Edit tour

Windows Analysis Report
https://www.fadlaldin.com/noodlehead/corpuscular

Overview

General Information

Sample URL:	https://www.fadlaldin.com/noodlehead/corpuscular
Analysis ID:	1560179
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

No high impact signatures.

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5868 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4136 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2016,i,451524844515595830,7794255132247358026,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6312 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.fadlaldin.com/noodlehead/corpuscular" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49754 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56

Source: global traffic	HTTP traffic detected: GET /noodlehead/corpuscular HTTP/1.1Host: www.fadlaldin.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /noodlehead/corpuscular/ HTTP/1.1Host: www.fadlaldin.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /noodlehead/corpuscular/ HTTP/1.1Host: www.fadlaldin.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://www.fadlaldin.com/noodlehead/corpuscular/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: d=-300; n=America/New_York; sp=Win32; su=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/117.0.0.0%20Safari/537.36; iu=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/117.0.0.0%20Safari/537.36; wd=false
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.fadlaldin.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.fadlaldin.com/noodlehead/corpuscular/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: d=-300; n=America/New_York; sp=Win32; su=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/117.0.0.0%20Safari/537.36; iu=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/117.0.0.0%20Safari/537.36; wd=false
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.fadlaldin.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: d=-300; n=America/New_York; sp=Win32; su=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/117.0.0.0%20Safari/537.36; iu=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/117.0.0.0%20Safari/537.36; wd=false
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9y3hzhCsOlFZN8A&MD=aVEpTZ+K HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9y3hzhCsOlFZN8A&MD=aVEpTZ+K HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: www.fadlaldin.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49754 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@16/0@6/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2016,i,451524844515595830,7794255132247358026,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.fadlaldin.com/noodlehead/corpuscular"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2016,i,451524844515595830,7794255132247358026,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://www.fadlaldin.com/noodlehead/corpuscular	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://www.fadlaldin.com/favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.fadlaldin.com	69.163.182.142	true	false		unknown
www.google.com	172.217.18.100	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.fadlaldin.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://www.fadlaldin.com/noodlehead/corpuscular	false		unknown
https://www.fadlaldin.com/noodlehead/corpuscular/	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
69.163.182.142	www.fadlaldin.com	United States	26347	DREAMHOST-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.18.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.23
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560179
Start date and time:	2024-11-21 14:14:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://www.fadlaldin.com/noodlehead/corpuscular
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@16/0@6/5

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.195, 66.102.1.84, 142.250.186.46, 34.104.35.123, 199.232.214.172, 192.229.221.95, 142.250.186.131
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, otelrules.azureedge.net, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://www.fadlaldin.com/noodlehead/corpuscular

Simulations

Behavior and APIs

⊘No simulations

Input	Output
URL: https://www.fadlaldin.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://www.fadlaldin.com

