Edit tour

Windows Analysis Report
http://www.thegioimoicau.com/

Overview

General Information

Sample URL:	http://www.thegioimoicau.com/
Analysis ID:	1541622
Tags:	urlscan
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6148 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6116 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 --field-trial-handle=2020,i,8993358670009259370,1289488428852012967,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5916 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.thegioimoicau.com/" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

HTTP traffic detected: POST /el/AGSKWxUgPsocCWU3SJl2JMhuICYqNbN4KFHAOxYsOziW893S2ME-NbtrtlvUkaYZpV1iF0fiXRxLjwMkXvdzsS-xwmiL-5zFf4tcF_mEhj9j9_rp7pc3Cc3Uxhnr1lR2rfbGN6Uh0qMxdA== HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-aliveContent-Length: 247sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plainAccept: */*Origin: https://thegioimoicau.comX-Client-Data: CJe2yQEIo7bJAQipncoBCJr0ygEIlqHLAQiFoM0BCLnKzQEIutTNARjymM0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thegioimoicau.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon
Source: https://thegioimoicau.com/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.10:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.10:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.10:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:49835 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: chromecache_441.2.dr, chromecache_238.2.dr	String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},lk:function(){e=zb()},ud:function(){d()}}};var gc=ma(["data-gtm-yt-inspected-"]),pD=["www.youtube.com","www.youtube-nocookie.com"],qD,rD=!1; equals www.youtube.com (Youtube)
Source: chromecache_441.2.dr, chromecache_238.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=WA(a,c,e);U(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return U(122),!0;if(d&&f){for(var m=Kb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},ZA=function(){var a=[],b=function(c){return pb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_441.2.dr, chromecache_238.2.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={rh:e,ph:f,qh:g,bi:k,di:m,Je:n,Fb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(AD(w,"iframe_api")\|\|AD(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!rD&&yD(x[A],p.Je))return xc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_441.2.dr, chromecache_238.2.dr	String found in binary or memory: var CC=function(a,b,c,d,e){var f=tA("fsl",c?"nv.mwt":"mwt",0),g;g=c?tA("fsl","nv.ids",[]):tA("fsl","ids",[]);if(!g.length)return!0;var k=yA(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);U(121);if(m==="https://www.facebook.com/tr/")return U(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!fz(k,hz(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.thegioimoicau.com
Source: global traffic	DNS traffic detected: DNS query: thegioimoicau.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: googletagmanager.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: fundingchoicesmessages.google.com
Source: global traffic	DNS traffic detected: DNS query: s0.2mdn.net
Source: global traffic	DNS traffic detected: DNS query: x.bidswitch.net
Source: global traffic	DNS traffic detected: DNS query: match.prod.bidr.io
Source: global traffic	DNS traffic detected: DNS query: c1.adform.net
Source: global traffic	DNS traffic detected: DNS query: sync.srv.stackadapt.com
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: rtb.mfadsrvr.com
Source: global traffic	DNS traffic detected: DNS query: dclk-match.dotomi.com
Source: global traffic	DNS traffic detected: DNS query: a.tribalfusion.com
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: pr-bh.ybp.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: dsp.adkernel.com
Source: global traffic	DNS traffic detected: DNS query: gw-iad-bid.ymmobi.com
Source: global traffic	DNS traffic detected: DNS query: s.tribalfusion.com
Source: global traffic	DNS traffic detected: DNS query: fw.adsafeprotected.com
Source: global traffic	DNS traffic detected: DNS query: choices.truste.com
Source: global traffic	DNS traffic detected: DNS query: ad.turn.com
Source: global traffic	DNS traffic detected: DNS query: cms.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: pm.w55c.net
Source: global traffic	DNS traffic detected: DNS query: um.simpli.fi
Source: global traffic	DNS traffic detected: DNS query: ads.travelaudience.com
Source: global traffic	DNS traffic detected: DNS query: b1sync.zemanta.com
Source: global traffic	DNS traffic detected: DNS query: choices.trustarc.com
Source: global traffic	DNS traffic detected: DNS query: sync-tm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: tr.blismedia.com
Source: global traffic	DNS traffic detected: DNS query: dis.criteo.com
Source: global traffic	DNS traffic detected: DNS query: r.turn.com
Source: global traffic	DNS traffic detected: DNS query: dt.adsafeprotected.com
Source: global traffic	DNS traffic detected: DNS query: static.adsafeprotected.com
Source: global traffic	DNS traffic detected: DNS query: widget.us.criteo.com
Source: global traffic	DNS traffic detected: DNS query: dsum-sec.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: ads.revjet.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: ep1.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: ep2.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: cdn.revjet.com
Source: global traffic	DNS traffic detected: DNS query: pix.revjet.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 --field-trial-handle=2020,i,8993358670009259370,1289488428852012967,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.thegioimoicau.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 --field-trial-handle=2020,i,8993358670009259370,1289488428852012967,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://ep2.adtrafficquality.google	0%	URL Reputation	safe
https://fundingchoicesmessages.google.com/i/$	0%	URL Reputation	safe
http://ns.attribution.com/ads/1.0/	0%	URL Reputation	safe
https://cdn.ampproject.org/amp4ads-host-v0.js	0%	URL Reputation	safe
https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar2&v=232	0%	URL Reputation	safe
http://mathiasbynens.be/	0%	URL Reputation	safe
https://ep2.adtrafficquality.google/sodar/$	0%	URL Reputation	safe
http://google.com	100%	URL Reputation	malware

