlwnmhC1EWR0sv80000000uwg000000008f5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:42 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:43 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071643Z-174f7845968jrjrxhC1EWRmmrs0000000v8g000000004tde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:43 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:43 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:44 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:43 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071643Z-174f7845968n2hr8hC1EWR9cag0000000uvg0000000001md x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:44 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:43 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:44 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:43 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071643Z-174f7845968qj8jrhC1EWRh41s0000000uzg0000000096ct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:44 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:43 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:44 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:43 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071643Z-174f7845968j6t2phC1EWRcfe80000000v60000000009qn0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:44 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:43 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:44 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:44 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071644Z-174f7845968cdxdrhC1EWRg0en0000000v3g000000003an2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:44 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:45 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:45 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:45 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071645Z-174f78459688l8rvhC1EWRtzr000000007u00000000003b8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:45 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:45 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:46 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:46 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071646Z-174f7845968g6hv8hC1EWR1v2n00000002yg00000000akhr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:16:46 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:45 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:46 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:46 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071646Z-174f7845968qj8jrhC1EWRh41s0000000v300000000032z4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:46 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:45 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:46 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:46 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071646Z-174f7845968frfdmhC1EWRxxbw0000000v2000000000aqs5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:46 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:46 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:46 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:46 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071646Z-174f7845968psccphC1EWRuz9s0000000vag0000000070ny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:46 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:47 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:47 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:47 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071647Z-174f7845968nxc96hC1EWRspw80000000uyg000000000kdu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:47 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:48 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:48 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071648Z-174f7845968psccphC1EWRuz9s0000000vcg000000003z40 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:48 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:48 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:48 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071648Z-174f7845968px8v7hC1EWR08ng0000000va0000000007tng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:48 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:48 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:48 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071648Z-174f7845968qj8jrhC1EWRh41s0000000v3000000000330a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:48 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:48 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:48 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071648Z-174f7845968xlwnmhC1EWR0sv80000000v1g000000000c7k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:48 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:49 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:49 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071649Z-174f7845968frfdmhC1EWRxxbw0000000v400000000077m9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:50 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:50 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:50 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071650Z-174f7845968kvnqxhC1EWRmf3g0000000dw00000000074wb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:50 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:50 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:50 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071650Z-174f7845968kvnqxhC1EWRmf3g0000000dw00000000074wc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:50 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:50 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:50 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071650Z-174f7845968px8v7hC1EWR08ng0000000va0000000007tqp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:50 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:50 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:51 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:50 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071650Z-174f78459684bddphC1EWRbht40000000uyg0000000001qe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 07:16:51 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:51 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:52 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:52 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071652Z-174f7845968cdxdrhC1EWRg0en0000000uzg00000000ach5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:52 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:52 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:53 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:52 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071652Z-174f7845968frfdmhC1EWRxxbw0000000v400000000077pd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:53 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:52 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:53 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:52 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071652Z-174f7845968cpnpfhC1EWR3afc0000000up0000000009fnp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:53 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:52 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:53 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:53 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071653Z-174f7845968px8v7hC1EWR08ng0000000v90000000009xkb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:53 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:52 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:53 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:53 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071653Z-174f7845968ljs8phC1EWRe6en0000000uug00000000dp0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:53 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:54 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:54 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:54 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071654Z-174f7845968cdxdrhC1EWRg0en0000000v0g0000000097w6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:54 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:54 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:55 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:55 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071655Z-174f7845968qj8jrhC1EWRh41s0000000v3000000000335s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:55 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:54 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:55 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:55 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071655Z-174f7845968frfdmhC1EWRxxbw0000000v500000000059h0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:55 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:55 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:55 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:55 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071655Z-174f7845968g6hv8hC1EWR1v2n00000002yg00000000akqw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:55 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:55 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:55 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:55 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071655Z-174f7845968zgtf6hC1EWRqd8s0000000n0g0000000088ue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:55 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:56 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:56 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:56 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071656Z-174f7845968kvnqxhC1EWRmf3g0000000dy00000000049m0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:56 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:56 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:57 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071657Z-174f78459685726chC1EWRsnbg0000000v500000000061u0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:57 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:57 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:57 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071657Z-174f7845968jrjrxhC1EWRmmrs0000000vb0000000000tds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:57 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:57 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:57 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071657Z-174f7845968xr5c2hC1EWRd0hn0000000bxg000000007t89 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:57 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 07:16:57 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 07:16:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 07:16:57 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T071657Z-174f7845968kvnqxhC1EWRmf3g0000000dvg000000008h9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 07:16:57 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 2136, Parent PID: 744

General

Target ID:	0
Start time:	02:15:29
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6100, Parent PID: 2136

General

Target ID:	2
Start time:	02:15:34
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2036,i,1867157703621612913,8993123151590466767,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6384, Parent PID: 744

General

Target ID:	3
Start time:	02:15:37
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://c219111adfa947eeab6af09dce063831.svc.dynamics.com/t/t/ztXJZMj9rZ8iYS3npIzRkXSAIA5ADBvD3N1VaHd5qBcx/JiMNNsNZGlecgfVUxFYeQjS0MvF0EESkB89ns4tVPv8x"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://c219111adfa947eeab6af09dce063831.svc.dynamics.com/t/t/ztXJZMj9rZ8iYS3npIzRkXSAIA5ADBvD3N1VaHd5qBcx/JiMNNsNZGlecgfVUxFYeQjS0MvF0EESkB89ns4tVPv8x

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
https://c219111adfa947eeab6af09dce063831.svc.dynamics.com/t/t/ztXJZMj9rZ8iYS3npIzRkXSAIA5ADBvD3N1VaHd5qBcx/JiMNNsNZGlecgfVUxFYeQjS0MvF0EESkB89ns4tVPv8x