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 14:15:20.192611933 CET	49675	443	192.168.2.4	173.222.162.32
Nov 21, 2024 14:15:21.808723927 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:21.808756113 CET	443	49735	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:21.808809996 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:21.809329987 CET	49736	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:21.809362888 CET	443	49736	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:21.809420109 CET	49736	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:21.809679031 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:21.809700012 CET	443	49735	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:21.809954882 CET	49736	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:21.809964895 CET	443	49736	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:23.183660984 CET	443	49736	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:23.183970928 CET	49736	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:23.183990955 CET	443	49736	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:23.184892893 CET	443	49736	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:23.184947968 CET	49736	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:23.187365055 CET	49736	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:23.187421083 CET	443	49736	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:23.187594891 CET	49736	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:23.187598944 CET	443	49736	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:23.232394934 CET	49736	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:23.261704922 CET	443	49735	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:23.261997938 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:23.262012959 CET	443	49735	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:23.265613079 CET	443	49735	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:23.265686989 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:23.266503096 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:23.266681910 CET	443	49735	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:23.309851885 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:23.309887886 CET	443	49735	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:23.355396032 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:23.704540968 CET	443	49736	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:23.704592943 CET	443	49736	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:23.704631090 CET	49736	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:23.705420017 CET	49736	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:23.705434084 CET	443	49736	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:23.708430052 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:23.751355886 CET	443	49735	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:24.251255989 CET	443	49735	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:24.251351118 CET	443	49735	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:24.251492977 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:24.251524925 CET	443	49735	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:24.251595974 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:24.252393007 CET	443	49735	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:24.252531052 CET	443	49735	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:24.252592087 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:24.255896091 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:24.255942106 CET	443	49735	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:24.255970001 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:24.256247997 CET	49735	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:24.383172989 CET	49739	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:24.383215904 CET	443	49739	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:24.383317947 CET	49739	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:24.383331060 CET	49740	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:24.383382082 CET	443	49740	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:24.383997917 CET	49739	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:24.384011984 CET	443	49739	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:24.384027958 CET	49740	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:24.384367943 CET	49740	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:24.384383917 CET	443	49740	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:24.460673094 CET	49743	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:15:24.460715055 CET	443	49743	172.217.18.100	192.168.2.4
Nov 21, 2024 14:15:24.460778952 CET	49743	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:15:24.460982084 CET	49743	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:15:24.460994959 CET	443	49743	172.217.18.100	192.168.2.4
Nov 21, 2024 14:15:24.952671051 CET	49744	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:24.952759027 CET	443	49744	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:24.952842951 CET	49744	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:24.956115961 CET	49744	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:24.956155062 CET	443	49744	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:25.802776098 CET	443	49739	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:25.803201914 CET	49739	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:25.803230047 CET	443	49739	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:25.804387093 CET	443	49739	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:25.804778099 CET	49739	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:25.804935932 CET	443	49740	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:25.804956913 CET	443	49739	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:25.804981947 CET	49739	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:25.805176020 CET	49740	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:25.805224895 CET	443	49740	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:25.806385040 CET	443	49740	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:25.806698084 CET	49740	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:25.806890011 CET	443	49740	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:25.851335049 CET	443	49739	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:25.859916925 CET	49739	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:25.860086918 CET	49740	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:25.949497938 CET	443	49743	172.217.18.100	192.168.2.4
Nov 21, 2024 14:15:25.949754953 CET	49743	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:15:25.949776888 CET	443	49743	172.217.18.100	192.168.2.4
Nov 21, 2024 14:15:25.951433897 CET	443	49743	172.217.18.100	192.168.2.4
Nov 21, 2024 14:15:25.951503038 CET	49743	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:15:25.952533960 CET	49743	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:15:25.952627897 CET	443	49743	172.217.18.100	192.168.2.4
Nov 21, 2024 14:15:26.002159119 CET	49743	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:15:26.002166986 CET	443	49743	172.217.18.100	192.168.2.4
Nov 21, 2024 14:15:26.045646906 CET	49743	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:15:26.459059954 CET	443	49744	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:26.459161997 CET	49744	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:26.462279081 CET	49744	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:26.462301016 CET	443	49744	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:26.462753057 CET	443	49744	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:26.500125885 CET	49744	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:26.547332048 CET	443	49744	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:26.778536081 CET	443	49739	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:26.779565096 CET	443	49739	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:26.779697895 CET	49739	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:26.780102968 CET	49739	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:26.780133009 CET	443	49739	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:26.780145884 CET	49739	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:26.780246019 CET	49739	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:26.802418947 CET	49740	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:26.847337961 CET	443	49740	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:27.016639948 CET	443	49744	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:27.016803026 CET	443	49744	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:27.016824007 CET	49744	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:27.016870975 CET	443	49744	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:27.016891003 CET	49744	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:27.016891003 CET	49744	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:27.016901016 CET	443	49744	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:27.016910076 CET	443	49744	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:27.063163996 CET	49745	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:27.063209057 CET	443	49745	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:27.063273907 CET	49745	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:27.063621998 CET	49745	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:27.063641071 CET	443	49745	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:27.341099024 CET	443	49740	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:27.341923952 CET	49740	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:27.342029095 CET	443	49740	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:27.342113018 CET	49740	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:27.772572041 CET	49746	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:27.772617102 CET	443	49746	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:27.772720098 CET	49746	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:27.772927999 CET	49746	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:27.772939920 CET	443	49746	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:28.516347885 CET	443	49745	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:28.516587019 CET	49745	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:28.518781900 CET	49745	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:28.518793106 CET	443	49745	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:28.519728899 CET	443	49745	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:28.520889997 CET	49745	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:28.567373991 CET	443	49745	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:29.064686060 CET	443	49745	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:29.064882994 CET	443	49745	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:29.065068960 CET	49745	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:29.065839052 CET	49745	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:29.065887928 CET	443	49745	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:29.065917969 CET	49745	443	192.168.2.4	184.28.90.27
Nov 21, 2024 14:15:29.065933943 CET	443	49745	184.28.90.27	192.168.2.4
Nov 21, 2024 14:15:29.236679077 CET	443	49746	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:29.237021923 CET	49746	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:29.237054110 CET	443	49746	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:29.240639925 CET	443	49746	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:29.240722895 CET	49746	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:29.241190910 CET	49746	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:29.241274118 CET	443	49746	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:29.241370916 CET	49746	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:29.241380930 CET	443	49746	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:29.294584990 CET	49746	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:29.776710033 CET	443	49746	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:29.776889086 CET	443	49746	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:29.776967049 CET	49746	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:29.777570963 CET	49746	443	192.168.2.4	69.163.182.142
Nov 21, 2024 14:15:29.777592897 CET	443	49746	69.163.182.142	192.168.2.4
Nov 21, 2024 14:15:33.370549917 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:33.370599985 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:33.370676994 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:33.371798038 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:33.371819019 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:35.120896101 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:35.120989084 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:35.125283003 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:35.125303984 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:35.125761032 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:35.168867111 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:35.753056049 CET	443	49743	172.217.18.100	192.168.2.4
Nov 21, 2024 14:15:35.753240108 CET	443	49743	172.217.18.100	192.168.2.4
Nov 21, 2024 14:15:35.753439903 CET	49743	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:15:36.451714039 CET	49743	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:15:36.451801062 CET	443	49743	172.217.18.100	192.168.2.4
Nov 21, 2024 14:15:36.667922020 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:36.711323023 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:37.245881081 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:37.245951891 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:37.245971918 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:37.246011019 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:37.246061087 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:37.246057987 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:37.246105909 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:37.246149063 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:37.246149063 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:37.246181011 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:37.269740105 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:37.269828081 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:37.269840002 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:37.269891024 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:38.523554087 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:38.523608923 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:38.523643970 CET	49747	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:15:38.523660898 CET	443	49747	4.245.163.56	192.168.2.4
Nov 21, 2024 14:15:39.144395113 CET	49723	80	192.168.2.4	199.232.210.172