Name	Source	Malicious	Antivirus Detection	Reputation
https://adclick.g.doubleclick.net/aclk?nis	chromecache_387.2.dr	false		unknown
https://stats.g.doubleclick.net/g/collect	chromecache_441.2.dr, chromecache_238.2.dr	false	URL Reputation: safe	unknown
https://aa.agkn.com/adscores/g.json?sid=	chromecache_319.2.dr, chromecache_338.2.dr	false		unknown
https://googleads.g.doubleclick.net/pagead/images/abg/iconx2-000000.png"	chromecache_270.2.dr, chromecache_272.2.dr, chromecache_485.2.dr, chromecache_352.2.dr, chromecache_465.2.dr, chromecache_283.2.dr, chromecache_573.2.dr, chromecache_564.2.dr, chromecache_446.2.dr, chromecache_321.2.dr, chromecache_566.2.dr, chromecache_426.2.dr, chromecache_535.2.dr, chromecache_532.2.dr, chromecache_529.2.dr, chromecache_456.2.dr, chromecache_316.2.dr, chromecache_526.2.dr, chromecache_536.2.dr, chromecache_254.2.dr, chromecache_374.2.dr	false		unknown
https://www.google.com/url?ct	chromecache_313.2.dr, chromecache_387.2.dr, chromecache_285.2.dr, chromecache_365.2.dr	false		unknown
https://adssettings.google.com/whythisad?source=display	chromecache_566.2.dr, chromecache_526.2.dr, chromecache_254.2.dr, chromecache_577.2.dr	false		unknown
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm	chromecache_342.2.dr	false		unknown
https://ep2.adtrafficquality.google	chromecache_586.2.dr	false	URL Reputation: safe	unknown
https://www.kayak.com/semi/gdntext/hotel_destination/19811/en.html%3Fz_sig%3Df510155a9ddc627c%26z_tr	chromecache_387.2.dr	false		unknown
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_547.2.dr	false		unknown
http://preferences-mgr.trustarc.com/?pid=honda01&aid=honda01&cid=RPA_31800219_213080731_391535610&w=	chromecache_263.2.dr	false		unknown
https://fundingchoicesmessages.google.com/i/$	chromecache_508.2.dr, chromecache_491.2.dr	false	URL Reputation: safe	unknown
https://adclick.g.doubleclick.net/aclk?nis=4&sa=l&ai=CoG4jUc8aZ6K9Dvyzx_APqraP-ArcrOnheZzR8u	chromecache_573.2.dr	false		unknown
http://ns.attribution.com/ads/1.0/	chromecache_561.2.dr, chromecache_333.2.dr, chromecache_397.2.dr	false	URL Reputation: safe	unknown
https://cdn.ampproject.org/amp4ads-host-v0.js	chromecache_508.2.dr, chromecache_491.2.dr	false	URL Reputation: safe	unknown
https://adclick.g.doubleclick.net/aclk?nis=4&sa=l&ai=C_RsiUc8aZ_mND9mB_NUP2oWJ6AbcrOnheZzR8u	chromecache_504.2.dr	false		unknown
https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar2&v=232	chromecache_586.2.dr	false	URL Reputation: safe	unknown
https://googleads.g.doubleclick.net/pagead/images/mtad/back_blue.png	chromecache_313.2.dr, chromecache_387.2.dr, chromecache_285.2.dr, chromecache_365.2.dr	false		unknown
https://googleads.g.doubleclick.net/pagead/images/mtad/abg_blue.png"	chromecache_270.2.dr, chromecache_272.2.dr, chromecache_485.2.dr, chromecache_352.2.dr, chromecache_465.2.dr, chromecache_283.2.dr, chromecache_573.2.dr, chromecache_564.2.dr, chromecache_446.2.dr, chromecache_321.2.dr, chromecache_566.2.dr, chromecache_426.2.dr, chromecache_535.2.dr, chromecache_532.2.dr, chromecache_529.2.dr, chromecache_456.2.dr, chromecache_316.2.dr, chromecache_526.2.dr, chromecache_536.2.dr, chromecache_254.2.dr, chromecache_374.2.dr	false		unknown
https://googleads.g.doubleclick.net/pagead/images/mtad/x_blue.png	chromecache_313.2.dr, chromecache_387.2.dr, chromecache_285.2.dr, chromecache_365.2.dr	false		unknown
https://choices.trustarc.com/assets/forward_i.png	chromecache_284.2.dr, chromecache_263.2.dr	false		unknown
https://choices.trustarc.com/camsg?	chromecache_284.2.dr, chromecache_263.2.dr	false		unknown
https://securepubads.g.doubleclick.net/pagead/js/cocar.js	chromecache_508.2.dr, chromecache_491.2.dr	false		unknown
http://mathiasbynens.be/	chromecache_508.2.dr, chromecache_491.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/adsense/search/async-ads.js	chromecache_508.2.dr, chromecache_491.2.dr	false		unknown
https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpix	chromecache_342.2.dr	false		unknown
https://googleads.g.doubleclick.net/pagead/images/abg/iconx2-000000.png	chromecache_313.2.dr, chromecache_387.2.dr, chromecache_285.2.dr, chromecache_365.2.dr	false		unknown
http://googleads.g.doubleclick.net	chromecache_508.2.dr, chromecache_398.2.dr, chromecache_472.2.dr, chromecache_491.2.dr	false		unknown
https://googleads.g.doubleclick.net/pagead/images/mtad/abg_blue.png	chromecache_313.2.dr, chromecache_387.2.dr, chromecache_285.2.dr, chromecache_365.2.dr	false		unknown
https://ep2.adtrafficquality.google/sodar/$	chromecache_508.2.dr, chromecache_491.2.dr	false	URL Reputation: safe	unknown
https://adclick.g.doubleclick.net/aclk?nis=4&sa=l&ai=CORV-Uc8aZ82pDp7V1PIPoc_WoQncrOnheZzR8u	chromecache_270.2.dr	false		unknown
https://adclick.g.doubleclick.net/aclk?nis=4&sa=l&ai=CHaVYUc8aZ_mND9mB_NUP2oWJ6AbcrOnheZzR8u	chromecache_504.2.dr	false		unknown
https://github.com/blueimp/JavaScript-MD5	chromecache_383.2.dr, chromecache_576.2.dr	false		unknown
https://adclick.g.doubleclick.net/aclk?nis=4&sa=l&ai=CZGCSUc8aZ82pDp7V1PIPoc_WoQncrOnheZzR8u	chromecache_270.2.dr	false		unknown
https://adclick.g.doubleclick.net/aclk?nis=4&sa=l&ai=CubdjUc8aZ82pDp7V1PIPoc_WoQncrOnheZzR8u	chromecache_270.2.dr	false		unknown
https://choices.trustarc.com/cair?	chromecache_284.2.dr, chromecache_263.2.dr	false		unknown
https://www.kayak.com/semi/gdntext/hotel_destination/60564/en.html%3Fz_sig%3D0ce41ca2faf1435e%26z_tr	chromecache_387.2.dr	false		unknown
http://google.com	chromecache_508.2.dr, chromecache_491.2.dr	true	URL Reputation: malware	unknown
https://adclick.g.doubleclick.net/aclk?nis=4&sa=l&ai=CjyZ-Uc8aZ_mND9mB_NUP2oWJ6AbcrOnheZzR8u	chromecache_504.2.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
35.190.0.66	ads.travelaudience.com	United States	15169	GOOGLEUS	false
103.110.86.98	thegioimoicau.com	Viet Nam	63760	AZDIGI-AS-VNAZDIGICorporationVN	false
52.210.194.151	firewall-external-2134955858.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
104.18.37.193	s.tribalfusion.com	United States	13335	CLOUDFLARENETUS	false
54.196.229.231	sync.srv.stackadapt.com	United States	14618	AMAZON-AESUS	false
54.74.69.9	ds-pr-bh.ybp.gysm.yahoodns.net	United States	16509	AMAZON-02US	false
34.241.33.46	match.prod.bidr.io	United States	16509	AMAZON-02US	false
185.89.210.20	ib.anycast.adnxs.com	Germany	29990	ASN-APPNEXUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.72	unknown	United States	15169	GOOGLEUS	false
142.250.186.33	unknown	United States	15169	GOOGLEUS	false
