Edit tour

Windows Analysis Report
https://get-zip.b-cdn.net/n41.txt

Overview

General Information

Sample URL:	https://get-zip.b-cdn.net/n41.txt
Analysis ID:	1527898
Infos:

Detection

Score:	21
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Phishing site detected (based on image similarity)

Detected non-DNS traffic on DNS port

HTML body with high number of embedded images detected

Invalid T&C link found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2020,i,2827767752969188721,9938809765368574924,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5916 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://get-zip.b-cdn.net/n41.txt" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /piwik.php?action_name=bunny.net%20-%20The%20Content%20Delivery%20platform%20that%20truly%20Hops!&idsite=1&rec=1&r=888304&h=5&m=12&s=0&url=https%3A%2F%2Fbunny.net%2F&_id=088966a460b12cfa&_idn=1&send_image=0&_refts=0&pv_id=XK6hFd&pf_net=820&pf_srv=210&pf_tfr=1024&pf_dm1=2218&pf_dm2=8227&pf_onl=1&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.134%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.134%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1280x1024 HTTP/1.1Host: bunnycdn.innocraft.cloudConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=utf-8Accept: */*Origin: https://bunny.netSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://bunny.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://bunny.net/pricing/stream/	Matcher: Found strong image similarity, brand: FACEBOOK
Source: https://bunny.net/stream/transcribe-ai/	Matcher: Found strong image similarity, brand: FACEBOOK

Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.72:443 -> 192.168.2.7:49865 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.7:49701 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.7:57891 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.72