Nov 21, 2024 14:15:39.268382072 CET	80	49723	199.232.210.172	192.168.2.4
Nov 21, 2024 14:15:39.268492937 CET	49723	80	192.168.2.4	199.232.210.172
Nov 21, 2024 14:16:14.777831078 CET	49753	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:16:14.777925968 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:14.778053045 CET	49753	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:16:14.778610945 CET	49753	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:16:14.778645992 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:15.298276901 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:15.298321009 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:15.298394918 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:15.298945904 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:15.298962116 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:16.540157080 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:16.540258884 CET	49753	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:16:16.545995951 CET	49753	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:16:16.546008110 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:16.547208071 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:16.564917088 CET	49753	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:16:16.607352972 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:17.086304903 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.086453915 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.087949991 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.087960958 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.088359118 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.098973036 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.139334917 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.236798048 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:17.236830950 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:17.236850977 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:17.236931086 CET	49753	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:16:17.236967087 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:17.236987114 CET	49753	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:16:17.237020016 CET	49753	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:16:17.280668974 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:17.280724049 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:17.280772924 CET	49753	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:16:17.280782938 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:17.280797958 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:17.280822039 CET	49753	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:16:17.280853987 CET	49753	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:16:17.281008959 CET	49753	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:16:17.281023979 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:17.281039000 CET	49753	443	192.168.2.4	4.245.163.56
Nov 21, 2024 14:16:17.281044960 CET	443	49753	4.245.163.56	192.168.2.4
Nov 21, 2024 14:16:17.576323986 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.576361895 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.576426983 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.576445103 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.576512098 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.747661114 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.747705936 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.747904062 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.747925043 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.747978926 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.791913033 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.792095900 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.792135954 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.792149067 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.792226076 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.917901993 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.917958021 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.918054104 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.918071985 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.918121099 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.918144941 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.946511030 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.946556091 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.946707010 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.946724892 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.946767092 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.946794987 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.973843098 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.973887920 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.973948956 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.973963022 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.974004984 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.974036932 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.989828110 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.989880085 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.989928961 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.989943027 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:17.989979029 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:17.990005016 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.107616901 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.107692957 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.107779026 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.107795000 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.107903004 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.126640081 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.126693010 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.126773119 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.126780033 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.126825094 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.126854897 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.146131992 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.146177053 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.146223068 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.146235943 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.146265030 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.146294117 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.161401033 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.161428928 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.161509037 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.161520958 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.161566019 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.172365904 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.172393084 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.172472000 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.172482014 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.172524929 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.183031082 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.183057070 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.183136940 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.183147907 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.183178902 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.199856043 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.199923992 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.199928999 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.199947119 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.199965954 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.200004101 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.200074911 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.200083017 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.200102091 CET	49754	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.200107098 CET	443	49754	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.265027046 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.265120029 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.265235901 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.266084909 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.266166925 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.266279936 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.266644001 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.266678095 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.267205954 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.267241955 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.268419027 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.268466949 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.268675089 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.268757105 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.268776894 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.269412994 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.269452095 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.269581079 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.269967079 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.269989967 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.270067930 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.270090103 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.270107985 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:18.270170927 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:18.270179033 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:19.906430006 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:19.907051086 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:19.907073021 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:19.907461882 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:19.907468081 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.020709991 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.021300077 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.021346092 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.021753073 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.021764994 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.076189041 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.076603889 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.076634884 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.076950073 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.076957941 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.077955961 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.078191042 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.078217983 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.078485966 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.078491926 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.099498987 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.099909067 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.099920988 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.100212097 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.100217104 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.362291098 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.362373114 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.362433910 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.362679005 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.362703085 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.362716913 CET	49758	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.362724066 CET	443	49758	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.365583897 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.365629911 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.365710974 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.365856886 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.365864992 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.472095966 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.472155094 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.472299099 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.472362995 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.472462893 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.472574949 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.472594976 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.472632885 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.472978115 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.473064899 CET	443	49755	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.473121881 CET	49755	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.475387096 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.475421906 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.475500107 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.475792885 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.475806952 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.528026104 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.528208017 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.528286934 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.528336048 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.528352976 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.528363943 CET	49756	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.528368950 CET	443	49756	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.530881882 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.530910969 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.530998945 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.531032085 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.531084061 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.531250954 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.531286955 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.531361103 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.531445980 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.531451941 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.531474113 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.531678915 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.531722069 CET	443	49757	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.531769037 CET	49757	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.532613993 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.532632113 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.534157991 CET	49764	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.534195900 CET	443	49764	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.534287930 CET	49764	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.534424067 CET	49764	