35.214.199.88	dorpat.geo.iponweb.net	United States	19527	GOOGLE-2US	false
174.137.133.49	dsp.adkernel.com	United States	27257	WEBAIR-INTERNETUS	false
3.33.220.150	match.adsrvr.org	United States	8987	AMAZONEXPANSIONGB	false
13.32.121.5	choices.truste.com	United States	16509	AMAZON-02US	false
18.244.18.32	choices.trustarc.com	United States	16509	AMAZON-02US	false
172.217.18.6	s0.2mdn.net	United States	15169	GOOGLEUS	false
172.64.150.63	a.tribalfusion.com	United States	13335	CLOUDFLARENETUS	false
18.66.112.44	d162h6x3rxav67.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
104.18.36.155	dsum-sec.casalemedia.com	United States	13335	CLOUDFLARENETUS	false
192.229.233.6	fp2df3.wac.edgecastcdn.net	United States	15133	EDGECASTUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
91.228.74.159	global.px.quantserve.com	United Kingdom	27281	QUANTCASTUS	false
168.119.2.148	unknown	Germany	24940	HETZNER-ASDE	false
47.253.61.56	bid-iad-static.yeahtargeter.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
172.217.16.196	unknown	United States	15169	GOOGLEUS	false
13.32.121.100	unknown	United States	16509	AMAZON-02US	false
35.214.136.108	user-data-eu.bidswitch.net	United States	19527	GOOGLE-2US	false
18.244.18.68	unknown	United States	16509	AMAZON-02US	false
35.204.74.118	um.simpli.fi	United States	15169	GOOGLEUS	false
172.217.18.14	www3.l.google.com	United States	15169	GOOGLEUS	false
216.58.206.34	unknown	United States	15169	GOOGLEUS	false
3.214.191.164	unknown	United States	14618	AMAZON-AESUS	false
46.228.164.11	presentation-ams1.turn.com	United Kingdom	56396	TURNGB	false
37.27.168.162	pix.revjet.com	Iran (ISLAMIC Republic Of)	39232	UNINETAZ	false
18.164.52.35	unknown	United States	3	MIT-GATEWAYSUS	false
185.89.210.82	unknown	Germany	29990	ASN-APPNEXUS	false
142.250.185.162	ep1.adtrafficquality.google	United States	15169	GOOGLEUS	false
65.21.116.58	unknown	United States	199592	CP-ASDE	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541622
Start date and time:	2024-10-25 00:49:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.thegioimoicau.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@25/597@150/52
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 21:50:27 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9810975212816526
Encrypted:	false
SSDEEP:	48:8LLSbd4TsjHyidAKZdA1uehwiZUklqehay+3:8LL1w3Zy
MD5:	501B27C7FD09EEF0F44F7F3A81889260
SHA1:	33600B61932D3F6F6FD3EBCC4D41EA2C1A0B9F05
SHA-256:	8287ED749349DD3F6791D583AE66DA343AB55AACD453179A7E3A1D2F012F78B6
SHA-512:	B3466077A13DF613103C3B85E1C2CDC585B817D07C82195DFC1BCD647E2973690600C55C257B2A93E73EC2A9D7A0ACF30427B046D6EBD142C28148EE1A6FB05A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........g&......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IXYL.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXYL.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VXYL.....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VXYL............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VXYN.....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........u..H.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Name	Malicious	Reputation
https://sync.srv.stackadapt.com/sync?nid=154&google_push=AXcoOmTGUn2d59sI70_Gm6klHzGPKTbzoahfFc_fxWRNIweIAormRrrwAaWqW7NNPvwDDkiAtM-6f413dDRaxczHun2LTGL1PuZzKQ	false	unknown
https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJ9ZbrL4jSDriq-mlGEW95s&google_cver=1&google_push=AXcoOmRrsBAfZgi42_meSRecrJsww8xbGl96WtJjdXea4ipJwFawX8xWRyHHJsHNn_tyd2eDbf98cbm1Tb6V--S68h03BRsGqGFJPPGw	false	unknown
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ2Mg8q32YU_nVFZo_fpiTxxGnfoJgCeZKpMWK8ika1rRYyku-yO-QZFwyrt1b2hPvlsm5VR0F-_snxOjJH9NiCCjTM4A	false	unknown
https://fundingchoicesmessages.google.com/el/AGSKWxV2fITIUIOwuchkLapnLrhrtW2Q-xTG1KFqWdKBP1t5KtpZZWX7eH1NMwAWJMr7IMjxXHOAeHNh8jhkwEbKMQZnljRETH20QZnbe-GTpEWBBkYff5ZatTFgsl3NEybTyHKYZjKj1A==	false	unknown
https://ads.travelaudience.com/google_pixel?google_gid=CAESEHSj3W0BGgsgwpkd_flJolo&google_cver=1&google_push=AXcoOmSO6jkyCtpLGLDNuCyrkKMzxJ7BfviVXmYAXIWxx3AmhSTIpAWoD7vLmFf32uzjs0C5qzJFFstGl6uWMcib5Cm-IdIlI_Flerg	false	unknown
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D	false	unknown
https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEHYM27RnSZKn-PAfcEzzWDw&google_cver=1&google_push=AXcoOmR7yXlBchgjewOFgJEYa0dLaRIAUknXz4M6pwzosrLPozUWc-UPhTmjqJ3WI1tuBgLHi7lOcbpsTq9CijrhoziQprnmb2gdZag	false	unknown
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRM4JmzsOE-RREl71654ar1nJsKgvqRvKejJwo0aRFuit5yWd77s5OXA9_A6ae8hpsdkU6UqYfP3TcU00giHd2ZCD61bw	false	unknown
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESEP4-V-kfCk7V98PClFf0kG4&google_cver=1&google_push=AXcoOmTPQxHXjkSRC576JM1en4heSfmvqatlriOcrdoUCeNAWEHddsazsP_iejmk9LS_rHSaEjjGtfYoSCmxVdNc9MpteS74EhEohjI&_bee_ppp=1	false	unknown
https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJ9ZbrL4jSDriq-mlGEW95s&google_cver=1&google_push=AXcoOmSf_LDAR85MvrMmcNr0EcxGKzUnZz4fOGjsmSpZo-SIv7RPrRteTHt2LXhX8ThdFGn-cbXG3mSc5p4BhuxL8_r9P6AM5Nl6xVc	false	unknown
https://thegioimoicau.com/fonts/Roboto-Regular.ttf	false	unknown
https://thegioimoicau.com/media/media.css?version=8.3	false	unknown
https://dt.adsafeprotected.com/dt?advEntityId=2123525&asId=6df8cfc7-668f-8daf-299b-ce2118a1652d&tv=%7Bc:s4XROk,pingTime:-3,time:86,type:v,sca:%7Blts:2024-10-24%2018.51.32%7D,clog:%5B%7Bpiv:0,vs:o,r:r.h,w:0,h:0,t:55%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:87,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:55,wc:0.0.1280.984,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,bkn:%7Bpiv:%5B62~0%5D,as:%5B62~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:usafHCe+11%7C12%7C131%7C132%7C14%7C15%7C16%7C17%7C181%7C191%7C1a1%7C1b1%7C1c1%7C1d1%7C1e%7C1f%7C1g1.2123525-80746924%7C1g11%7C1g12%7C1g13,idMap:1g1,rmeas:1,rend:0,renddet:svg.us,siq:57%7D&br=c	false	unknown
https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQjanrYMSHB_TzPqUpNo6C7GbPF_hnNUJuyripjuN1ob5um_RJw6_3G4iiEZyhmGSbLot5ccoJfvf8Gf5olr-rNDF9VXyGvHr9F&google_gid=CAESECpLJTRVbjNFJrNuFTTvIGs&google_cver=1	false	unknown
https://www.google.com/ads/measurement/l?ebcid=ALh7CaS9G8y4us8Zs3S-Bg_q_BHn98CSQL6TwrV6IMgv0ytSxVJ5mYfsIk3pBwJbvEa9SRU9_8ljGsJs-47MeABfae5KFdxiZA	false	unknown
https://x.bidswitch.net/sync?ssp=google&google_gid=CAESED2rpEL-1Y-qdfuTNhkolyc&google_cver=1&google_push=AXcoOmQzGzTkyRHUNGEKEhYynMKg4xUfyG15Ouyq5XMBR3wK11LFefysJcyFVxrvejVv83RQ0HJqycNJ5nQd0WBW9z_Cbh59ncV3hMg	false	unknown