Source: chromecache_500.4.dr	String found in binary or memory: <!DOCTYPE html><html class=""><head><meta charSet="utf-8"/><meta http-equiv="x-ua-compatible" content="ie=edge"/><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"/><meta name="generator" content="Gatsby 4.25.9"/><meta data-react-helmet="true" name="seobility" content="50711449fc8c5141e795e7c196baaada"/><meta data-react-helmet="true" name="description" content="Hop on bunny.net and speed up your web presence with the next-generation Content Delivery Service (CDN), Edge Storage, and Optimization Services at any scale."/><meta data-react-helmet="true" name="author" content="bunny.net"/><meta data-react-helmet="true" property="og:url" content="https://bunny.net/"/><meta data-react-helmet="true" property="og:title" content="bunny.net - The Content Delivery platform that truly Hops!"/><meta data-react-helmet="true" property="og:description" content="Hop on bunny.net and speed up your web presence with the next-generation Content Delivery Service (CDN), Edge Storage, and Optimization Services at any scale."/><meta data-react-helmet="true" property="og:site_name" content="bunny.net"/><meta data-react-helmet="true" property="og:image" content="https://bunny.net/images/bunny-net-we-are-makeing-the-internet-hop-faster.jpg"/><meta data-react-helmet="true" property="og:image:width" content="1280"/><meta data-react-helmet="true" property="og:image:height" content="628"/><meta data-react-helmet="true" property="og:type" content="website"/><meta data-react-helmet="true" property="article:tag" content="bunny.net - The Content Delivery platform that truly Hops!"/><meta data-react-helmet="true" property="article:publisher" content="https://www.facebook.com/bunnycdn"/><meta data-react-helmet="true" name="twitter:url" content="https://bunny.net/"/><meta data-react-helmet="true" name="twitter:title" content="bunny.net - The Content Delivery platform that truly Hops!"/><meta data-react-helmet="true" name="twitter:description" content="Hop on bunny.net and speed up your web presence with the next-generation Content Delivery Service (CDN), Edge Storage, and Optimization Services at any scale."/><meta data-react-helmet="true" name="twitter:site" content="@bunnycdn"/><meta data-react-helmet="true" name="twitter:card" content="summary"/><style data-href="/styles.d7b0255598458c6fab04.css" data-identity="gatsby-global-css">/* equals www.facebook.com (Facebook)
Source: chromecache_175.4.dr	String found in binary or memory: <!DOCTYPE html><html class=""><head><meta charSet="utf-8"/><meta http-equiv="x-ua-compatible" content="ie=edge"/><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"/><meta name="generator" content="Gatsby 4.25.9"/><meta data-react-helmet="true" name="seobility" content="50711449fc8c5141e795e7c196baaada"/><meta data-react-helmet="true" name="description" content="The most affordable Livestream, VOD, and Video Delivery CDN pricing on the market. Deliver with free transcoding, video player, and all security features!"/><meta data-react-helmet="true" name="author" content="bunny.net"/><meta data-react-helmet="true" property="og:url" content="https://bunny.net/pricing/stream/"/><meta data-react-helmet="true" property="og:title" content="Bunny Stream Pricing \| Simplified and Flexible Video CDN Pricing"/><meta data-react-helmet="true" property="og:description" content="The most affordable Livestream, VOD, and Video Delivery CDN pricing on the market. Deliver with free transcoding, video player, and all security features!"/><meta data-react-helmet="true" property="og:site_name" content="bunny.net"/><meta data-react-helmet="true" property="og:image" content="https://bunny.net/images/bunny-net-cdn-pricing-pay-as-you-go.png"/><meta data-react-helmet="true" property="og:image:width" content="1280"/><meta data-react-helmet="true" property="og:image:height" content="628"/><meta data-react-helmet="true" property="og:type" content="website"/><meta data-react-helmet="true" property="article:tag" content="Bunny Stream Pricing \| Simplified and Flexible Video CDN Pricing"/><meta data-react-helmet="true" property="article:publisher" content="https://www.facebook.com/bunnycdn"/><meta data-react-helmet="true" name="twitter:url" content="https://bunny.net/pricing/stream/"/><meta data-react-helmet="true" name="twitter:title" content="Bunny Stream Pricing \| Simplified and Flexible Video CDN Pricing"/><meta data-react-helmet="true" name="twitter:description" content="The most affordable Livestream, VOD, and Video Delivery CDN pricing on the market. Deliver with free transcoding, video player, and all security features!"/><meta data-react-helmet="true" name="twitter:site" content="@bunnycdn"/><meta data-react-helmet="true" name="twitter:card" content="summary"/><style data-href="/styles.d7b0255598458c6fab04.css" data-identity="gatsby-global-css">/* equals www.facebook.com (Facebook)
Source: chromecache_584.4.dr	String found in binary or memory: <!DOCTYPE html><html class=""><head><meta charSet="utf-8"/><meta http-equiv="x-ua-compatible" content="ie=edge"/><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"/><meta name="generator" content="Gatsby 4.25.9"/><meta data-react-helmet="true" name="seobility" content="50711449fc8c5141e795e7c196baaada"/><meta data-react-helmet="true" name="description" content="Utilize powerful Bunny Transcribe AI to automatically detect, and convert speech in your videos to text."/><meta data-react-helmet="true" name="author" content="bunny.net"/><meta data-react-helmet="true" property="og:url" content="https://bunny.net/stream/transcribe-ai/"/><meta data-react-helmet="true" property="og:title" content="Transcribe AI - New era of accessibility and video intelligence!"/><meta data-react-helmet="true" property="og:description" content="Utilize powerful Bunny Transcribe AI to automatically detect, and convert speech in your videos to text."/><meta data-react-helmet="true" property="og:site_name" content="bunny.net"/><meta data-react-helmet="true" property="og:image" content="https://bunny.net/images/bunny-net-transcribe-ai-product.png"/><meta data-react-helmet="true" property="og:image:width" content="1280"/><meta data-react-helmet="true" property="og:image:height" content="628"/><meta data-react-helmet="true" property="og:type" content="website"/><meta data-react-helmet="true" property="article:tag" content="Transcribe AI - New era of accessibility and video intelligence!"/><meta data-react-helmet="true" property="article:publisher" content="https://www.facebook.com/bunnycdn"/><meta data-react-helmet="true" name="twitter:url" content="https://bunny.net/stream/transcribe-ai/"/><meta data-react-helmet="true" name="twitter:title" content="Transcribe AI - New era of accessibility and video intelligence!"/><meta data-react-helmet="true" name="twitter:description" content="Utilize powerful Bunny Transcribe AI to automatically detect, and convert speech in your videos to text."/><meta data-react-helmet="true" name="twitter:site" content="@bunnycdn"/><meta data-react-helmet="true" name="twitter:card" content="summary"/><style data-href="/styles.d7b0255598458c6fab04.css" data-identity="gatsby-global-css">/* equals www.facebook.com (Facebook)