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.534437895 CET	443	49764	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.556586027 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.556607962 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.556742907 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.556751966 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.556915998 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.556929111 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.556969881 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.557099104 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.557141066 CET	443	49759	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.557192087 CET	49759	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.559259892 CET	49765	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.559345007 CET	443	49765	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:20.559451103 CET	49765	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.559606075 CET	49765	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:20.559643030 CET	443	49765	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.171227932 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.171905041 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.171928883 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.172439098 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.172444105 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.281251907 CET	443	49765	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.281822920 CET	49765	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.281882048 CET	443	49765	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.282414913 CET	49765	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.282452106 CET	443	49765	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.290476084 CET	443	49764	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.290797949 CET	49764	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.290848017 CET	443	49764	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.291241884 CET	49764	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.291256905 CET	443	49764	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.327851057 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.328473091 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.328500032 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.329257011 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.329262018 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.467660904 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.468518972 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.468611002 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.469928980 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.469945908 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.627139091 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.627341032 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.627460957 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.627552032 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.627598047 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.627635956 CET	49761	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.627651930 CET	443	49761	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.630533934 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.630636930 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.630744934 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.630908012 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.630928993 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.716716051 CET	443	49765	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.716875076 CET	443	49765	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.717056036 CET	49765	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.717056036 CET	49765	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.717056036 CET	49765	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.719554901 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.719628096 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.719718933 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.719870090 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.719885111 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.741872072 CET	443	49764	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.741936922 CET	443	49764	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.742006063 CET	49764	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.745696068 CET	49764	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.745739937 CET	443	49764	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.745776892 CET	49764	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.745790958 CET	443	49764	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.748922110 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.748961926 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.749059916 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.749248028 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.749264002 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.771287918 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.771457911 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.771558046 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.771727085 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.771727085 CET	49762	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.771744967 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.771754026 CET	443	49762	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.774513960 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.774595976 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.774702072 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.774915934 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.774951935 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.922903061 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.922985077 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.923054934 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.923249006 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.923278093 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.923300982 CET	49763	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.923326969 CET	443	49763	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.926645041 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.926692009 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.926784992 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.927035093 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.927042961 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:22.935348988 CET	49765	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:22.935389996 CET	443	49765	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.296395063 CET	49771	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:16:24.296447992 CET	443	49771	172.217.18.100	192.168.2.4
Nov 21, 2024 14:16:24.296555996 CET	49771	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:16:24.296842098 CET	49771	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:16:24.296863079 CET	443	49771	172.217.18.100	192.168.2.4
Nov 21, 2024 14:16:24.444212914 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.444875002 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.444926977 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.445497990 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.445513010 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.458173990 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.458216906 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.458916903 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.458937883 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.459547997 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.459553957 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.459878922 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.459937096 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.460387945 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.460400105 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.619882107 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.620862961 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.620927095 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.621445894 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.621499062 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.717377901 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.717927933 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.717947006 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.718517065 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.718523026 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.887079000 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.887239933 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.887339115 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.887413979 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.887459993 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.887490034 CET	49766	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.887506008 CET	443	49766	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.890561104 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.890609026 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.890672922 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.890801907 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.890820026 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.891951084 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.892108917 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.892168999 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.892245054 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.892245054 CET	49767	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.892287016 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.892316103 CET	443	49767	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.894535065 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.894608974 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.894699097 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.894814014 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.894835949 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.910217047 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.910298109 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.910353899 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.910490990 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.910507917 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.910523891 CET	49768	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.910530090 CET	443	49768	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.912877083 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.912898064 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:24.912975073 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.913100958 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:24.913113117 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:25.081545115 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:25.081708908 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:25.081794977 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:25.081886053 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:25.081886053 CET	49769	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:25.081929922 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:25.081957102 CET	443	49769	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:25.085012913 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:25.085056067 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:25.085143089 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:25.085330963 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:25.085345984 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:25.153297901 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:25.153366089 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:25.153440952 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:25.153641939 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:25.153661966 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:25.153671980 CET	49770	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:25.153678894 CET	443	49770	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:25.156673908 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:25.156740904 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:25.156848907 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:25.157013893 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:25.157047987 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:25.791481972 CET	443	49771	172.217.18.100	192.168.2.4
Nov 21, 2024 14:16:25.792237997 CET	49771	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:16:25.792279005 CET	443	49771	172.217.18.100	192.168.2.4
Nov 21, 2024 14:16:25.792758942 CET	443	49771	172.217.18.100	192.168.2.4
Nov 21, 2024 14:16:25.793107033 CET	49771	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:16:25.793214083 CET	443	49771	172.217.18.100	192.168.2.4
Nov 21, 2024 14:16:25.840995073 CET	49771	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:16:26.434863091 CET	49724	80	192.168.2.4	199.232.210.172
Nov 21, 2024 14:16:26.554811001 CET	80	49724	199.232.210.172	192.168.2.4
Nov 21, 2024 14:16:26.554882050 CET	49724	80	192.168.2.4	199.232.210.172