https://fundingchoicesmessages.google.com/f/AGSKWxUeH-_xuUgmmMvvzRKNcl-C3xJECknb5MeZDJQEuwL9rLGcyUIVN9_ma-K5hRbi8UZ6mWfuIZUWg0bvgvsDahQSwyHnwmmL2nherhqMk2nMSPAG1Wnc4is8Znmq9OEjWLCv7bOtNfWC9r2E6bDPqJ_MlQSvKjFXGKcQ9pO0_dmr8de6ZGmeC_632sO7/_-Ad300x250./getarticleadvertimageservlet?/adspf./admaster.-160x600_	false	unknown
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQN-e-Gk_NwQ3wRMHiS_KBXMgjgPwzU8CldO9U6TeV8lAzERPmIk1z8pcSJ6IYaN4uN9HyHF3_BQLhvqXU0tl2DGA83lQ	false	unknown
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESEP4-V-kfCk7V98PClFf0kG4&google_cver=1&google_push=AXcoOmTjMIOeaN2vgKg03Awlsp4Vtn-hyazlqTRD_kcRW08AQhyN72tU_iUvfFrPb-rPF8DmRk06T2AS9MNAxkJFgYNNJAIpwSBXvTw	false	unknown
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESEP4-V-kfCk7V98PClFf0kG4&google_cver=1&google_push=AXcoOmRK7vNQUgqZwMv5SULY6bGpF0Iy-iZ934kfJvoUSpPo6PBvQpRz_TJP4AyGDOYX-oA6CSNjhYQ282SEGh71u23PF5WXIXA5	false	unknown
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFipXlLmhtQMLBnbhEbt78w&google_cver=1&google_hm=2	false	unknown
https://thegioimoicau.com/media/header.js?version=2.9	false	unknown
https://widget.us.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQjanrYMSHB_TzPqUpNo6C7GbPF_hnNUJuyripjuN1ob5um_RJw6_3G4iiEZyhmGSbLot5ccoJfvf8Gf5olr-rNDF9VXyGvHr9F&google_gid=CAESECpLJTRVbjNFJrNuFTTvIGs&google_cver=1	false	unknown
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESEP4-V-kfCk7V98PClFf0kG4&google_cver=1&google_push=AXcoOmS9MkPJFZaZwUnbnbb1D7DOSY0SqBQ-zL5XyV7Ta9fjMgy02cSQlNdI2lcb2bxdiyTZRz2z910C2cvXdQJQX683ASNzEinhOuk	false	unknown
https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESED6imYohnizqdW62IHmgbVI&google_cver=1&google_push=AXcoOmSkk7jVLFCfLHCyPhp5-xWeGwBYp4smqNc90qlXZQJa9xV54A0Ax4ui3HQxJZRyhaAYLm_U5x1ic1cQ9rj9wKBgxWKcflmUuC_Y	false	unknown
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQtF89VO3q63qkPxRuIXGZlVxUxRj9_hr11WWFtHh2YRla-auOGPXk7BD1anEXOwBLvynL5xJPuHlxhL8lgLXshSxQclA	false	unknown
https://thegioimoicau.com/media/header.png	false	unknown
https://rtb.mfadsrvr.com/sync?ssp=bidswitch&bidswitch_ssp_id=google&bsw_user_id=09fbe915-b501-4643-bc79-c6e21996b95f&gdpr=&gdpr_consent=&us_privacy=	false	unknown
https://ad.turn.com/r/cs?pid=3&google_gid=CAESEKDAA2Vn_FcK24jJBqXdjZ8&google_cver=1&google_push=AXcoOmS1crN5d1VwGJschLq_5oX_LrhaOad7aTwLKv5fqTPUnyLtPq-VQuAqLZ13uM9MjkxS-dihztuwVObBUJgNOk7ZPAc-l2kAXbc	false	unknown
https://um.simpli.fi/gp_match?google_gid=CAESELU2E-ylZrHX8FkpcHqr1vM&google_cver=1&google_push=AXcoOmRPdup5CO02HiaWzmICGsScGu6teYb5H9TbUoEjZFdc9VwkuUV7ZbeI7Ec-SGZYU_a4oOo0wQVSbOxHumsJUg1ZQqdy48ABb30	false	unknown
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESED6imYohnizqdW62IHmgbVI&google_cver=1&google_push=AXcoOmQ9abEC2W1zE5sZ6H-V0vxM6Jifuq4pcClOddz1bFS5Oyvq4Yqsk09EDHOWY3lgYg9fyDGcCOgJO5gQRiUsYcDljhz828DcsKI	false	unknown
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESEP4-V-kfCk7V98PClFf0kG4&google_cver=1&google_push=AXcoOmQEU_ahWguzh2mlyzIK_BrLdpaRyWUjB2etwbJ_RMmQaBSRw4XMB-ubz3spZQhQL9xnzGCKUTStScYVE6hpo1uC2WEjfSN3CPMw	false	unknown
https://googletagmanager.com/gtag/js?id=G-XMWZYM87V8	false	unknown
https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEDf5UwX-9k6q9QFJs0SXgak&google_cver=1&google_push=AXcoOmTBcZEa_LmQjDsiQh_Q7oStPbEeOZCN6rz20HCr6gKbYWJgXN804cqKwhvrN3pMq82pIFQPZHUQHR5z4dmTqAcyHhErkrFLog	false	unknown
https://fundingchoicesmessages.google.com/el/AGSKWxVMsVikZf41KIJXOZG9Z_1Fv6BY18VmEs6UPCd1xtucGKIySIjxzhJrxbYMPQ6MYRoVrkhlT4KTwUL6vhVUvSYrUFI_zz4r1GOn3ZtGlKmg91BXVhhsNZPTuWrm9zSUu5zlTRmlBQ==	false	unknown
https://widget.us.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmT1u5Ie4kVKIaqvzp5WySOvuywZhWhuj27VNq7q2R1r9uHjElysGPBhs9l190BawV_60F-07vLqA3xQhKMoWS3P7363Au6jxYE&google_gid=CAESECpLJTRVbjNFJrNuFTTvIGs&google_cver=1	false	unknown
https://thegioimoicau.com/media/pace.css?version=2.2	false	unknown
https://cdn.revjet.com/~cdn/JS/03/elements-2.17.0.js	false	unknown
https://fw.adsafeprotected.com/rjss/st/2123525/80746924/skeleton.js	false	unknown
https://gw-iad-bid.ymmobi.com/adx/user/cookie_syn?pubid=Z29vZ2xlYWR4&google_gid=CAESEJlVZtgVno9vDrW-W2UGJ2c&google_cver=1&google_push=AXcoOmT9x2y2VUMadb0k6kaa8tfPrPk3TpjgFuhGfheUmhkrEF-qBxmhS9PRVSRO6PBAceXlwzGanUa7Ylxt8QCJZ9H5auBs7uslGcc	false	unknown
https://ads.travelaudience.com/google_pixel?google_gid=CAESEHSj3W0BGgsgwpkd_flJolo&google_cver=1&google_push=AXcoOmSSfAB7PFS7y_BnoKCphT4-eYiXU1BP_SMwj1K6i6Zcuvd0Cy0MkzeAbIRz4ti6Lb6VqhDJg_9RIOPbM631u-NZU_plG_L9EsrO	false	unknown
https://fundingchoicesmessages.google.com/f/AGSKWxWuZ6ZHt1weZMjDJojTREKyQ4zWmqkNP2o8oOu0N32QfwjZOO2G9F-tvyO5npEr1q4-OKyvhktHJhGt-LFX_DmOc4B-Ms3el330yYBE68j6nmtoz-Clzw0MBuc9-24SF4_4nH8gqw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI5ODEwMjcwLDUxNzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly90aGVnaW9pbW9pY2F1LmNvbS8iLG51bGwsW1s4LCJaN2Z4VnpXY0hLNCJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ	false	unknown
https://ib.adnxs.com/setuid?entity=101&code=CAESENEj9yHEbobBZ84UR4VL-JQ&google_cver=1	false	unknown
https://fundingchoicesmessages.google.com/el/AGSKWxVXX5xZgUSb9_TecLEkbDJjoCdi6fLNHiSl5VA5HOpDI07ptTJ8MsxY3zurPPDyBluCUeQNXqWqraZZQvL-u8QsPBBUM9d52h_N7RcqEEDZbwH8KZNq0fUnEV3BBuMW0nsEfrdugg==	false	unknown
https://fundingchoicesmessages.google.com/f/AGSKWxX3mlE3kjloDgEtsr2-BrPQANCImedcD52GbvLGngjm1jXfMN3o4_FQkGuRiXSNTgFZXBpipThmmhrxuF1zoZPN5hQ-3xAb1RedkVTC868HcXnGFA5rBW0LwNl3NNchKpYTGxSaJg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI5ODEwMjc1LDQ3NjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly90aGVnaW9pbW9pY2F1LmNvbS8iLG51bGwsW1s4LCJaN2Z4VnpXY0hLNCJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ	false	unknown
https://match.adsrvr.org/track/cmf/google?google_gid=CAESEI2G8qVv0micU0d2sC3w-Mc&google_cver=1&google_push=AXcoOmTze3Y84nn34u6FPUimI0cy4WKRZ51wT-_88zpAFX7gql2vFVaKHsAYD6TrR9jIW3q_2KsCKDitP3yD7a9PF8FjYPajk5k-UyGd	false	unknown
https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEHYM27RnSZKn-PAfcEzzWDw&google_cver=1&google_push=AXcoOmSfu11-feSrpebfYNzHwK4mULsIXgZl_DApWnk7Fxx6CAxYHT2k-7jkHvaVSBpnyCJB6_iASRWa-zDTN-ni6v_p5fjqDQlBPigi	false	unknown
https://match.prod.bidr.io/cookie-sync/adx?google_gid=CAESEP4-V-kfCk7V98PClFf0kG4&google_cver=1&google_push=AXcoOmTaKaeIRpxltOa5opfm2khJv-cHrYdwY8DPIS-EyKBgCJFzEF7s08rARzEE6NK7dhJrK2vPGq7UTm5g0rl9r_O7ZZ_Bj3K_a134	false	unknown