Source: chromecache_175.4.dr, chromecache_584.4.dr, chromecache_500.4.dr	String found in binary or memory: </a></li><li> <a href="https://status.bunny.net/">Service Status</a></li><li><i class="fas fa-envelope"></i> <a href="mailto:hello@bunny.net">hello@bunny.net</a></li></ul></div></div></div></div><div class="row row-bottom"><div class="col-lg-4 col-md-6 sales"><h4>Big traffic? Talk to Sales</h4><div class="text-formatted"><p>Working on a big project?<br> Let our experts help you out.</p></div><ul><li><a href="mailto:sales@bunny.net"><i class="fas fa-envelope"></i> <!-- -->sales@bunny.net</a></li><li><a href="tel:+1-339-300-4270"><i class="fas fa-phone"></i> <!-- -->+1-339-300-4270</a></li></ul><div class="cta-wr undefined"><a class="cta cta-primary" href="/contact-sales/">Contact Sales</a></div></div><div class="col-lg-6 col-md-6 social"><h4>Stay up to date with bunny.net</h4><div class="text-formatted"><p>Follow us on social media for special promotions and important news.</p></div><ul><li><a href="https://www.facebook.com/bunnycdn"><i class="fab fa-facebook-f"></i> <!-- -->bunny.net on Facebook</a></li><li><a href="https://twitter.com/BunnyCDN"><i class="fab fa-x-twitter"></i> <!-- -->bunny.net on Twitter</a></li><li><a href="https://www.linkedin.com/company/bunnynet/"><i class="fab fa-linkedin-in"></i> <!-- -->bunny.net on Linkedin</a></li><li><a href="https://discord.gg/bunnynet?ref=bunny.net"><i class="fab fa-discord"></i> <!-- -->bunny.net on Discord</a></li></ul><div class="slogan">~ Making the internet hop faster!</div></div></div></div></div><div class="footer-bottom"><div class="container"><div class="row"><div class="col-md-5 cols"><p class="copyright">2024 All Rights Reserved equals www.facebook.com (Facebook)
Source: chromecache_175.4.dr, chromecache_584.4.dr, chromecache_500.4.dr	String found in binary or memory: </a></li><li> <a href="https://status.bunny.net/">Service Status</a></li><li><i class="fas fa-envelope"></i> <a href="mailto:hello@bunny.net">hello@bunny.net</a></li></ul></div></div></div></div><div class="row row-bottom"><div class="col-lg-4 col-md-6 sales"><h4>Big traffic? Talk to Sales</h4><div class="text-formatted"><p>Working on a big project?<br> Let our experts help you out.</p></div><ul><li><a href="mailto:sales@bunny.net"><i class="fas fa-envelope"></i> <!-- -->sales@bunny.net</a></li><li><a href="tel:+1-339-300-4270"><i class="fas fa-phone"></i> <!-- -->+1-339-300-4270</a></li></ul><div class="cta-wr undefined"><a class="cta cta-primary" href="/contact-sales/">Contact Sales</a></div></div><div class="col-lg-6 col-md-6 social"><h4>Stay up to date with bunny.net</h4><div class="text-formatted"><p>Follow us on social media for special promotions and important news.</p></div><ul><li><a href="https://www.facebook.com/bunnycdn"><i class="fab fa-facebook-f"></i> <!-- -->bunny.net on Facebook</a></li><li><a href="https://twitter.com/BunnyCDN"><i class="fab fa-x-twitter"></i> <!-- -->bunny.net on Twitter</a></li><li><a href="https://www.linkedin.com/company/bunnynet/"><i class="fab fa-linkedin-in"></i> <!-- -->bunny.net on Linkedin</a></li><li><a href="https://discord.gg/bunnynet?ref=bunny.net"><i class="fab fa-discord"></i> <!-- -->bunny.net on Discord</a></li></ul><div class="slogan">~ Making the internet hop faster!</div></div></div></div></div><div class="footer-bottom"><div class="container"><div class="row"><div class="col-md-5 cols"><p class="copyright">2024 All Rights Reserved equals www.linkedin.com (Linkedin)
Source: chromecache_175.4.dr, chromecache_584.4.dr, chromecache_500.4.dr	String found in binary or memory: </a></li><li> <a href="https://status.bunny.net/">Service Status</a></li><li><i class="fas fa-envelope"></i> <a href="mailto:hello@bunny.net">hello@bunny.net</a></li></ul></div></div></div></div><div class="row row-bottom"><div class="col-lg-4 col-md-6 sales"><h4>Big traffic? Talk to Sales</h4><div class="text-formatted"><p>Working on a big project?<br> Let our experts help you out.</p></div><ul><li><a href="mailto:sales@bunny.net"><i class="fas fa-envelope"></i> <!-- -->sales@bunny.net</a></li><li><a href="tel:+1-339-300-4270"><i class="fas fa-phone"></i> <!-- -->+1-339-300-4270</a></li></ul><div class="cta-wr undefined"><a class="cta cta-primary" href="/contact-sales/">Contact Sales</a></div></div><div class="col-lg-6 col-md-6 social"><h4>Stay up to date with bunny.net</h4><div class="text-formatted"><p>Follow us on social media for special promotions and important news.</p></div><ul><li><a href="https://www.facebook.com/bunnycdn"><i class="fab fa-facebook-f"></i> <!-- -->bunny.net on Facebook</a></li><li><a href="https://twitter.com/BunnyCDN"><i class="fab fa-x-twitter"></i> <!-- -->bunny.net on Twitter</a></li><li><a href="https://www.linkedin.com/company/bunnynet/"><i class="fab fa-linkedin-in"></i> <!-- -->bunny.net on Linkedin</a></li><li><a href="https://discord.gg/bunnynet?ref=bunny.net"><i class="fab fa-discord"></i> <!-- -->bunny.net on Discord</a></li></ul><div class="slogan">~ Making the internet hop faster!</div></div></div></div></div><div class="footer-bottom"><div class="container"><div class="row"><div class="col-md-5 cols"><p class="copyright">2024 All Rights Reserved equals www.twitter.com (Twitter)
Source: chromecache_567.4.dr	String found in binary or memory: }}catch(ag){}function af(){try{aj.apply(window,[].slice.call(arguments,0));ah()}catch(ak){ah();throw ak}}window[ai]=af}function ac(){return"object"===typeof YT&&YT&&YT.Player}function Z(){if(!ac()){return}var af=ae.getElementsByTagName("iframe");for(var ag=0;ag<af.length;ag++){if(p.isMediaIgnored(af[ag])){continue}var ah=p.getAttribute(af[ag],"src");if(ah&&(ah.indexOf("youtube.com")>0\|\|ah.indexOf("youtube-nocookie.com")>0)){if(af[ag].setAttribute){af[ag].setAttribute("enablejsapi","true")}new w(af[ag],g.VIDEO)}}}if(Y&&Y.length){if(ac()){Z()}else{if(G.onYouTubeIframeAPIReady){X("onYouTubeIframeAPIReady",Z);ab(false)}else{if(G.onYouTubePlayerAPIReady){X("onYouTubePlayerAPIReady",Z);ab(false)}else{G.onYouTubeIframeAPIReady=Z;ab(true)}}}}function ab(ah){if(!ah&&(typeof G.YT==="object"\|\|t.querySelectorAll('script[src="https://www.youtube.com/iframe_api"]').length>0)){return}var ag=t.createElement("script");ag.src="https://www.youtube.com/iframe_api";var af=t.getElementsByTagName("script");if(af&&af.length){var ai=af[0]; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: get-zip.b-cdn.net
Source: global traffic	DNS traffic detected: DNS query: bunnycdn.b-cdn.net
Source: global traffic	DNS traffic detected: DNS query: bunny.net
Source: global traffic	DNS traffic detected: DNS query: bunnycdn.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: fonts.bunny.net
Source: global traffic	DNS traffic detected: DNS query: posthog2.fluffleinfra.net
Source: global traffic	DNS traffic detected: DNS query: chat.bunny.net
Source: global traffic	DNS traffic detected: DNS query: bunnycdn.innocraft.cloud