Nov 21, 2024 14:16:26.647603989 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:26.648224115 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:26.648263931 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:26.648924112 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:26.648936987 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:26.668373108 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:26.668960094 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:26.668991089 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:26.669318914 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:26.669327974 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:26.697268009 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:26.697786093 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:26.697808027 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:26.698453903 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:26.698460102 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:26.941565037 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:26.942138910 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:26.942167044 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:26.942805052 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:26.942819118 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:26.973239899 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:26.973875999 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:26.973925114 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:26.974457979 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:26.974469900 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.083827972 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.083978891 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.084070921 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.084243059 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.084294081 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.084326029 CET	49772	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.084341049 CET	443	49772	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.087523937 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.087563992 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.087672949 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.087876081 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.087888956 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.102541924 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.102714062 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.102794886 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.102936029 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.102936029 CET	49774	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.102952957 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.102976084 CET	443	49774	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.105215073 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.105304956 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.105422020 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.105572939 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.105614901 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.141329050 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.141424894 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.141508102 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.141768932 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.141796112 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.141829014 CET	49773	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.141836882 CET	443	49773	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.145780087 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.145819902 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.145900011 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.146110058 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.146119118 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.395550966 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.395627975 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.395689964 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.395919085 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.395940065 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.395962000 CET	49775	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.395968914 CET	443	49775	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.399350882 CET	49780	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.399374008 CET	443	49780	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.399446964 CET	49780	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.399655104 CET	49780	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.399667025 CET	443	49780	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.416805983 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.416884899 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.416941881 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.417053938 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.417073965 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.417088032 CET	49776	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.417094946 CET	443	49776	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.420140982 CET	49781	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.420188904 CET	443	49781	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:27.420270920 CET	49781	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.420471907 CET	49781	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:27.420485973 CET	443	49781	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:28.820668936 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:28.821192980 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:28.821222067 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:28.821670055 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:28.821677923 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:28.897138119 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:28.897655964 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:28.897675037 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:28.898252010 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:28.898257971 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:28.929991961 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:28.930475950 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:28.930491924 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:28.931025982 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:28.931031942 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.192038059 CET	443	49780	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.192740917 CET	49780	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.192816973 CET	443	49780	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.193253040 CET	49780	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.193268061 CET	443	49780	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.254472017 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.254622936 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.254690886 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.254786015 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.254786015 CET	49777	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.254811049 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.254822969 CET	443	49777	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.257685900 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.257749081 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.257844925 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.258001089 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.258018017 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.295423031 CET	443	49781	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.295929909 CET	49781	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.295964003 CET	443	49781	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.296526909 CET	49781	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.296536922 CET	443	49781	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.344491005 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.344614983 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.344682932 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.344818115 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.344835997 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.344851017 CET	49778	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.344857931 CET	443	49778	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.348067999 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.348114967 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.348220110 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.348377943 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.348395109 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.383183002 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.383258104 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.383307934 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.383440971 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.383471012 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.383482933 CET	49779	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.383490086 CET	443	49779	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.386337042 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.386428118 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.386528015 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.386681080 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.386729002 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.635824919 CET	443	49780	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.635974884 CET	443	49780	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.636040926 CET	49780	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.636141062 CET	49780	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.636141062 CET	49780	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.636188030 CET	443	49780	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.636214018 CET	443	49780	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.638941050 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.639005899 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.639060974 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.639372110 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.639390945 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.748604059 CET	443	49781	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.748686075 CET	443	49781	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.748739004 CET	49781	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.748858929 CET	49781	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.748878002 CET	443	49781	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.748891115 CET	49781	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.748898029 CET	443	49781	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.751683950 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.751765966 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:29.751838923 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.751965046 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:29.751985073 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:30.982840061 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:30.983465910 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:30.983494043 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:30.983931065 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:30.983936071 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.138767958 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.139189959 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.139214039 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.139590025 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.139599085 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.233700037 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.234184027 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.234261036 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.234570980 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.234584093 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.422966003 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.423122883 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.423207998 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.423374891 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.423424006 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.423454046 CET	49782	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.423470974 CET	443	49782	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.426496983 CET	49787	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.426548958 CET	443	49787	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.426639080 CET	49787	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.426852942 CET	49787	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.426871061 CET	443	49787	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.490153074 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.490801096 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.490845919 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.491172075 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.491179943 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.536411047 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.536874056 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.536919117 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.537111044 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.537117958 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.582595110 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.582757950 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.582854986 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.582912922 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.582912922 CET	49783	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.582952023 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.582978964 CET	443	49783	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.585602045 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.585689068 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.585798979 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.585994959 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.586028099 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.689156055 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.689237118 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.689320087 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.689438105 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.689486027 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.689515114 CET	49784	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.689532042 CET	443	49784	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.691808939 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.691895962 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.692054033 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.692168951 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.692192078 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.941596031 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.941654921 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.941737890 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.942082882 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.942082882 CET	49785	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.942105055 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.942133904 CET	443	49785	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.945132017 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.945157051 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.945236921 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.945422888 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.945430994 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.982774973 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.982867956 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.983057976 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.983234882 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.983278990 