https://x.bidswitch.net/sync?ssp=google&google_gid=CAESED2rpEL-1Y-qdfuTNhkolyc&google_cver=1&google_push=AXcoOmRoRXvcSsHluy9woN4z9BB8PRsExdVV0GmfVw_MLbQBuvdqQi3B79obyU34pK99mxOvheUzBh8HeGLxwwX6mcgTeoWTL6k_9I5x	false	unknown
https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEEWBp1fqXhOHUHKJiAh22UY&google_cver=1&google_push=AXcoOmReF2ofc_8mO5MdXqIHOEh9HSCQApSlLb02IMIF_hmQ3gKYloVapD8YACTmpGCss7NZCB5-UzQMiOvKwwjck6j-sI_5DY8iVL4	false	unknown
https://ad.turn.com/r/cs?pid=3&google_gid=CAESEKDAA2Vn_FcK24jJBqXdjZ8&google_cver=1&google_push=AXcoOmRxbHbw628vF63uxnHllbobtfj9B_UO--iPjOLv_QREqOVQrvwGaw6yKRfnNk4NjVrKGSCtMl6z8gf-7idrxR_MuUgCPopoxZiT	false	unknown
https://fundingchoicesmessages.google.com/f/AGSKWxURKZIcY7JUUXuH-leSk6pnGf52MRlEOZIk6MX4KVSsZ7TGKomZihR7dN8KNKjkMhBBOz13sX8eFwpr-AlYLDrbAYS2UsUDDhS3FFK16ln10TXBiqfO1FCIX42bRnnWJo6TVQ5fIQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI5ODEwMjQ2LDUzMDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbN11dLCJodHRwczovL3RoZWdpb2ltb2ljYXUuY29tLyIsbnVsbCxbWzgsIlo3ZnhWeldjSEs0Il0sWzksImVuLVVTIl0sWzE4LCJbW1swXV1dIl0sWzE5LCIyIl0sWzE3LCJbMF0iXV1d	false	unknown
https://ads.revjet.com/tag314028?_key=bd0&_plc_id=195252930&ct_url=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsuV1pGepDHrMi2Gn96wDY3JDZl36ubIwGSEd8lPg9RJL8NdzSe_heR_wsYFJ6WF7RlrOn9NjcgJUz6JLzNsXjwcobign0ZRhI9jTrZ37xjXny5axaVGluAq3LrxTZ9WedAUHd93nJb1jpChqdArQpJsvXVfB_zJMLVNJ6o7psbodfTHVxEdDMA8-FnuEL-xdrwVyQL7-mQlPOJ9H05uOhrwOK0w1A3amkl3ssAD_E4jiiLBrjOPhbuzYfyjQWTrWtI-pGX2YYsngTsrsRBATPrt_pT66RNcSFK9MHs7HUNjFBLXcA4TuU2Klk_sFBm9ND_sEuK78EXAKULCux_qUxsOWP_L71aD0JJo0tZzYTMFRcRJRp0HoV2Q7GgZta-B_dPEATMblBsZfWQl1lfBhuIEnkYjhbyQpq42EcVMNbi_Sb-NZ0QjlfzhowcQYKJUmJr05Tp7BP8n5oCvIIMbgT9KR1XKiL9tJEjWsl3esUKJ5mBqjXuHaljZHzjmCtkGYpA6qWn7Xm627mvb5j6E0LF018VvxuXrZL-femWWEBOJendcFSmsbCXlPOLo3fmGWL8Py0iJtUxuPX3BlaBpIf2Lz3w0T_-O8ylwvfKU4h-TMwuIo-9lDqIhpySsWLoPwwKlr8IvuhTssFra1dX4O5HzBilI8RWKog1ji8Roq_xgKco9WKBJ5Vrs3FVFpbCIn5P5QhMeqCmiehw8-nn-Uv2-O-9I_MtoRCvzmm9renSn5EqhSUD1jjPh9ZUJqzAy4mkx8deRIrndsHs6ArTGSsYq1xn1DVx0yv9EiRySp14AItQiDCyyB3G28ceM78R9V5SKQnYmy6xXfqdLSsc9Qjt4GqshMqPj91nOcifo2F9Pb3hYYWv-vtaojna9VTCLvAjDTvQwRlKX8L3N1feG2VFcZh39Q9D6nfdATGJ41opB-KoFAuYxTJIxTXg-vWdykMdw0bos0Tww4uVYhZpsSRVXo47--A5z2si9JdwEdqcE7xwveE94R66Wyg20M3S-vFPAt3o4k9rkbtc7wi4erIQC9X7hp6G_7mlQ40G04IQre85moCjCSCMb1PiGk_RR7EXA4pF-Lw5QjL85zw-u-QR2l5rDzFeejV5yS2uj0EtfCN1VLoOm4hOLnzAXuPhqPJUz6IHGXltsZEJFkaT57N50a31YNIZRnLmFefKpaQCcFCtJ-X2D1DnO5AL0S_1IQ4yxdlQsk8oTK7MiX7UR6gbSNwIrQek5sjycfUizWb40SvOpdXt_omAAn9pv0kuXAsS8nAChIwtEseETP0DFbvB5qbv0EcM03Hf1Vrw6zTHzdvG7lIXmWwlDnk83LGaoOf8JiysNV5w-zeY1yQ%26sai%3DAMfl-YQ_f5mZAK1fwkfcWGnvy91dqALPGy2PpCsRFuIbRF3ByHcWIVKjj5YW6lQdd4Kqroa16ej5hnLnDzCrNP31o5XsYzmhMT9j8Bb_AJIDJhc7cBk1udObRPkqDkM0k3vIT24TWJy8XMkMl2AkFZMuqhj9u58w29nKxRrISMB_iyUFjzzSoTibtjpf9NFzkkA1s8WEu3D_CNPbOGpn3BUVzrgiKb3t6clbxTwRdmzB-8ElTvFOC8uHBVbkzHcg3M54iQqoxTHkqUShJ0dqpfR9v62TaPckiX0vW6py%26sig%3DCg0ArKJSzDOJIwMWTmCmEAE%26fbs_aeid%3D%255Bgw_fbsaeid%255D%26urlfix%3D1%26adurl%3D&eadv=4114413&esid=1986407&epid=397104853&ebuy=32087818&ecid=218065980&eaid=589547347&eenv=j&dcm_uid=0&dcm_site=N8821.1355339GOOGLE.COMDDMBIDMAN&jsonp=REVJET_TagObj_1.onLoad&_js_site_page=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20241023%2Fr20190131%2Fzrt_lookup_fy2021.html%23RS-0-%26adk%3D1812271808%26client%3Dca-pub-8216143311496088%26fa%3D8%26ifi%3D14%26uci%3Da!e&_js_site_ref=https%3A%2F%2Fthegioimoicau.com%2F&_js_device_w=1280&_js_device_h=1024&_js_tag_freq=1&_js_vis_type=8&_js_measurable=1&_js_imp_banner_number=1&_js_imp_offsetx=0&_js_imp_offsety=0&_js_imp_vis=1&_js_sf=0&_js_fif=0&_js_imp_banner_topframe=1&_js_embd_tag_id=revjet-tag-1184043270&_js_ao=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fthegioimoicau.com&_js_imp_banner_creative_attr=banner&_js_imp_tsver=3.5.8&_js_tstamp=1729810299451	false	unknown
https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEHYM27RnSZKn-PAfcEzzWDw&google_cver=1&google_push=AXcoOmT9Fbkh0yp9ivlHasyCVffmuB3sbIDA6RWrFINIo3fiEdXgDwxdZH-leut3lM85zb0Du2my1iuhsdR9aRW6RvM0AqnLQaU8xGU	false	unknown
https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESED6imYohnizqdW62IHmgbVI&google_cver=1&google_push=AXcoOmQ9abEC2W1zE5sZ6H-V0vxM6Jifuq4pcClOddz1bFS5Oyvq4Yqsk09EDHOWY3lgYg9fyDGcCOgJO5gQRiUsYcDljhz828DcsKI	false	unknown
https://ep2.adtrafficquality.google/sodar/sodar2.js	false	unknown
https://pix.revjet.com/interaction/1000?__ads=50da365b4c4485f2b9761c05065a8f1c&__adt=8128153360359181796&__ade=1&vid=5136979909444010049&__imps_time=1729810300993	false	unknown
https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEHYM27RnSZKn-PAfcEzzWDw&google_cver=1&google_push=AXcoOmSOhP0yBgxDKvu2TZKfPhyi1BagWUMyfUnEluFPptymtE7XuQYkiRof-LALOXt5oq8khhuKIlXss3x2HQriTHQ4kBgX1LibUYQw	false	unknown
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQnkkex0Nn3kzk3f91nSdh9Wp-1VarABzvfuEJ3DDptPChbylfycjvLCPTMqhdLgzFGn0mS6JYxEx3BNzKTFF9kM8B2sA	false	unknown
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSwCObjyWFMk4t3yJOuRE-AqacVsr1QFydaAg24Hc_bscpWggfCGrWWCzzETrLYwTHaJF6n_8F93ZWTf9XGq7aQJzdMcw	false	unknown
https://fw.adsafeprotected.com/rfw/st/2123525/80746924/4.js?adContainerId=gcc_ac8aZ47qNrOQjuwPn_akeA&cbFunctionName=goog_wrapCb_ac8aZ47qNrOQjuwPn_akeA&true_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2Fpassback_300x600.js&adsafe_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2F4a.js&adsafe_url=https%3A%2F%2Fthegioimoicau.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fthegioimoicau.com%2F&adsafe_type=c&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20241023%2Fr20190131%2Fzrt_lookup_fy2021.html&adsafe_type=d&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20241023%2Fr20190131%2Fzrt_lookup_fy2021.html%23RS-0-%26adk%3D1812271808%26client%3Dca-pub-8216143311496088%26fa%3D8%26ifi%3D14%26uci%3Da!e&adsafe_type=be&adsafe_jsinfo=,id:6df8cfc7-668f-8daf-299b-ce2118a1652d,c:s4XRNP,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-f64dbd694-5s9t2,rg:ie,pt:1-5-15,wc:0.0.1280.984,ac:NaN.NaN.0.0,am:sp,cc:0.0.0.0,piv:0,obst:0,th:0,reas:r.h,mu:10000,br:c,bru:c,an:n,oam:0,mtim:16,mot:0,app:0,maw:0,tdt:s,fm:usafHCe+11%7C12%7C131%7C132%7C14%7C15%7C16%7C17%7C181%7C191%7C1a1%7C1b1%7C1c1%7C1d1%7C1e%7C1f%7C1g1.2123525-80746924%7C1g11%7C1g12%7C1g13,idMap:1g1,ex:e2,pl:CV8L.CV8L.CV8L.CV8L.CV8L,rmeas:1,rend:0,renddet:svg.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:56,oid:82f15342-925a-11ef-95e5-9ae4e0023c2a,v:19.8.544,sp:0,st:0,fwm:0,wr:1280.984,sr:1280.1024,ff:1,ov:0	false	unknown