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 07 Oct 2024 09:11:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingServer: BunnyCDN-DE1-756CDN-RequestId: a445dc0592cc27fa0be5973ddab82798
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Mon, 07 Oct 2024 09:11:29 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingServer: BunnyCDN-DE1-756CDN-RequestId: e5e378b1fb653621fa43487f7d0851a3

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2020,i,2827767752969188721,9938809765368574924,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://get-zip.b-cdn.net/n41.txt"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2020,i,2827767752969188721,9938809765368574924,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
posthog2.fluffleinfra.net	157.90.88.232	true	false	unknown
bunnycdn.com	169.150.236.105	true	false	unknown
get-zip.b-cdn.net	89.187.169.47	true	false	unknown
www.google.com	142.250.186.68	true	false	unknown
bunnyfonts.b-cdn.net	169.150.247.37	true	false	unknown
bunny.net	169.150.247.39	true	false	unknown
bunnycdn.innocraft.cloud	18.195.235.189	true	false	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.20	true	false	unknown
bunnycdn.b-cdn.net	169.150.247.37	true	false	unknown
chat.bunny.net	136.244.92.75	true	false	unknown
fonts.bunny.net	unknown	unknown	false	unknown

Name	Source	Malicious	Reputation
https://fonts.bunny.net/rubik/files/rubik-latin-ext-600-normal.woff)	chromecache_549.4.dr	false	unknown
https://dash.bunny.net/auth/register?pk_buttonlocation=bigcard&pk_buttonurl=gcorelabs	chromecache_151.4.dr, chromecache_544.4.dr	false	unknown
https://bunnycdn.com/assets/v2/images/general/il-bg-black-flower.svg);	chromecache_559.4.dr	false	unknown
http://creativecommons.org/licenses/by-sa/4.0/	chromecache_489.4.dr	false	unknown
https://dash.bunny.net/auth/register?pk_buttonlocation=footer&pk_buttonurl=cdnasia	chromecache_151.4.dr, chromecache_544.4.dr	false	unknown
https://casestudies.b-cdn.net/bunnynet-case-study-pulse.pdf	chromecache_151.4.dr, chromecache_544.4.dr	false	unknown
https://docs.bunny.net/docs	chromecache_584.4.dr, chromecache_631.4.dr, chromecache_533.4.dr	false	unknown
https://casestudies.b-cdn.net/bunnynet-case-study-launchcdn.pdf	chromecache_151.4.dr, chromecache_544.4.dr	false	unknown
https://w.soundcloud.com/player/api.js	chromecache_285.4.dr, chromecache_567.4.dr	false	unknown
https://www.innocraft.com/license	chromecache_285.4.dr, chromecache_567.4.dr	false	unknown
https://bunny.net/thank-you	chromecache_151.4.dr, chromecache_544.4.dr	false	unknown
https://bunny.net/broadcast-asia2024/	chromecache_471.4.dr, chromecache_593.4.dr, chromecache_184.4.dr, chromecache_513.4.dr, chromecache_499.4.dr, chromecache_572.4.dr	false	unknown
https://fonts.bunny.net/rubik/files/rubik-latin-300-normal.woff2)	chromecache_549.4.dr	false	unknown
https://fonts.bunny.net/rubik/files/rubik-latin-600-normal.woff2)	chromecache_549.4.dr	false	unknown
http://creativecommons.org/ns#Notice	chromecache_324.4.dr, chromecache_489.4.dr	false	unknown
https://fonts.bunny.net/rubik/files/rubik-cyrillic-ext-600-normal.woff)	chromecache_549.4.dr	false	unknown
https://bunnynet.teamtailor.com/jobs/4900247-product-manager-content-delivery-security	chromecache_499.4.dr	false	unknown
https://dash.bunny.net/auth/register?pk_buttonlocation=bigcard&pk_buttonurl=akamai	chromecache_151.4.dr, chromecache_544.4.dr	false	unknown
https://fonts.bunny.net/rubik/files/rubik-arabic-500-normal.woff2)	chromecache_549.4.dr	false	unknown
https://fonts.bunny.net/rubik/files/rubik-latin-ext-400-normal.woff)	chromecache_549.4.dr	false	unknown
https://fonts.bunny.net/css2?family=Rubik:wght	chromecache_175.4.dr, chromecache_584.4.dr	false	unknown
https://bunnynet.teamtailor.com/jobs/4811406-lead-product-manager	chromecache_499.4.dr	false	unknown
https://dash.bunny.net/auth/register?pk_buttonlocation=footer&pk_buttonurl=optimizerapi	chromecache_151.4.dr, chromecache_544.4.dr	false	unknown
https://casestudies.b-cdn.net/bunnynet-case-study-samsung-food.pdf.pdf	chromecache_151.4.dr, chromecache_544.4.dr	false	unknown
https://bunnynet.teamtailor.com/jobs/4952162-senior-software-engineer-content-delivery-security	chromecache_499.4.dr	false	unknown
https://fonts.bunny.net/rubik/files/rubik-latin-ext-500-normal.woff2)	chromecache_549.4.dr	false	unknown
https://fonts.bunny.net/rubik/files/rubik-cyrillic-400-normal.woff2)	chromecache_549.4.dr	false	unknown
https://fonts.bunny.net/rubik/files/rubik-cyrillic-700-normal.woff2)	chromecache_549.4.dr	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
157.90.88.232	posthog2.fluffleinfra.net	United States	766	REDIRISRedIRISAutonomousSystemES	false
169.150.247.38	unknown	United States	2711	SPIRITTEL-ASUS	false
169.150.247.39	bunny.net	United States	2711	SPIRITTEL-ASUS	false
89.187.169.47	get-zip.b-cdn.net	Czech Republic	60068	CDN77GB	false
169.150.247.36	unknown	United States	2711	SPIRITTEL-ASUS	false
169.150.247.37	bunnyfonts.b-cdn.net	United States	2711	SPIRITTEL-ASUS	false
169.150.236.105	bunnycdn.com	United States	2711	SPIRITTEL-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.195.235.189	bunnycdn.innocraft.cloud	United States	16509	AMAZON-02US	false
136.244.92.75	chat.bunny.net	United States	20473	AS-CHOOPAUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527898
Start date and time:	2024-10-07 11:10:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://get-zip.b-cdn.net/n41.txt
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus21.phis.win@19/951@36/12
Cookbook Comments:	Browse: https://bunny.net/ Browse: https://bunny.net/pricing/stream/ Browse: https://bunny.net/stream/transcribe-ai/