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.983330965 CET	49786	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.983345985 CET	443	49786	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.985944986 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.985985041 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:31.986078978 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.986274958 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:31.986295938 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.151098013 CET	443	49787	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.151699066 CET	49787	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.151721001 CET	443	49787	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.152118921 CET	49787	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.152126074 CET	443	49787	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.373934031 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.374557972 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.374587059 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.375286102 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.375293016 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.472296000 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.472893953 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.472918987 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.473337889 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.473341942 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.588721037 CET	443	49787	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.588835001 CET	443	49787	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.588913918 CET	49787	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.589158058 CET	49787	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.589180946 CET	443	49787	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.589198112 CET	49787	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.589205027 CET	443	49787	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.592497110 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.592547894 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.592629910 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.592775106 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.592792034 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.724435091 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.724989891 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.725009918 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.725461960 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.725470066 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.772965908 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.773439884 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.773457050 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.773902893 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.773906946 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.817898035 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.818073034 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.818131924 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.818188906 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.818208933 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.818223953 CET	49788	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.818231106 CET	443	49788	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.820818901 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.820858955 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.820945978 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.821101904 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.821119070 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.916635036 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.916723013 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.916779995 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.916912079 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.916924000 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.916935921 CET	49789	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.916939974 CET	443	49789	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.919503927 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.919548988 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:33.919622898 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.919761896 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:33.919778109 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:34.183139086 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:34.183232069 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:34.183384895 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:34.183619022 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:34.183633089 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:34.183651924 CET	49790	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:34.183657885 CET	443	49790	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:34.186503887 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:34.186542988 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:34.186629057 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:34.186814070 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:34.186825991 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:34.216486931 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:34.216557980 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:34.216605902 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:34.216748953 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:34.216764927 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:34.216778040 CET	49791	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:34.216783047 CET	443	49791	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:34.218832970 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:34.218857050 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:34.218930006 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:34.219054937 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:34.219065905 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.376036882 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.376496077 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:35.376523018 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.377124071 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:35.377132893 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.580312967 CET	443	49771	172.217.18.100	192.168.2.4
Nov 21, 2024 14:16:35.580379963 CET	443	49771	172.217.18.100	192.168.2.4
Nov 21, 2024 14:16:35.580465078 CET	49771	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:16:35.639693022 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.642905951 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:35.642929077 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.643528938 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:35.643536091 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.722873926 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.729427099 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:35.729458094 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.729798079 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:35.729805946 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.822576046 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.822660923 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.822721004 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:35.822855949 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:35.822880030 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.822892904 CET	49792	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:35.822900057 CET	443	49792	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.825304031 CET	49797	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:35.825397968 CET	443	49797	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.825491905 CET	49797	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:35.825628996 CET	49797	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:35.825650930 CET	443	49797	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.977149963 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.978037119 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:35.978068113 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:35.978383064 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:35.978389978 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.002345085 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.003117085 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.003160000 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.003576994 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.003585100 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.083924055 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.084085941 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.084178925 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.084350109 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.084372997 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.084392071 CET	49793	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.084402084 CET	443	49793	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.087387085 CET	49798	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.087481976 CET	443	49798	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.087589025 CET	49798	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.087821007 CET	49798	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.087852955 CET	443	49798	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.180566072 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.180740118 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.180883884 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.181246042 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.181314945 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.181351900 CET	49794	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.181366920 CET	443	49794	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.184061050 CET	49799	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.184137106 CET	443	49799	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.184248924 CET	49799	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.184377909 CET	49799	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.184400082 CET	443	49799	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.433232069 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.433418989 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.433566093 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.433926105 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.433948994 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.433964014 CET	49795	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.433973074 CET	443	49795	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.436844110 CET	49800	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.436882019 CET	443	49800	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.436964989 CET	49800	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.437150955 CET	49800	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.437165976 CET	443	49800	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.448071957 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.448162079 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.448230028 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.448309898 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.448345900 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.448374987 CET	49796	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.448390961 CET	443	49796	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.450407028 CET	49801	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.450439930 CET	443	49801	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.450511932 CET	49801	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.450694084 CET	49801	443	192.168.2.4	13.107.246.45
Nov 21, 2024 14:16:36.450716019 CET	443	49801	13.107.246.45	192.168.2.4
Nov 21, 2024 14:16:36.452040911 CET	49771	443	192.168.2.4	172.217.18.100
Nov 21, 2024 14:16:36.452089071 CET	443	49771	172.217.18.100	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 14:15:19.809792995 CET	53	53917	1.1.1.1	192.168.2.4
Nov 21, 2024 14:15:20.027596951 CET	53	61275	1.1.1.1	192.168.2.4
Nov 21, 2024 14:15:21.381128073 CET	49773	53	192.168.2.4	1.1.1.1
Nov 21, 2024 14:15:21.381436110 CET	54859	53	192.168.2.4	1.1.1.1
Nov 21, 2024 14:15:21.788718939 CET	53	54859	1.1.1.1	192.168.2.4
Nov 21, 2024 14:15:21.808063984 CET	53	49773	1.1.1.1	192.168.2.4
Nov 21, 2024 14:15:22.433729887 CET	53	49634	1.1.1.1	192.168.2.4
Nov 21, 2024 14:15:24.232960939 CET	54962	53	192.168.2.4	1.1.1.1
Nov 21, 2024 14:15:24.233108044 CET	61353	53	192.168.2.4	1.1.1.1
Nov 21, 2024 14:15:24.459676027 CET	53	61353	1.1.1.1	192.168.2.4
Nov 21, 2024 14:15:24.459721088 CET	53	54962	1.1.1.1	192.168.2.4
Nov 21, 2024 14:15:27.345937014 CET	50113	53	192.168.2.4	1.1.1.1
Nov 21, 2024 14:15:27.346081018 CET	55853	53	192.168.2.4	1.1.1.1
Nov 21, 2024 14:15:27.767462969 CET	53	50113	1.1.1.1	192.168.2.4
Nov 21, 2024 14:15:27.767939091 CET	53	55853	1.1.1.1	192.168.2.4
Nov 21, 2024 14:15:38.019185066 CET	138	138	192.168.2.4	192.168.2.255
Nov 21, 2024 14:15:39.527447939 CET	53	58257	1.1.1.1	192.168.2.4
Nov 21, 2024 14:15:58.353740931 CET	53	55638	1.1.1.1	192.168.2.4
Nov 21, 2024 14:16:19.796278954 CET	53	53153	1.1.1.1	192.168.2.4
Nov 21, 2024 14:16:20.901684999 CET	53	49827	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 14:15:21.381128073 CET	192.168.2.4	1.1.1.1	0x4aa0	Standard query (0)	www.fadlaldin.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:15:21.381436110 CET	192.168.2.4	1.1.1.1	0x3653	Standard query (0)	www.fadlaldin.com	65	IN (0x0001)	false
Nov 21, 2024 14:15:24.232960939 CET	192.168.2.4	1.1.1.1	0xe341	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:15:24.233108044 CET	192.168.2.4	1.1.1.1	0xa72a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 14:15:27.345937014 CET	192.168.2.4	1.1.1.1	0xd8ab	Standard query (0)	www.fadlaldin.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:15:27.346081018 CET	192.168.2.4	1.1.1.1	0x84a5	Standard query (0)	www.fadlaldin.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 14:15:21.808063984 CET	1.1.1.1	192.168.2.4	0x4aa0	No error (0)	www.fadlaldin.com	69.163.182.142	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:15:24.459676027 CET	1.1.1.1	192.168.2.4	0xa72a	No error (0)	www.google.com		65	IN (0x0001)	false
Nov 21, 2024 14:15:24.459721088 CET	1.1.1.1	192.168.2.4	0xe341	No error (0)	www.google.com	172.217.18.100	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:15:27.767462969 CET	1.1.1.1	192.168.2.4	0xd8ab	No error (0)	www.fadlaldin.com	69.163.182.142	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.fadlaldin.com