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 00:50:27.187134981 CEST	192.168.2.10	1.1.1.1	0xe5fc	Standard query (0)	www.thegioimoicau.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:27.187365055 CEST	192.168.2.10	1.1.1.1	0x9375	Standard query (0)	www.thegioimoicau.com	65	IN (0x0001)	false
Oct 25, 2024 00:50:29.250931978 CEST	192.168.2.10	1.1.1.1	0x6c2c	Standard query (0)	thegioimoicau.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:29.253978968 CEST	192.168.2.10	1.1.1.1	0xb04f	Standard query (0)	thegioimoicau.com	65	IN (0x0001)	false
Oct 25, 2024 00:50:30.135171890 CEST	192.168.2.10	1.1.1.1	0xd62a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:30.135427952 CEST	192.168.2.10	1.1.1.1	0x6044	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 25, 2024 00:50:33.530438900 CEST	192.168.2.10	1.1.1.1	0x3fe8	Standard query (0)	thegioimoicau.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:33.530677080 CEST	192.168.2.10	1.1.1.1	0xaf18	Standard query (0)	thegioimoicau.com	65	IN (0x0001)	false
Oct 25, 2024 00:50:34.554306030 CEST	192.168.2.10	1.1.1.1	0x1565	Standard query (0)	thegioimoicau.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:34.555042982 CEST	192.168.2.10	1.1.1.1	0x2b6c	Standard query (0)	thegioimoicau.com	65	IN (0x0001)	false
Oct 25, 2024 00:50:35.724503040 CEST	192.168.2.10	1.1.1.1	0xc3c6	Standard query (0)	googletagmanager.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:35.725675106 CEST	192.168.2.10	1.1.1.1	0x8770	Standard query (0)	googletagmanager.com	65	IN (0x0001)	false
Oct 25, 2024 00:50:36.587850094 CEST	192.168.2.10	1.1.1.1	0x6864	Standard query (0)	thegioimoicau.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:37.602428913 CEST	192.168.2.10	1.1.1.1	0x6864	Standard query (0)	thegioimoicau.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:38.263369083 CEST	192.168.2.10	1.1.1.1	0x9bb0	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:38.266370058 CEST	192.168.2.10	1.1.1.1	0xe538	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Oct 25, 2024 00:50:38.652105093 CEST	192.168.2.10	1.1.1.1	0x6864	Standard query (0)	thegioimoicau.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:40.208297968 CEST	192.168.2.10	1.1.1.1	0x523b	Standard query (0)	googletagmanager.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:40.208686113 CEST	192.168.2.10	1.1.1.1	0xb246	Standard query (0)	googletagmanager.com	65	IN (0x0001)	false
Oct 25, 2024 00:50:41.065459013 CEST	192.168.2.10	1.1.1.1	0x9b10	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:41.065459013 CEST	192.168.2.10	1.1.1.1	0xdda8	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Oct 25, 2024 00:50:41.081789970 CEST	192.168.2.10	1.1.1.1	0x6864	Standard query (0)	thegioimoicau.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:43.314539909 CEST	192.168.2.10	1.1.1.1	0xfffb	Standard query (0)	thegioimoicau.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:43.314977884 CEST	192.168.2.10	1.1.1.1	0xb2fb	Standard query (0)	thegioimoicau.com	65	IN (0x0001)	false
Oct 25, 2024 00:50:43.967745066 CEST	192.168.2.10	1.1.1.1	0xf2a	Standard query (0)	fundingchoicesmessages.google.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:43.967928886 CEST	192.168.2.10	1.1.1.1	0xf9f5	Standard query (0)	fundingchoicesmessages.google.com	65	IN (0x0001)	false
Oct 25, 2024 00:50:46.464442968 CEST	192.168.2.10	1.1.1.1	0x6aff	Standard query (0)	fundingchoicesmessages.google.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:46.464658022 CEST	192.168.2.10	1.1.1.1	0x21f2	Standard query (0)	fundingchoicesmessages.google.com	65	IN (0x0001)	false
Oct 25, 2024 00:50:48.531636953 CEST	192.168.2.10	1.1.1.1	0x9dbc	Standard query (0)	s0.2mdn.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:48.532049894 CEST	192.168.2.10	1.1.1.1	0x8d91	Standard query (0)	s0.2mdn.net	65	IN (0x0001)	false
Oct 25, 2024 00:50:56.689905882 CEST	192.168.2.10	1.1.1.1	0x3d1e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:56.690265894 CEST	192.168.2.10	1.1.1.1	0x6f16	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 25, 2024 00:50:57.254550934 CEST	192.168.2.10	1.1.1.1	0xb918	Standard query (0)	thegioimoicau.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:58.582461119 CEST	192.168.2.10	1.1.1.1	0xc1ac	Standard query (0)	x.bidswitch.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:58.582717896 CEST	192.168.2.10	1.1.1.1	0x5403	Standard query (0)	x.bidswitch.net	65	IN (0x0001)	false
Oct 25, 2024 00:50:58.584680080 CEST	192.168.2.10	1.1.1.1	0xdb93	Standard query (0)	match.prod.bidr.io	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:58.584680080 CEST	192.168.2.10	1.1.1.1	0x3202	Standard query (0)	match.prod.bidr.io	65	IN (0x0001)	false
Oct 25, 2024 00:50:58.590796947 CEST	192.168.2.10	1.1.1.1	0xce7c	Standard query (0)	c1.adform.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:58.590797901 CEST	192.168.2.10	1.1.1.1	0xd44d	Standard query (0)	c1.adform.net	65	IN (0x0001)	false
Oct 25, 2024 00:50:58.596307993 CEST	192.168.2.10	1.1.1.1	0xd6ec	Standard query (0)	sync.srv.stackadapt.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:58.597868919 CEST	192.168.2.10	1.1.1.1	0xba1a	Standard query (0)	cm.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:50:58.597868919 CEST	192.168.2.10	1.1.1.1	0x5b94	Standard query (0)	sync.srv.stackadapt.com	65	IN (0x0001)	false
Oct 25, 2024 00:50:58.598047018 CEST	192.168.2.10	1.1.1.1	0x4948	Standard query (0)	cm.g.doubleclick.net	65	IN (0x0001)	false
Oct 25, 2024 00:51:03.701778889 CEST	192.168.2.10	1.1.1.1	0x39	Standard query (0)	cm.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:03.702013016 CEST	192.168.2.10	1.1.1.1	0x10e1	Standard query (0)	cm.g.doubleclick.net	65	IN (0x0001)	false
Oct 25, 2024 00:51:15.451136112 CEST	192.168.2.10	1.1.1.1	0xdaa7	Standard query (0)	rtb.mfadsrvr.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:15.451323986 CEST	192.168.2.10	1.1.1.1	0x3768	Standard query (0)	rtb.mfadsrvr.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:18.995708942 CEST	192.168.2.10	1.1.1.1	0x9530	Standard query (0)	thegioimoicau.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:25.723706961 CEST	192.168.2.10	1.1.1.1	0x850b	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:25.724244118 CEST	192.168.2.10	1.1.1.1	0x6ea4	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Oct 25, 2024 00:51:27.578732967 CEST	192.168.2.10	1.1.1.1	0x96cd	Standard query (0)	dclk-match.dotomi.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:27.579885960 CEST	192.168.2.10	1.1.1.1	0xbde9	Standard query (0)	dclk-match.dotomi.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:27.613897085 CEST	192.168.2.10	1.1.1.1	0x7e93	Standard query (0)	a.tribalfusion.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:27.614561081 CEST	192.168.2.10	1.1.1.1	0xa479	Standard query (0)	a.tribalfusion.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:27.620877981 CEST	192.168.2.10	1.1.1.1	0x57ab	Standard query (0)	match.adsrvr.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:27.621990919 CEST	192.168.2.10	1.1.1.1	0xaca	Standard query (0)	match.adsrvr.org	65	IN (0x0001)	false
Oct 25, 2024 00:51:27.622570038 CEST	192.168.2.10	1.1.1.1	0xf504	Standard query (0)	pr-bh.ybp.yahoo.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:27.622872114 CEST	192.168.2.10	1.1.1.1	0x44d1	Standard query (0)	pr-bh.ybp.yahoo.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:27.628468990 CEST	192.168.2.10	1.1.1.1	0x8804	Standard query (0)	dsp.adkernel.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:27.629093885 CEST	192.168.2.10	1.1.1.1	0xb80c	Standard query (0)	dsp.adkernel.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:27.630069971 CEST	192.168.2.10	1.1.1.1	0x32a6	Standard query (0)	gw-iad-bid.ymmobi.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:27.630516052 CEST	192.168.2.10	1.1.1.1	0x383c	Standard query (0)	gw-iad-bid.ymmobi.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:29.715065002 CEST	192.168.2.10	1.1.1.1	0x6618	Standard query (0)	s.tribalfusion.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:29.715368032 CEST	192.168.2.10	1.1.1.1	0xf56e	Standard query (0)	s.tribalfusion.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:30.311201096 CEST	192.168.2.10	1.1.1.1	0xc467	Standard query (0)	fw.adsafeprotected.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:30.311618090 CEST	192.168.2.10	1.1.1.1	0xb00a	Standard query (0)	fw.adsafeprotected.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:30.313865900 CEST	192.168.2.10	1.1.1.1	0x766c	Standard query (0)	choices.truste.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:30.314327955 CEST	192.168.2.10	1.1.1.1	0x8a80	Standard query (0)	choices.truste.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:30.542777061 CEST	192.168.2.10	1.1.1.1	0xc2e7	Standard query (0)	ad.turn.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:30.543251038 CEST	192.168.2.10	1.1.1.1	0x106a	Standard query (0)	ad.turn.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:30.544549942 CEST	192.168.2.10	1.1.1.1	0x20d5	Standard query (0)	cms.quantserve.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:30.545296907 CEST	192.168.2.10	1.1.1.1	0x8fff	Standard query (0)	cms.quantserve.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:30.546190977 CEST	192.168.2.10	1.1.1.1	0x33f0	Standard query (0)	pm.w55c.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:30.546740055 CEST	192.168.2.10	1.1.1.1	0xa2c3	Standard query (0)	pm.w55c.net	65	IN (0x0001)	false
Oct 25, 2024 00:51:30.549632072 CEST	192.168.2.10	1.1.1.1	0xbd15	Standard query (0)	um.simpli.fi	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:30.551981926 CEST	192.168.2.10	1.1.1.1	0xe6f7	Standard query (0)	um.simpli.fi	65	IN (0x0001)	false
Oct 25, 2024 00:51:30.552901983 CEST	192.168.2.10	1.1.1.1	0x830a	Standard query (0)	ads.travelaudience.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:30.553781033 CEST	192.168.2.10	1.1.1.1	0xb6fd	Standard query (0)	ads.travelaudience.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:30.558321953 CEST	192.168.2.10	1.1.1.1	0xce19	Standard query (0)	b1sync.zemanta.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:30.559360027 CEST	192.168.2.10	1.1.1.1	0xefdb	Standard query (0)	b1sync.zemanta.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:31.412528038 CEST	192.168.2.10	1.1.1.1	0x42ab	Standard query (0)	s.tribalfusion.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:31.412808895 CEST	192.168.2.10	1.1.1.1	0x7c8	Standard query (0)	s.tribalfusion.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:32.987663031 CEST	192.168.2.10	1.1.1.1	0xf1cb	Standard query (0)	choices.trustarc.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:32.988089085 CEST	192.168.2.10	1.1.1.1	0xb30d	Standard query (0)	choices.trustarc.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:33.245420933 CEST	192.168.2.10	1.1.1.1	0xe014	Standard query (0)	sync-tm.everesttech.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:33.245584011 CEST	192.168.2.10	1.1.1.1	0xcaab	Standard query (0)	sync-tm.everesttech.net	65	IN (0x0001)	false