Input	Output
URL: https://get-zip.b-cdn.net/n41.txt Model: jbxai	{ "brand":["Bunny.net"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Domain suspended or not configured If you are the administrator and believe this is an error on our side, please check your BunnyCDN account configuration or contact customer support.", "has_visible_qrcode":false}

URL: https://bunny.net/ Model: jbxai	{ "brand":["bunny.net"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Try FREE for 14 Days", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"The global content delivery platform that truly hops Speed up your content with our next-generation CDN, Edge Storage, and Optimization Services. bunny.net makes lightning-fast performance at any scale easier than ever before. Join over 1, 000, 00+ websites already powered by bunny.net Our dedication to quality has won the trust of many well-known brands in their industries. We're rated Excellent 4.8 4.8 out of 5 based on 900+ reviews", "has_visible_qrcode":false}

URL: https://bunny.net/pricing/stream/ Model: jbxai	{ "brand":["bunny.net"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Get Started", "text_input_field_labels":["Encoding", "Storage", "CDN"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Simplified pricing. Up to 10x lower cost. Utilize video player, transcoding, and all security features completely free of charge. Only pay for the traffic you use!", "has_visible_qrcode":false}

URL: https://bunny.net/stream/transcribe-ai/ Model: jbxai	{ "brand":["bunny.net"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Start 14-Day FREE Trial", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "text":"Turn your videos into valuable insights Automatically detect, and convert speech in your videos to text. Generate captions and translations in over 57 languages. Expand your global reach and explore a new level of video insights. No credit card needed. Start in seconds. We use cookies to improve your user experience. Learn more Join over 1, 000, 000+ websites already powered by bunny.net", "has_visible_qrcode":false}

Name	Malicious	Reputation
https://bunny.net/images/belka-games.png	false	unknown
https://bunny.net/flags/AU.svg	false	unknown
https://bunny.net/flags/PF.svg	false	unknown
https://bunny.net/images/super-bunny.svg	false	unknown
https://bunny.net/flags/GB.svg	false	unknown
https://bunny.net/flags/BS.svg	false	unknown
https://bunny.net/v2/images/bunnynet-logo.svg	false	unknown
https://bunny.net/images/www.svg	false	unknown
https://bunny.net/flags/DO.svg	false	unknown
https://bunny.net/flags/TT.svg	false	unknown
https://bunny.net/images/bunny-products.svg	false	unknown
https://bunny.net/flags/ML.svg	false	unknown
https://bunny.net/flags/SV.svg	false	unknown
https://bunny.net/flags/KW.svg	false	unknown
https://bunny.net/flags/AN.svg	false	unknown
https://bunny.net/flags/IT.svg	false	unknown
https://bunny.net/images/cdn_icon-global_network.svg	false	unknown
https://bunny.net/flags/PM.svg	false	unknown
https://bunny.net/images/stream-icon.svg	false	unknown
https://bunny.net/flags/ZA.svg	false	unknown
https://bunny.net/favicon-32x32.png?v=1ca91ab4134c7fdacfd5e433633a1572	false	unknown
https://bunny.net/flags/BZ.svg	false	unknown
https://bunny.net/flags/KP.svg	false	unknown
https://bunny.net/flags/LU.svg	false	unknown
https://bunny.net/flags/SG.svg	false	unknown
https://bunny.net/flags/FK.svg	false	unknown
https://bunny.net/flags/SO.svg	false	unknown
https://bunny.net/images/check-list.svg	false	unknown
https://bunny.net/images/video-player.svg	false	unknown
https://bunny.net/flags/CC.svg	false	unknown
https://bunny.net/flags/FR.svg	false	unknown
https://bunny.net/flags/KI.svg	false	unknown
https://bunny.net/flags/VA.svg	false	unknown
https://bunny.net/images/image-cdn.svg	false	unknown
https://bunny.net/flags/ET.svg	false	unknown
https://bunny.net/images/media-cage.svg	false	unknown
https://bunny.net/flags/AF.svg	false	unknown
https://bunny.net/images/optimize-once-save-forever.svg	false	unknown
https://bunny.net/flags/IL.svg	false	unknown
https://bunny.net/images/nexusmods.png	false	unknown
https://bunny.net/flags/GQ.svg	false	unknown
https://bunny.net/flags/MZ.svg	false	unknown
https://bunny.net/images/logo-alo.svg	false	unknown
https://bunny.net/flags/IE.svg	false	unknown
https://bunny.net/flags/CY.svg	false	unknown
https://bunny.net/flags/TM.svg	false	unknown
https://bunny.net/flags/BD.svg	false	unknown
https://bunny.net/flags/UY.svg	false	unknown
https://bunny.net/flags/WF.svg	false	unknown
https://bunny.net/flags/MS.svg	false	unknown
https://bunny.net/flags/MK.svg	false	unknown
https://bunny.net/flags/SA.svg	false	unknown
https://bunny.net/flags/BT.svg	false	unknown
https://bunny.net/flags/MT.svg	false	unknown
https://bunny.net/images/tcl.png	false	unknown
https://bunny.net/flags/UZ.svg	false	unknown
https://bunny.net/flags/EE.svg	false	unknown
https://bunny.net/flags/CR.svg	false	unknown
https://bunny.net/flags/AT.svg	false	unknown
https://bunny.net/flags/PE.svg	false	unknown
https://bunny.net/flags/CI.svg	false	unknown
https://bunny.net/4d33dcd6742d5d3a9169a3efa28fdac416dfbee1-a6f8bd735e85632e3ad9.js	false	unknown
https://bunny.net/flags/RW.svg	false	unknown
https://bunny.net/flags/LT.svg	false	unknown
https://bunny.net/flags/TZ.svg	false	unknown
https://bunny.net/flags/NP.svg	false	unknown
https://bunny.net/flags/FJ.svg	false	unknown
https://bunny.net/app-982aa09faa739c4912a7.js	false	unknown
https://bunny.net/flags/BY.svg	false	unknown
https://bunny.net/flags/ID.svg	false	unknown
https://bunny.net/images/bunnynet-low-pricing-icon.svg	false	unknown
https://bunny.net/images/nitropack-logo-svg.svg	false	unknown