https:

fs.microsoft.com

slscr.update.microsoft.com

otelrules.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	69.163.182.142	443	4136	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:15:23 UTC	682	OUT	GET /noodlehead/corpuscular HTTP/1.1 Host: www.fadlaldin.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:15:23 UTC	301	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Nov 2024 13:15:23 GMT Server: Apache Location: https://www.fadlaldin.com/noodlehead/corpuscular/ Cache-Control: max-age=600 Expires: Thu, 21 Nov 2024 13:25:23 GMT Content-Length: 257 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-21 13:15:23 UTC	257	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 64 6c 61 6c 64 69 6e 2e 63 6f 6d 2f 6e 6f 6f 64 6c 65 68 65 61 64 2f 63 6f 72 70 75 73 63 75 6c 61 72 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.fadlaldin.com/noodlehead/corpuscular/">here</a>.</p></body></html

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	69.163.182.142	443	4136	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:15:23 UTC	683	OUT	GET /noodlehead/corpuscular/ HTTP/1.1 Host: www.fadlaldin.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:15:24 UTC	277	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:15:23 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Cache-Control: max-age=600 Expires: Thu, 21 Nov 2024 13:25:23 GMT Vary: Accept-Encoding,User-Agent Content-Length: 3741 Content-Type: text/html; charset=UTF-8
2024-11-21 13:15:24 UTC	3741	IN	Data Raw: 3c 64 69 76 3e 3c 2f 64 69 76 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 62 3e 3c 2f 62 3e 3c 70 20 73 74 79 6c 65 3d 27 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 30 30 30 30 30 30 30 30 30 30 30 34 25 3b 27 3e 73 65 6d 69 6a 6f 69 6e 20 72 65 66 6c 65 63 74 69 76 65 6c 79 20 73 74 65 65 6c 77 6f 72 6b 73 20 63 72 61 6d 70 6f 6e 73 3c 2f 70 3e 3c 70 3e 3c 2f 70 3e 3c 69 3e 3c 2f 69 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 62 20 73 74 79 6c 65 3d 27 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 30 30 30 30 30 30 30 30 30 36 70 78 3b 27 3e 6d 6f 6c 64 65 64 20 6f 75 74 65 72 6d 6f 73 74 20 6d 6f 72 72 6f 77 2f 73 77 69 66 74 6c 79 20 73 6b 61 74 65 62 6f 61 72 64 20 70 69 6d 69 65 6e 74 6f 3c 2f 62 3e 3c 70 3e 3c 2f 70 3e 3c 62 3e 3c 2f 62 3e 3c 62 3e 3c 2f 62 Data Ascii: <div></div><span></span><b></b><p style='font-size: 0.000000000004%;'>semijoin reflectively steelworks crampons</p><p></p><i></i><span></span><b style='font-size: 0.0000000006px;'>molded outermost morrow/swiftly skateboard pimiento</b><p></p><b></b><b></b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	69.163.182.142	443	4136	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:15:25 UTC	1116	OUT	GET /noodlehead/corpuscular/ HTTP/1.1 Host: www.fadlaldin.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://www.fadlaldin.com/noodlehead/corpuscular/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: d=-300; n=America/New_York; sp=Win32; su=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/117.0.0.0%20Safari/537.36; iu=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/117.0.0.0%20Safari/537.36; wd=false
2024-11-21 13:15:26 UTC	258	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:15:26 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Cache-Control: max-age=600 Expires: Thu, 21 Nov 2024 13:25:26 GMT Vary: User-Agent Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:15:26 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 13:15:27 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=185405 Date: Thu, 21 Nov 2024 13:15:26 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	69.163.182.142	443	4136	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:15:26 UTC	973	OUT	GET /favicon.ico HTTP/1.1 Host: www.fadlaldin.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.fadlaldin.com/noodlehead/corpuscular/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: d=-300; n=America/New_York; sp=Win32; su=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/117.0.0.0%20Safari/537.36; iu=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/117.0.0.0%20Safari/537.36; wd=false
2024-11-21 13:15:27 UTC	354	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:15:26 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Last-Modified: Mon, 10 Jun 2024 07:26:27 GMT ETag: "0-61a841140c1ab" Accept-Ranges: bytes Content-Length: 0 Cache-Control: max-age=172800 Expires: Sat, 23 Nov 2024 13:15:26 GMT Vary: User-Agent Content-Type: image/vnd.microsoft.icon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:15:28 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 13:15:29 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=185362 Date: Thu, 21 Nov 2024 13:15:28 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-21 13:15:29 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	69.163.182.142	443	4136	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:15:29 UTC	712	OUT	GET /favicon.ico HTTP/1.1 Host: www.fadlaldin.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: d=-300; n=America/New_York; sp=Win32; su=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/117.0.0.0%20Safari/537.36; iu=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/117.0.0.0%20Safari/537.36; wd=false
2024-11-21 13:15:29 UTC	354	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:15:29 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Last-Modified: Mon, 10 Jun 2024 07:26:27 GMT ETag: "0-61a841140c1ab" Accept-Ranges: bytes Content-Length: 0 Cache-Control: max-age=172800 Expires: Sat, 23 Nov 2024 13:15:29 GMT Vary: User-Agent Content-Type: image/vnd.microsoft.icon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49747	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:15:36 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9y3hzhCsOlFZN8A&MD=aVEpTZ+K HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 13:15:37 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 12c152e1-3fed-40b3-bf06-59eacc7c8e8f MS-RequestId: 8b4eb6b3-720d-462f-938a-c4f7d27c7af9 MS-CV: xy5rir6HXUSUBaBo.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 13:15:36 GMT Connection: close Content-Length: 24490
2024-11-21 13:15:37 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-21 13:15:37 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49753	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:16 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9y3hzhCsOlFZN8A&MD=aVEpTZ+K HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 13:16:17 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: e2ed5bcb-b36d-44db-a271-e451cc145097 MS-RequestId: e8e22f58-04a4-4b67-a2f2-99c261102ef5 MS-CV: QeAyWvdLVEyB/LBi.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 13:16:16 GMT Connection: close Content-Length: 30005
2024-11-21 13:16:17 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-21 13:16:17 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:17 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:17 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:17 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 16:37:24 GMT ETag: "0x8DD08B87243495C" x-ms-request-id: b5254561-a01e-0070-0158-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131617Z-178bfbc474bh5zbqhC1NYCkdug00000001hg000000000dnh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:17 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-21 13:16:17 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-21 13:16:17 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-21 13:16:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-21 13:16:17 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-21 13:16:17 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-21 13:16:17 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-21 13:16:18 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-21 13:16:18 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-21 13:16:18 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:19 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:20 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131620Z-178bfbc474bkvpdnhC1NYCuu2w00000001hg00000000f5v8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:20 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:20 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:20 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:20 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1c744767-001e-0082-6060-3b5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131620Z-178bfbc474bbbqrhhC1NYCvw7400000001h000000000pqcn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:20 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:20 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:20 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:20 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aa7a34d-201e-0096-3676-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131620Z-178bfbc474bmqmgjhC1NYCy16c00000001hg00000000d405 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:20 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:20 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:20 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131620Z-r1d97b99577sdxndhC1TEBec5n0000000ad000000000h5ch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:20 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:20 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:20 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:20 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 7268c357-001e-0066-5863-3b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131620Z-178bfbc474b7cbwqhC1NYC8z4n00000001c000000000fc04 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:20 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:22 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 02a2c6fa-b01e-0001-107b-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131622Z-178bfbc474b9xljthC1NYCtw9400000001fg0000000058vc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:22 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:22 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:22 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3af01634-701e-000d-3dd2-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131622Z-r1d97b99577kk29chC1TEBemmg0000000af0000000008dda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:22 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:22 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:22 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 5e8702c1-301e-000c-0b8f-3b323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131622Z-1777c6cb754n67brhC1TEBcp9c0000000b900000000034t3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:22 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:22 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 30601852-401e-0047-7476-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131622Z-1777c6cb754gvvgfhC1TEBz4rg0000000b4000000000f6y3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:22 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 17c3c293-501e-00a3-6567-3bc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131622Z-178bfbc474bkvpdnhC1NYCuu2w00000001p0000000005uez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:24 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:24 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131624Z-1777c6cb754rz2pghC1TEBghen0000000b20000000007mst x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:24 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:24 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131624Z-178bfbc474bpnd5vhC1NYC4vr400000001dg00000000hsuk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:24 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:24 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 4e7b5ce8-701e-0098-117a-3b395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131624Z-178bfbc474bbcwv4hC1NYCypys00000001c000000000ahm7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:24 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:24 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:24 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131624Z-178bfbc474bpnd5vhC1NYC4vr400000001cg00000000mqt3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:24 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:24 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131624Z-178bfbc474bw8bwphC1NYC38b400000001b000000000bf6v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:26 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131626Z-178bfbc474bvjk8shC1NYC83ns00000001a000000000eg20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:27 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:26 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 44207c53-001e-0079-37ad-3b12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131626Z-r1d97b995778dpcthC1TEB4b540000000aag0000000073bc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:27 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49773	13.107.246.45	443	4136	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:26 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 7fd471a5-f01e-00aa-27bf-3b8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131626Z-r1d97b99577hsvhhhC1TEByb1w00000004p000000000abpd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:26 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:27 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 918e3103-701e-0097-4a7c-3bb8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131627Z-1777c6cb754b7tdghC1TEBwwa40000000bc0000000000n1g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:27 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:26 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:27 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 8b710333-301e-0020-767a-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131627Z-178bfbc474bw8bwphC1NYC38b4000000018000000000khhz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:27 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:28 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 367ebca4-601e-0070-6762-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131629Z-178bfbc474bv7whqhC1NYC1fg400000001mg0000000028qp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:28 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 2b92647c-c01e-00a2-646f-3b2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131629Z-1777c6cb7542p5p4hC1TEBq0980000000b4g000000008sdh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:28 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:29 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131629Z-1777c6cb754vxwc9hC1TEBykgw0000000b600000000060wa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:29 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:29 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 20c6f849-701e-005c-2e61-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131629Z-178bfbc474bxkclvhC1NYC69g400000001f0000000009y6v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:29 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:29 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 947c7cf8-001e-00a2-018c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131629Z-r1d97b995774n5h6hC1TEBvf840000000a9g00000000e6xm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:29 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:30 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:31 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131631Z-178bfbc474bkvpdnhC1NYCuu2w00000001pg00000000320a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:31 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:31 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:31 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 7f65af6f-801e-0067-5f8c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131631Z-1777c6cb754j8gqphC1TEB5bf80000000b4g000000002g4h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:31 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:31 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:31 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131631Z-178bfbc474btvfdfhC1NYCa2en00000001gg00000000fzn8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:31 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:31 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 657669b3-a01e-0002-118c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131631Z-r1d97b9957744xz5hC1TEB5bf80000000a8g00000000b31e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:31 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:31 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 3af7945d-501e-0016-1564-3b181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131631Z-178bfbc474brk967hC1NYCfu6000000001dg000000000mr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:31 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:33 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:33 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131633Z-178bfbc474bbbqrhhC1NYCvw7400000001kg00000000kt0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:33 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:33 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 76e93f39-101e-0034-5559-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131633Z-178bfbc474bbbqrhhC1NYCvw7400000001kg00000000kt17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:33 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:33 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 79192ebf-401e-0035-7e68-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131633Z-178bfbc474b9xljthC1NYCtw9400000001a000000000mtt1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:33 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:33 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131634Z-178bfbc474btrnf9hC1NYCb80g00000001ng00000000ferk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:33 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:34 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131634Z-r1d97b99577dd2gchC1TEBz5ys0000000a5000000000emq8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:34 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:35 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:35 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131635Z-178bfbc474b7cbwqhC1NYC8z4n00000001h0000000000twb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:35 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:35 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:35 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: feb02638-401e-0067-7b8c-3a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131635Z-r1d97b99577kk29chC1TEBemmg0000000aeg000000008q47 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:36 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:35 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:36 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131636Z-1777c6cb754lvj6mhC1TEBke940000000b3g00000000hd03 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:35 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:36 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 792329fd-401e-0035-1f6c-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131636Z-178bfbc474bmqmgjhC1NYCy16c00000001n00000000080ab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:36 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:36 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:36 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131636Z-1777c6cb754mqztshC1TEB4mkc0000000b3g00000000ebts x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:36 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:37 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:37 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: c2180679-501e-008f-16bc-3b9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131637Z-178bfbc474bp8mkvhC1NYCzqnn000000019000000000gaf2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:37 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:37 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:38 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7511d71d-801e-0083-6e8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131638Z-1777c6cb754mrj2shC1TEB6k7w0000000b8000000000bp6x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:38 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:37 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:38 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:38 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 71c2edc3-001e-0082-0fa6-3b5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131638Z-r1d97b99577d6qrbhC1TEBux5s0000000ak0000000006tsv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 13:16:38 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:38 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:38 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e456cfdf-c01e-0014-248c-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131638Z-1777c6cb754g9zd5hC1TEBfvpw0000000bc0000000000h88 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:38 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:16:38 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:16:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:16:38 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: c4abe473-d01e-008e-4d67-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T131638Z-178bfbc474bxkclvhC1NYC69g400000001gg0000000058t1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:16:38 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 5868, Parent PID: 5500

General

Target ID:	0
Start time:	08:15:14
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 4136, Parent PID: 5868

General

Target ID:	2
Start time:	08:15:18
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2016,i,451524844515595830,7794255132247358026,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6312, Parent PID: 5500

General

Target ID:	3
Start time:	08:15:20
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.fadlaldin.com/noodlehead/corpuscular"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.fadlaldin.com/noodlehead/corpuscular

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5868, Parent PID: 5500

General

Chronological Activities

Analysis Process: chrome.exePID: 4136, Parent PID: 5868

General

Chronological Activities

Analysis Process: chrome.exePID: 6312, Parent PID: 5500

General

Chronological Activities

Disassembly

Windows Analysis Report
https://www.fadlaldin.com/noodlehead/corpuscular