Oct 25, 2024 00:51:33.291996002 CEST	192.168.2.10	1.1.1.1	0x5b2d	Standard query (0)	tr.blismedia.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:33.292146921 CEST	192.168.2.10	1.1.1.1	0x9f8a	Standard query (0)	tr.blismedia.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:33.357341051 CEST	192.168.2.10	1.1.1.1	0x93c	Standard query (0)	dis.criteo.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:33.357816935 CEST	192.168.2.10	1.1.1.1	0xa408	Standard query (0)	dis.criteo.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:33.609561920 CEST	192.168.2.10	1.1.1.1	0x3b50	Standard query (0)	r.turn.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:33.609740019 CEST	192.168.2.10	1.1.1.1	0xdb91	Standard query (0)	r.turn.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:33.898776054 CEST	192.168.2.10	1.1.1.1	0xbc0a	Standard query (0)	dt.adsafeprotected.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:33.898986101 CEST	192.168.2.10	1.1.1.1	0xa36b	Standard query (0)	dt.adsafeprotected.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:33.969461918 CEST	192.168.2.10	1.1.1.1	0xf76e	Standard query (0)	static.adsafeprotected.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:33.969810009 CEST	192.168.2.10	1.1.1.1	0xe542	Standard query (0)	static.adsafeprotected.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:35.096122980 CEST	192.168.2.10	1.1.1.1	0xcd78	Standard query (0)	widget.us.criteo.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:35.096535921 CEST	192.168.2.10	1.1.1.1	0xc83c	Standard query (0)	widget.us.criteo.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:35.106934071 CEST	192.168.2.10	1.1.1.1	0x79b2	Standard query (0)	dsum-sec.casalemedia.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:35.107085943 CEST	192.168.2.10	1.1.1.1	0x387d	Standard query (0)	dsum-sec.casalemedia.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:35.323458910 CEST	192.168.2.10	1.1.1.1	0x7ce1	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:35.323674917 CEST	192.168.2.10	1.1.1.1	0xc666	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:36.260678053 CEST	192.168.2.10	1.1.1.1	0x76fd	Standard query (0)	ads.revjet.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:36.260848045 CEST	192.168.2.10	1.1.1.1	0xbdd2	Standard query (0)	ads.revjet.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:36.711561918 CEST	192.168.2.10	1.1.1.1	0x971a	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:36.713227987 CEST	192.168.2.10	1.1.1.1	0x23c9	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:38.544303894 CEST	192.168.2.10	1.1.1.1	0x6696	Standard query (0)	ep1.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:38.544452906 CEST	192.168.2.10	1.1.1.1	0x3c00	Standard query (0)	ep1.adtrafficquality.google	65	IN (0x0001)	false
Oct 25, 2024 00:51:39.709105968 CEST	192.168.2.10	1.1.1.1	0xed67	Standard query (0)	a.tribalfusion.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:39.709275961 CEST	192.168.2.10	1.1.1.1	0xc497	Standard query (0)	a.tribalfusion.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:39.727058887 CEST	192.168.2.10	1.1.1.1	0xaa75	Standard query (0)	choices.truste.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:39.727334976 CEST	192.168.2.10	1.1.1.1	0x5ad9	Standard query (0)	choices.truste.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:39.902000904 CEST	192.168.2.10	1.1.1.1	0xcb0d	Standard query (0)	ep2.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:39.902282953 CEST	192.168.2.10	1.1.1.1	0x18b6	Standard query (0)	ep2.adtrafficquality.google	65	IN (0x0001)	false
Oct 25, 2024 00:51:40.029860020 CEST	192.168.2.10	1.1.1.1	0x7388	Standard query (0)	fw.adsafeprotected.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:40.030025005 CEST	192.168.2.10	1.1.1.1	0xbba1	Standard query (0)	fw.adsafeprotected.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:40.071408987 CEST	192.168.2.10	1.1.1.1	0x540f	Standard query (0)	choices.trustarc.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:40.071723938 CEST	192.168.2.10	1.1.1.1	0x82b5	Standard query (0)	choices.trustarc.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:40.083240986 CEST	192.168.2.10	1.1.1.1	0x3a10	Standard query (0)	r.turn.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:40.083384991 CEST	192.168.2.10	1.1.1.1	0xab5b	Standard query (0)	r.turn.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:40.086919069 CEST	192.168.2.10	1.1.1.1	0x9e6e	Standard query (0)	dt.adsafeprotected.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:40.087250948 CEST	192.168.2.10	1.1.1.1	0xf1b7	Standard query (0)	dt.adsafeprotected.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:40.106441975 CEST	192.168.2.10	1.1.1.1	0xba4c	Standard query (0)	static.adsafeprotected.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:40.106585026 CEST	192.168.2.10	1.1.1.1	0x9cb0	Standard query (0)	static.adsafeprotected.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:40.107872963 CEST	192.168.2.10	1.1.1.1	0xb1c4	Standard query (0)	widget.us.criteo.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:40.108020067 CEST	192.168.2.10	1.1.1.1	0x4d7c	Standard query (0)	widget.us.criteo.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:40.110735893 CEST	192.168.2.10	1.1.1.1	0xcfb6	Standard query (0)	sync-tm.everesttech.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:40.110946894 CEST	192.168.2.10	1.1.1.1	0x281a	Standard query (0)	sync-tm.everesttech.net	65	IN (0x0001)	false
Oct 25, 2024 00:51:40.137172937 CEST	192.168.2.10	1.1.1.1	0xb74d	Standard query (0)	dsum-sec.casalemedia.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:40.137339115 CEST	192.168.2.10	1.1.1.1	0xbf25	Standard query (0)	dsum-sec.casalemedia.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:40.625808954 CEST	192.168.2.10	1.1.1.1	0xf088	Standard query (0)	ads.revjet.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:40.626177073 CEST	192.168.2.10	1.1.1.1	0xf725	Standard query (0)	ads.revjet.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:40.638109922 CEST	192.168.2.10	1.1.1.1	0x6794	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:40.638379097 CEST	192.168.2.10	1.1.1.1	0x4253	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:40.792357922 CEST	192.168.2.10	1.1.1.1	0x8f01	Standard query (0)	ep1.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:40.793179989 CEST	192.168.2.10	1.1.1.1	0xcabd	Standard query (0)	ep1.adtrafficquality.google	65	IN (0x0001)	false
Oct 25, 2024 00:51:40.995131016 CEST	192.168.2.10	1.1.1.1	0x4a79	Standard query (0)	thegioimoicau.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:41.348735094 CEST	192.168.2.10	1.1.1.1	0x826d	Standard query (0)	ep2.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:41.348891020 CEST	192.168.2.10	1.1.1.1	0x24ea	Standard query (0)	ep2.adtrafficquality.google	65	IN (0x0001)	false
Oct 25, 2024 00:51:41.609052896 CEST	192.168.2.10	1.1.1.1	0x2c09	Standard query (0)	ep2.adtrafficquality.google	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:41.609261990 CEST	192.168.2.10	1.1.1.1	0x24cb	Standard query (0)	ep2.adtrafficquality.google	65	IN (0x0001)	false
Oct 25, 2024 00:51:41.660171986 CEST	192.168.2.10	1.1.1.1	0xe578	Standard query (0)	cdn.revjet.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:41.660391092 CEST	192.168.2.10	1.1.1.1	0xb74f	Standard query (0)	cdn.revjet.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:41.661726952 CEST	192.168.2.10	1.1.1.1	0x5b6a	Standard query (0)	pix.revjet.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:41.661912918 CEST	192.168.2.10	1.1.1.1	0x9d3f	Standard query (0)	pix.revjet.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:42.008570910 CEST	192.168.2.10	1.1.1.1	0x4a79	Standard query (0)	thegioimoicau.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:43.026839018 CEST	192.168.2.10	1.1.1.1	0x5f3b	Standard query (0)	pix.revjet.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:43.027013063 CEST	192.168.2.10	1.1.1.1	0x7208	Standard query (0)	pix.revjet.com	65	IN (0x0001)	false
Oct 25, 2024 00:51:44.346780062 CEST	192.168.2.10	1.1.1.1	0x30	Standard query (0)	cdn.revjet.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:51:44.346915960 CEST	192.168.2.10	1.1.1.1	0x7bd7	Standard query (0)	cdn.revjet.com	65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 00:50:28.039680958 CEST	436	OUT	GET / HTTP/1.1 Host: www.thegioimoicau.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 25, 2024 00:50:29.046127081 CEST	377	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 24 Oct 2024 22:50:28 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://thegioimoicau.com/ Server: Nginx X-Powered-By: DLEMP Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:25 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:25 UTC	561	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:25 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 23 Oct 2024 06:30:03 GMT ETag: "0x8DCF32C20D7262E" x-ms-request-id: 39f98116-901e-0015-0fb5-25b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225025Z-16849878b78p8hrf1se7fucxk800000000g0000000007n64 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:25 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-24 22:50:25 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-24 22:50:26 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-24 22:50:26 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-24 22:50:26 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-24 22:50:26 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-24 22:50:26 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-24 22:50:26 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-24 22:50:26 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-24 22:50:26 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:27 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:27 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:27 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fdb61705-b01e-0001-2f09-2246e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225027Z-16849878b78ngdnlw4w0762cms00000008dg00000000fcpw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:27 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:27 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:27 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:27 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 331d1c77-401e-0029-354e-229b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225027Z-16849878b78z5q7jpbgf6e9mcw00000008h0000000004e5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 22:50:27 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:27 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:27 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 52fc638d-b01e-0070-36c5-201cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225027Z-16849878b78smng4k6nq15r6s4000000014g00000000kn7u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:27 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:27 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:27 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 626c88a9-b01e-003d-54f3-24d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225027Z-15b8d89586fsx9lfqmgrbzpgmg0000000f9000000000bbkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:27 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:27 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:27 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:27 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 23ba7a24-801e-0015-5af3-24f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225027Z-17c5cb586f6hhlf5mrwgq3erx800000000ng000000009aug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:27 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:28 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:28 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7aa3dd97-101e-005a-6a20-26882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225028Z-17c5cb586f6qt228zy1nuwhy2g00000001v00000000023ew x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.thegioimoicau.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 227