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	524
Entropy (8bit):	4.822618057688341
Encrypted:	false
SSDEEP:	12:tra2hr4dDbtZ9XctWLOTCVunn6kDLRvVVUmIAzNDcGUJ3vR5UqO2UXwjpCF5I:tO2hr4d3tZ9Xct2+6OvVVyAz2GUJ/PEk
MD5:	072878BC70D214FBA1ACDA6AC3FCD23D
SHA1:	1568CB297A4B2AA31924053E49879A6F616001D7
SHA-256:	44A67AFBB1089ABD7040776C778153BE7999A19FE7B0769C77AE9FCBCACE5C4D
SHA-512:	1D0EAAE225F9C4A681CDB7BDE8C152A55AA81C5FB349100ACEAAFC31F73C737293C4C8394794D8C02CECB9A7AAF4BFE2260B05B532CDF331BB468BBBBB2AC106
Malicious:	false
Reputation:	low
URL:	https://bunny.net/flags/CZ.svg
Preview:	<svg width="512" height="336" viewBox="0 0 512 336" xmlns="http://www.w3.org/2000/svg">. <g fill="none">. <path d="M3.256 333.59L256 168 3.256 2.41C1.311 4.029 0 6.375 0 9.103v317.793c0 2.729 1.311 5.075 3.256 6.694z" fill="#41479B"/>. <path d="M3.256 333.59c1.53 1.274 3.425 2.134 5.571 2.134h494.345a8.829 8.829 0 0 0 8.828-8.828V168H256L3.256 333.59z" fill="#FF4B55"/>. <path d="M3.256 2.41C4.786 1.136 6.681.276 8.827.276h494.345A8.829 8.829 0 0 1 512 9.104V168H256L3.256 2.41z" fill="#F5F5F5"/>. </g>.</svg>.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 11:11:13.137447119 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 11:11:14.762392044 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 7, 2024 11:11:14.762392998 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 7, 2024 11:11:14.918664932 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 7, 2024 11:11:15.543596983 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 11:11:20.117543936 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 11:11:20.434269905 CEST	49671	443	192.168.2.7	204.79.197.203
Oct 7, 2024 11:11:20.496789932 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 11:11:21.262412071 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 11:11:22.762399912 CEST	49677	443	192.168.2.7	20.50.201.200
Oct 7, 2024 11:11:24.335907936 CEST	49701	53	192.168.2.7	1.1.1.1
Oct 7, 2024 11:11:24.340816021 CEST	53	49701	1.1.1.1	192.168.2.7
Oct 7, 2024 11:11:24.340900898 CEST	49701	53	192.168.2.7	1.1.1.1
Oct 7, 2024 11:11:24.342535019 CEST	49701	53	192.168.2.7	1.1.1.1
Oct 7, 2024 11:11:24.342546940 CEST	49701	53	192.168.2.7	1.1.1.1
Oct 7, 2024 11:11:24.342736959 CEST	49701	53	192.168.2.7	1.1.1.1
Oct 7, 2024 11:11:24.347402096 CEST	53	49701	1.1.1.1	192.168.2.7
Oct 7, 2024 11:11:24.347425938 CEST	53	49701	1.1.1.1	192.168.2.7
Oct 7, 2024 11:11:24.390552044 CEST	53	49701	1.1.1.1	192.168.2.7
Oct 7, 2024 11:11:24.467360020 CEST	49675	443	192.168.2.7	104.98.116.138
Oct 7, 2024 11:11:24.467367887 CEST	49674	443	192.168.2.7	104.98.116.138
Oct 7, 2024 11:11:24.469729900 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:24.469779015 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:24.469857931 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:24.470328093 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:24.470352888 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:24.589616060 CEST	49672	443	192.168.2.7	104.98.116.138
Oct 7, 2024 11:11:24.696822882 CEST	53	49701	1.1.1.1	192.168.2.7
Oct 7, 2024 11:11:24.696891069 CEST	49701	53	192.168.2.7	1.1.1.1
Oct 7, 2024 11:11:25.161813974 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.161900997 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.165750027 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.165781021 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.166140079 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.222636938 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.263417006 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.334800005 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.334825039 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.334834099 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.334867954 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.334927082 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.334940910 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.334948063 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.334979057 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.335000992 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.335031033 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.419205904 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.419265985 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.419306993 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.419337988 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.419358015 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.419379950 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.425416946 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.425486088 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.425513983 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.425537109 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.425554037 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.425637007 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.508656979 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.508682013 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.508845091 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.508877039 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.510339022 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.510359049 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.510420084 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.510433912 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.510457993 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.510482073 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.512155056 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.512170076 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.512238026 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.512257099 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.512275934 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.512304068 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.516017914 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.516035080 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.516138077 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.516160011 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.516464949 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.599373102 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.599402905 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.599534988 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.599576950 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.599600077 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.600358009 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.600378036 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.600415945 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.600435019 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.600450039 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.600476027 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.601340055 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.601355076 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.601396084 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.601406097 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.601422071 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.601447105 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.602147102 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.602164030 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.602210999 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.602221012 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.602236986 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.602257967 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.603121996 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.603138924 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.603199959 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.603214979 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.604078054 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.604096889 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.604137897 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.604152918 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.604168892 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.604195118 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.606534958 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.606607914 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.606611967 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.606781960 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.690836906 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.691914082 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.691942930 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.691961050 CEST	49704	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.691972017 CEST	443	49704	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.774307966 CEST	49707	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.774409056 CEST	443	49707	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.774501085 CEST	49707	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.775276899 CEST	49707	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.775307894 CEST	443	49707	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.776793957 CEST	49708	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.776850939 CEST	443	49708	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.776913881 CEST	49708	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.777029037 CEST	49708	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.777045965 CEST	443	49708	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.777951002 CEST	49709	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.777991056 CEST	443	49709	13.107.253.72	192.168.2.7
Oct 7, 2024 11:11:25.778224945 CEST	49709	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.780011892 CEST	49710	443	192.168.2.7	13.107.253.72
Oct 7, 2024 11:11:25.780035019 CEST	443	49710	13.107.253.72	192.168.2.7

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 11:11:25.868187904 CEST	192.168.2.7	1.1.1.1	0xf123	Standard query (0)	get-zip.b-cdn.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:25.868750095 CEST	192.168.2.7	1.1.1.1	0xe5be	Standard query (0)	get-zip.b-cdn.net	65	IN (0x0001)	false
Oct 7, 2024 11:11:26.944112062 CEST	192.168.2.7	1.1.1.1	0xb6cf	Standard query (0)	bunnycdn.b-cdn.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:26.944250107 CEST	192.168.2.7	1.1.1.1	0x5ba4	Standard query (0)	bunnycdn.b-cdn.net	65	IN (0x0001)	false
Oct 7, 2024 11:11:26.944714069 CEST	192.168.2.7	1.1.1.1	0x799a	Standard query (0)	bunny.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:26.944848061 CEST	192.168.2.7	1.1.1.1	0xbb48	Standard query (0)	bunny.net	65	IN (0x0001)	false
Oct 7, 2024 11:11:28.276246071 CEST	192.168.2.7	1.1.1.1	0x5f7d	Standard query (0)	bunnycdn.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:28.288613081 CEST	192.168.2.7	1.1.1.1	0xb518	Standard query (0)	bunnycdn.com	65	IN (0x0001)	false
Oct 7, 2024 11:11:28.757316113 CEST	192.168.2.7	1.1.1.1	0x8c17	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:28.757869005 CEST	192.168.2.7	1.1.1.1	0x6950	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 7, 2024 11:11:28.759160995 CEST	192.168.2.7	1.1.1.1	0xe0be	Standard query (0)	bunny.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:28.759860039 CEST	192.168.2.7	1.1.1.1	0xb413	Standard query (0)	bunny.net	65	IN (0x0001)	false
Oct 7, 2024 11:11:29.249346018 CEST	192.168.2.7	1.1.1.1	0x4d80	Standard query (0)	bunnycdn.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:29.249875069 CEST	192.168.2.7	1.1.1.1	0x63c2	Standard query (0)	bunnycdn.com	65	IN (0x0001)	false
Oct 7, 2024 11:11:38.865453959 CEST	192.168.2.7	1.1.1.1	0x437b	Standard query (0)	bunny.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:38.867899895 CEST	192.168.2.7	1.1.1.1	0xf5bf	Standard query (0)	bunny.net	65	IN (0x0001)	false
Oct 7, 2024 11:11:40.969348907 CEST	192.168.2.7	1.1.1.1	0x44d9	Standard query (0)	fonts.bunny.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:40.969855070 CEST	192.168.2.7	1.1.1.1	0xf9cd	Standard query (0)	fonts.bunny.net	65	IN (0x0001)	false
Oct 7, 2024 11:11:59.453584909 CEST	192.168.2.7	1.1.1.1	0xa300	Standard query (0)	posthog2.fluffleinfra.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:59.453752041 CEST	192.168.2.7	1.1.1.1	0xd7bd	Standard query (0)	posthog2.fluffleinfra.net	65	IN (0x0001)	false
Oct 7, 2024 11:11:59.485491037 CEST	192.168.2.7	1.1.1.1	0xf0f	Standard query (0)	chat.bunny.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:59.485687971 CEST	192.168.2.7	1.1.1.1	0xc730	Standard query (0)	chat.bunny.net	65	IN (0x0001)	false
Oct 7, 2024 11:12:01.660092115 CEST	192.168.2.7	1.1.1.1	0x7fad	Standard query (0)	chat.bunny.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:01.660541058 CEST	192.168.2.7	1.1.1.1	0xa7af	Standard query (0)	chat.bunny.net	65	IN (0x0001)	false
Oct 7, 2024 11:12:01.786350965 CEST	192.168.2.7	1.1.1.1	0x2c49	Standard query (0)	bunnycdn.innocraft.cloud	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:01.786653042 CEST	192.168.2.7	1.1.1.1	0xcf6c	Standard query (0)	bunnycdn.innocraft.cloud	65	IN (0x0001)	false
Oct 7, 2024 11:12:01.950288057 CEST	192.168.2.7	1.1.1.1	0x9a8d	Standard query (0)	posthog2.fluffleinfra.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:01.950711012 CEST	192.168.2.7	1.1.1.1	0x86f	Standard query (0)	posthog2.fluffleinfra.net	65	IN (0x0001)	false
Oct 7, 2024 11:12:28.812210083 CEST	192.168.2.7	1.1.1.1	0xbb61	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:28.812486887 CEST	192.168.2.7	1.1.1.1	0x85cd	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 7, 2024 11:12:28.953521967 CEST	192.168.2.7	1.1.1.1	0xb7ba	Standard query (0)	bunny.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:28.953763962 CEST	192.168.2.7	1.1.1.1	0xffe0	Standard query (0)	bunny.net	65	IN (0x0001)	false
Oct 7, 2024 11:12:39.823095083 CEST	192.168.2.7	1.1.1.1	0x9118	Standard query (0)	bunny.net	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:39.823460102 CEST	192.168.2.7	1.1.1.1	0x370c	Standard query (0)	bunny.net	65	IN (0x0001)	false
Oct 7, 2024 11:13:04.855447054 CEST	192.168.2.7	1.1.1.1	0x3ec2	Standard query (0)	bunnycdn.innocraft.cloud	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:13:04.855601072 CEST	192.168.2.7	1.1.1.1	0xb5e1	Standard query (0)	bunnycdn.innocraft.cloud	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 11:11:25.877968073 CEST	1.1.1.1	192.168.2.7	0xf123	No error (0)	get-zip.b-cdn.net		89.187.169.47	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:26.953229904 CEST	1.1.1.1	192.168.2.7	0xb6cf	No error (0)	bunnycdn.b-cdn.net		169.150.247.37	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:26.953732967 CEST	1.1.1.1	192.168.2.7	0x799a	No error (0)	bunny.net		169.150.247.39	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:28.286361933 CEST	1.1.1.1	192.168.2.7	0x5f7d	No error (0)	bunnycdn.com		169.150.236.105	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:28.764344931 CEST	1.1.1.1	192.168.2.7	0x8c17	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:28.764549971 CEST	1.1.1.1	192.168.2.7	0x6950	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 7, 2024 11:11:28.768237114 CEST	1.1.1.1	192.168.2.7	0xe0be	No error (0)	bunny.net		169.150.247.38	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:29.259485960 CEST	1.1.1.1	192.168.2.7	0x4d80	No error (0)	bunnycdn.com		169.150.247.36	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:35.569854975 CEST	1.1.1.1	192.168.2.7	0x894a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:35.569854975 CEST	1.1.1.1	192.168.2.7	0x894a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:38.875005960 CEST	1.1.1.1	192.168.2.7	0x437b	No error (0)	bunny.net		169.150.247.39	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:40.976799011 CEST	1.1.1.1	192.168.2.7	0xf9cd	No error (0)	fonts.bunny.net	bunnyfonts.b-cdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 11:11:40.977293015 CEST	1.1.1.1	192.168.2.7	0x44d9	No error (0)	fonts.bunny.net	bunnyfonts.b-cdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 11:11:40.977293015 CEST	1.1.1.1	192.168.2.7	0x44d9	No error (0)	bunnyfonts.b-cdn.net		169.150.247.37	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:59.466471910 CEST	1.1.1.1	192.168.2.7	0xa300	No error (0)	posthog2.fluffleinfra.net		157.90.88.232	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:11:59.493753910 CEST	1.1.1.1	192.168.2.7	0xf0f	No error (0)	chat.bunny.net		136.244.92.75	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:01.669029951 CEST	1.1.1.1	192.168.2.7	0x7fad	No error (0)	chat.bunny.net		136.244.92.75	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:01.800302982 CEST	1.1.1.1	192.168.2.7	0x2c49	No error (0)	bunnycdn.innocraft.cloud		18.195.235.189	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:01.800302982 CEST	1.1.1.1	192.168.2.7	0x2c49	No error (0)	bunnycdn.innocraft.cloud		3.126.133.169	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:01.800302982 CEST	1.1.1.1	192.168.2.7	0x2c49	No error (0)	bunnycdn.innocraft.cloud		18.157.122.248	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:01.964747906 CEST	1.1.1.1	192.168.2.7	0x9a8d	No error (0)	posthog2.fluffleinfra.net		157.90.88.232	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:18.852735996 CEST	1.1.1.1	192.168.2.7	0xa68c	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 11:12:18.852735996 CEST	1.1.1.1	192.168.2.7	0xa68c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:18.852735996 CEST	1.1.1.1	192.168.2.7	0xa68c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:18.852735996 CEST	1.1.1.1	192.168.2.7	0xa68c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:18.852735996 CEST	1.1.1.1	192.168.2.7	0xa68c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:18.852735996 CEST	1.1.1.1	192.168.2.7	0xa68c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.41	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:18.852735996 CEST	1.1.1.1	192.168.2.7	0xa68c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:18.852735996 CEST	1.1.1.1	192.168.2.7	0xa68c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:28.818926096 CEST	1.1.1.1	192.168.2.7	0xbb61	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:28.819375038 CEST	1.1.1.1	192.168.2.7	0x85cd	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 7, 2024 11:12:28.962603092 CEST	1.1.1.1	192.168.2.7	0xb7ba	No error (0)	bunny.net		169.150.247.38	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:37.225028038 CEST	1.1.1.1	192.168.2.7	0x61b9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:37.225028038 CEST	1.1.1.1	192.168.2.7	0x61b9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:12:39.831876040 CEST	1.1.1.1	192.168.2.7	0x9118	No error (0)	bunny.net		169.150.247.38	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:13:04.883402109 CEST	1.1.1.1	192.168.2.7	0x3ec2	No error (0)	bunnycdn.innocraft.cloud		18.195.235.189	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:13:04.883402109 CEST	1.1.1.1	192.168.2.7	0x3ec2	No error (0)	bunnycdn.innocraft.cloud		3.126.133.169	A (IP address)	IN (0x0001)	false
Oct 7, 2024 11:13:04.883402109 CEST	1.1.1.1	192.168.2.7	0x3ec2	No error (0)	bunnycdn.innocraft.cloud		18.157.122.248	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:25 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 09:11:25 UTC	540	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:11:25 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 04 Oct 2024 23:21:50 GMT ETag: "0x8DCE4CB535A72FA" x-ms-request-id: 5e64ff20-601e-005c-6bc1-17f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T091125Z-1767f7688dc97m2se6u6hv466400000007k000000000b9fw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 09:11:25 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-07 09:11:25 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-07 09:11:25 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-07 09:11:25 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-07 09:11:25 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-07 09:11:25 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-07 09:11:25 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-07 09:11:25 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-07 09:11:25 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-07 09:11:25 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:26 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 09:11:26 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:11:26 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1cc2ff82-e01e-0071-478c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T091126Z-r154656d9bcpnqc46yk454phh800000003e000000000ca6f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 09:11:26 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:26 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 09:11:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:11:26 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: b4e56b29-201e-0000-2178-18a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T091126Z-1767f7688dcvlhnc8mxy0v1nqw00000002y0000000003mg7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-07 09:11:26 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:26 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 09:11:26 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:11:26 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b9d87bc3-001e-008d-128c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T091126Z-r154656d9bcc4snr2sy7ntt13c0000000b9g000000003ucp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 09:11:26 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:26 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 09:11:26 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:11:26 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: ec1acd5e-601e-00ab-3736-1666f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T091126Z-r154656d9bcn4d55dey6ma44b00000000e9000000000b216 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-07 09:11:26 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://get-zip.b-cdn.net/n41.txt

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Chrome Cache Entry: 147

Chrome Cache Entry: 148

Chrome Cache Entry: 149

Chrome Cache Entry: 150

Chrome Cache Entry: 151

Chrome Cache Entry: 152

Chrome Cache Entry: 153

Chrome Cache Entry: 154

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Chrome Cache Entry: 161

Chrome Cache Entry: 162

Chrome Cache Entry: 163

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Windows Analysis Report
https://get-zip.b-cdn.net/n41.txt

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:26 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 09:11:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:11:26 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4b0a31e7-c01e-00ad-448c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T091126Z-1767f7688dc9hz5543dfnckp1w0000000g1g000000007rb2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 09:11:26 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:26 UTC	667	OUT	GET /n41.txt HTTP/1.1 Host: get-zip.b-cdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:11:26 UTC	233	IN	HTTP/1.1 403 Forbidden Date: Mon, 07 Oct 2024 09:11:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Server: BunnyCDN-DE1-756 CDN-RequestId: a445dc0592cc27fa0be5973ddab82798
2024-10-07 09:11:26 UTC	724	IN	Data Raw: 32 63 38 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 6f 6e 74 73 2e 62 75 6e 6e 79 2e 6e 65 74 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 75 62 69 6b 3a 33 30 30 2c 34 30 30 2c 35 30 30 2c 37 30 30 2c 39 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 75 6e 6e 79 63 64 6e 2e 62 2d 63 64 6e 2e 6e 65 74 2f 61 73 73 65 74 73 2f 6c 61 6e 64 69 6e 67 70 61 67 65 2f 63 73 73 2f 75 6e 63 6f 6e 66 69 67 75 72 65 64 2e 63 73 73 22 3e 20 3c 74 69 74 6c 65 3e 42 75 6e 6e 79 43 44 4e 20 4e 6f 64 65 20 44 45 31 2d 37 35 36 3c 2f 74 69 Data Ascii: 2c8<html><head> <link href="http://fonts.bunny.net/css?family=Rubik:300,400,500,700,900" rel="stylesheet" type="text/css"> <link rel="stylesheet" href="https://bunnycdn.b-cdn.net/assets/landingpage/css/unconfigured.css"> <title>BunnyCDN Node DE1-756</ti

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:27 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 09:11:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:11:27 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: aa8826a4-b01e-0053-608c-15cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T091127Z-r154656d9bclhnqxthdkb0ps8000000007wg000000001m1h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 09:11:27 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:27 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 09:11:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:11:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 757ce4f4-401e-000a-128c-154a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T091127Z-1767f7688dcddqmnbcgcfkdk6s00000003cg00000000abwv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 09:11:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:27 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 09:11:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:11:27 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: c55c0703-801e-00a0-3f04-182196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T091127Z-r154656d9bcmxqxrqrw0qrf8hg0000000ak0000000009ram x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 09:11:27 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:27 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 09:11:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:11:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 24b39cfc-301e-0096-2a8c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T091127Z-r154656d9bcgk58qzsfr5pfzg40000000rz0000000003pap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 09:11:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:27 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 09:11:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:11:27 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: b2393cc3-501e-005b-768c-15d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T091127Z-1767f7688dcxs7gvbd5dcgxeys0000000rq0000000001dbx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 09:11:27 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:27 UTC	571	OUT	GET /assets/landingpage/css/unconfigured.css HTTP/1.1 Host: bunnycdn.b-cdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://get-zip.b-cdn.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:11:27 UTC	976	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:11:27 GMT Content-Type: text/css Content-Length: 1199 Connection: close Vary: Accept-Encoding Server: BunnyCDN-DE1-1080 CDN-PullZone: 390 CDN-Uid: 51eb4203-ff94-48c6-99a5-954f277b91de CDN-RequestCountryCode: US Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match Access-Control-Expose-Headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match Cache-Control: public, max-age=2592000 ETag: "0ebc14fe13db1:0" Last-Modified: Tue, 01 Oct 2024 12:32:46 GMT Backend: 1 CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 200 CDN-CachedAt: 10/07/2024 09:11:27 CDN-EdgeStorageId: 1082 CDN-Status: 200 CDN-RequestTime: 1 CDN-RequestId: 7b9a4b1dd1a0dac9b2789ac11e50dc73 CDN-Cache: MISS Accept-Ranges: bytes
2024-10-07 09:11:27 UTC	1199	IN	Data Raw: ef bb bf 68 74 6d 6c 2c 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 75 62 69 6b 27 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 62 75 6e 6e 79 63 64 6e 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 76 32 2f 69 6d 61 67 65 73 2f 67 65 6e 65 72 61 6c 2f 69 6c 2d 62 67 2d 62 6c 61 63 6b 2d 66 6c 6f 77 65 72 2e 73 76 67 29 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0d 0a 20 20 Data Ascii: html, body { width: 100%; margin: 0; padding: 0; text-align: center; font-family: 'Rubik'; background-image: url(https://bunnycdn.com/assets/v2/images/general/il-bg-black-flower.svg); background-repeat: no-repeat;

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:27 UTC	597	OUT	GET /v2/images/bunnynet-logo.svg HTTP/1.1 Host: bunny.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://get-zip.b-cdn.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-07 09:11:28 UTC	646	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:11:27 GMT Content-Type: image/svg+xml Content-Length: 7011 Connection: close Vary: Accept-Encoding Server: BunnyCDN-DE1-1082 CDN-PullZone: 876725 CDN-Uid: 3a60ca70-b89d-4cd5-a4b5-34a3468d7e0f CDN-RequestCountryCode: US Cache-Control: public, max-age=31536000 ETag: "1d8176d56a5be63" Last-Modified: Tue, 01 Feb 2022 13:12:18 GMT CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 200 CDN-CachedAt: 10/07/2024 09:11:27 CDN-EdgeStorageId: 1080 CDN-Status: 200 CDN-RequestTime: 1 CDN-RequestId: 5a77a590ebe2eb39ef8a0374365feb8d CDN-Cache: MISS Accept-Ranges: bytes
2024-10-07 09:11:28 UTC	7011	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 34 38 2e 31 37 20 34 32 2e 37 31 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 63 6c 73 2d 31 2c 2e 63 6c 73 2d 31 30 2c 2e 63 6c 73 2d 31 31 2c 2e 63 6c 73 2d 32 2c 2e 63 6c 73 2d 33 2c 2e 63 6c 73 2d 34 2c 2e 63 6c 73 2d 35 2c 2e 63 6c 73 2d 36 2c 2e 63 6c 73 2d 37 2c 2e 63 6c 73 2d 38 2c 2e 63 6c 73 2d 39 7b 66 69 6c 6c 2d 72 75 6c 65 3a 65 76 65 6e 6f 64 64 3b 7d 2e 63 6c 73 2d 31 7b 66 69 6c 6c 3a 75 72 6c 28 23 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 29 3b Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 148.17 42.71"><defs><style>.cls-1,.cls-10,.cls-11,.cls-2,.cls-3,.cls-4,.cls-5,.cls-6,.cls-7,.cls-8,.cls-9{fill-rule:evenodd;}.cls-1{fill:url(#linear-gradient);

Timestamp	Bytes transferred	Direction	Data
2024-10-07 09:11:28 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-07 09:11:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 09:11:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 023e3944-a01e-003d-708c-1598d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241007T091128Z-1767f7688dc9hz5543dfnckp1w0000000g50000000002agy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-07 09:11:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">