Chrome Cache Entry: 228

Chrome Cache Entry: 229

Chrome Cache Entry: 230

Chrome Cache Entry: 231

Chrome Cache Entry: 232

Chrome Cache Entry: 233

Chrome Cache Entry: 234

Chrome Cache Entry: 235

Chrome Cache Entry: 236

Chrome Cache Entry: 237

Chrome Cache Entry: 238

Chrome Cache Entry: 239

Chrome Cache Entry: 240

Chrome Cache Entry: 241

Chrome Cache Entry: 242

Chrome Cache Entry: 243

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 246

Windows Analysis Report
http://www.thegioimoicau.com/

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:28 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: d919e2dc-e01e-001f-153d-261633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225028Z-r197bdfb6b466qclztvgs64z10000000011g00000000k472 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:28 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: e5fe76b8-601e-0050-2e06-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225028Z-r197bdfb6b4g24ztpxkw4umce8000000013000000000rmm2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:28 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:28 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: b0d76b6d-d01e-002b-3e84-2525fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225028Z-15b8d89586ffsjj9qb0gmb1stn00000003s000000000hpv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:28 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:28 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:28 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 0a92035d-201e-00aa-57da-213928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225028Z-16849878b78dsttbr1qw36rxs800000008f0000000002ur8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:28 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:28 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225028Z-16849878b78rjhv97f3nhawr7s00000008bg000000006vt1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:28 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:29 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: a568b4a7-501e-0035-1a18-26c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225029Z-17c5cb586f6tq56f8fz96wddtg00000001wg00000000279e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:28 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 802631a9-901e-002a-57ad-247a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225029Z-15b8d89586fcvr6p5956n5d0rc00000005m0000000002exv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:28 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:29 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: d7788b78-601e-0084-2f37-266b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225029Z-16849878b78hz7zj8u0h2zng1400000008hg000000000g7w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 22:50:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:29 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: e4cbed29-601e-0002-4328-26a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225029Z-17c5cb586f6qk7x5scs1ghy2m400000001tg000000003n5d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:50:30 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:50:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:50:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3edebaab-e01e-0033-21c8-214695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T225030Z-16849878b78k8q5pxkgux3mbgg00000008b0000000008ygs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:50:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru