Edit tour

Windows Analysis Report
https://aka.ms/LearnAboutSenderIdentification.%5D

Overview

General Information

Sample URL:	https://aka.ms/LearnAboutSenderIdentification.%5D
Analysis ID:	1545886
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Form action URLs do not match main URL

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5840 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1968,i,16302990646006207657,489257779820627759,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6280 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://aka.ms/LearnAboutSenderIdentification.%5D" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://www.bing.com/?ref=aka&shorturl=LearnAboutSenderIdentification.]

HTTP Parser: Form action: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token+code&nonce=a1991546-c718-47db-ae29-dbab9e0cff64&redirect_uri=https%3a%2f%2fwww.bing.com%2forgid%2fidtoken%2fconditional&scope=openid%20email%20profile%209ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7/.default&response_mode=form_post&instance_aware=true&msafed=0&prompt=none&state=%7b%22ig%22%3a%224AAA8E10375B467FBC9D0704BC4B7EE5%22%7d&sso_reload=true bing microsoftonline

Source: https://www.bing.com/?ref=aka&shorturl=LearnAboutSenderIdentification.]	HTTP Parser: No favicon
Source: https://www.bing.com/?ref=aka&shorturl=LearnAboutSenderIdentification.]	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:50172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:50372 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: aka.ms
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: www.msn.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com

Source: chromecache_218.2.dr, chromecache_348.2.dr	String found in binary or memory: http://adaptivecards.io/schemas/adaptive-card.json
Source: chromecache_437.2.dr, chromecache_536.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_437.2.dr, chromecache_536.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_200.2.dr	String found in binary or memory: https://affiliate.insider.com?h=e27784aee7e38b7f8d88b7f533052a39d3bcb430fafa7ad4ce4ce1f503d86204&pla
Source: chromecache_492.2.dr, chromecache_298.2.dr	String found in binary or memory: https://assets.msn.$
Source: chromecache_218.2.dr, chromecache_348.2.dr	String found in binary or memory: https://assets.msn.com/content/view/v1/Preview/$
Source: chromecache_200.2.dr	String found in binary or memory: https://businessofhome.com/articles/more-stores-a-restructure-and-trade-perks-crate-barrel-s-ceo-tal
Source: chromecache_350.2.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13DrkE
Source: chromecache_350.2.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13DrkE-dark
Source: chromecache_350.2.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gDvl
Source: chromecache_350.2.dr	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gDvl-dark
Source: chromecache_350.2.dr	String found in binary or memory: https://chachingqueen.com/free-grocery-store-items/
Source: chromecache_200.2.dr	String found in binary or memory: https://chachingqueen.com/passive-real-estate-investing/
Source: chromecache_200.2.dr	String found in binary or memory: https://chachingqueen.com/states-the-average-buyer-can-still-afford-a-house/
Source: chromecache_200.2.dr	String found in binary or memory: https://chachingqueen.com/usa-moving-trends/
Source: chromecache_437.2.dr, chromecache_536.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_508.2.dr, chromecache_276.2.dr	String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_508.2.dr, chromecache_276.2.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.37.1/LICENSE
Source: chromecache_350.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1721px.img
Source: chromecache_350.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1g7fkP.img
Source: chromecache_350.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1iq0gq.img
Source: chromecache_200.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1qZsyg.img
Source: chromecache_200.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1rjFIT.img
Source: chromecache_350.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1sEHdh.img
Source: chromecache_350.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1sET62.img
Source: chromecache_350.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1sEVtF.img
Source: chromecache_350.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAGmzvE.img
Source: chromecache_350.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAIwViw.img
Source: chromecache_350.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17bMnx.img
Source: chromecache_200.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1n2h0S.img
Source: chromecache_200.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1nbzLA.img
Source: chromecache_350.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBERG9W.img
Source: chromecache_350.2.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBtOBsY.img
Source: chromecache_493.2.dr, chromecache_420.2.dr	String found in binary or memory: https://login.chinacloudapi.cn
Source: chromecache_493.2.dr, chromecache_420.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_493.2.dr, chromecache_420.2.dr	String found in binary or memory: https://login.microsoftonline.de
Source: chromecache_493.2.dr, chromecache_420.2.dr	String found in binary or memory: https://login.microsoftonline.us
Source: chromecache_493.2.dr, chromecache_420.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_218.2.dr, chromecache_348.2.dr	String found in binary or memory: https://msasg.visualstudio.com/Bing_Ads/_workitems/edit/3905327
Source: chromecache_218.2.dr, chromecache_348.2.dr	String found in binary or memory: https://msasg.visualstudio.com/ContentServices/_workitems/edit/3620803
Source: chromecache_350.2.dr	String found in binary or memory: https://prod-streaming-video-msn-com.akamaized.net/v1/eus004/8438d047-aa94-47a3-85f6-0fb4b04a97f9/0d
Source: chromecache_350.2.dr	String found in binary or memory: https://prod-streaming-video-msn-com.akamaized.net/v1/eus004/8d6666b0-b405-451d-a30b-e664424ba3a0/39
Source: chromecache_350.2.dr	String found in binary or memory: https://prod-video-cms-amp-microsoft-com.akamaized.net/tenant/amp/entityid/AA1r3cxM?blobrefkey=close
Source: chromecache_180.2.dr, chromecache_529.2.dr	String found in binary or memory: https://service.weibo.com/share/share.php?url=
Source: chromecache_180.2.dr, chromecache_529.2.dr	String found in binary or memory: https://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?title=
Source: chromecache_200.2.dr	String found in binary or memory: https://unsplash.com/s/photos/investment-properties
Source: chromecache_200.2.dr	String found in binary or memory: https://www.businessinsider.com/christmas-holiday-decor-shopping-review-pottery-barn-vs-crate-and-ba
Source: chromecache_200.2.dr	String found in binary or memory: https://www.businessinsider.com/crate-and-barrel-best-things-there-interior-decorator-says-2024
Source: chromecache_200.2.dr	String found in binary or memory: https://www.businessinsider.com/things-interior-designer-would-never-get-at-ikea-what-to-buy
Source: chromecache_350.2.dr	String found in binary or memory: https://www.costco.com/CatalogSearch?dept=All&keyword=EasyOn
Source: chromecache_350.2.dr	String found in binary or memory: https://www.familyhandyman.com/heating-cooling/furnace-repair/how-to-change-a-furnace-filter/
Source: chromecache_350.2.dr	String found in binary or memory: https://www.familyhandyman.com/project/gutter-cleaning/
Source: chromecache_350.2.dr	String found in binary or memory: https://www.familyhandyman.com/project/how-to-change-a-dirty-furnace-filter/
Source: chromecache_350.2.dr	String found in binary or memory: https://www.familyhandyman.com/smart-homeowner/13-costco-tips-frequent-shoppers-keep-to-themselves/
Source: chromecache_361.2.dr, chromecache_501.2.dr	String found in binary or memory: https://www.msn.com
Source: chromecache_200.2.dr, chromecache_350.2.dr	String found in binary or memory: https://www.msn.com/en-us/entertainment/news/wicked-viewers-demand-oscar-consideration-for-ariana-gr
Source: chromecache_350.2.dr	String found in binary or memory: https://www.msn.com/en-us/foodanddrink/foodnews/arby-s-just-brought-back-2-fall-sandwiches-fans-wish
Source: chromecache_350.2.dr	String found in binary or memory: https://www.msn.com/en-us/lifestyle/home-and-garden/30-products-diyers-shouldn-t-pass-up-at-costco/s
Source: chromecache_350.2.dr	String found in binary or memory: https://www.msn.com/en-us/money/news/bank-of-america-will-stop-accepting-1-bills/ar-AA1tdOCo
Source: chromecache_350.2.dr	String found in binary or memory: https://www.msn.com/en-us/money/other/17-things-you-can-get-for-free-at-grocery-stores/vi-AA1r3cxM
Source: chromecache_200.2.dr, chromecache_350.2.dr	String found in binary or memory: https://www.msn.com/en-us/news/crime/delphi-murder-suspect-s-alleged-jail-confessions-revealed-in-co
Source: chromecache_200.2.dr, chromecache_350.2.dr	String found in binary or memory: https://www.msn.com/en-us/news/politics/uncomfortable-nikki-haley-backers-weigh-their-options-with-e
Source: chromecache_200.2.dr, chromecache_350.2.dr	String found in binary or memory: https://www.msn.com/en-us/news/us/supreme-court-s-conservative-justices-leave-in-place-virginia-s-pu
Source: chromecache_200.2.dr, chromecache_350.2.dr	String found in binary or memory: https://www.msn.com/en-us/news/world/locked-in-mideast-wars-and-battered-by-sanctions-iran-is-wary-o
Source: chromecache_200.2.dr, chromecache_350.2.dr	String found in binary or memory: https://www.msn.com/en-us/news/world/north-korea-launches-a-new-intercontinental-ballistic-missile-d
Source: chromecache_200.2.dr, chromecache_350.2.dr	String found in binary or memory: https://www.msn.com/en-us/news/world/ukrainian-front-line-school-system-goes-underground-to-protect-
Source: chromecache_350.2.dr	String found in binary or memory: https://www.msn.com/en-us/sports/mlb/comeback-dodgers-come-back-home-as-champions/ar-AA1teVlu
Source: chromecache_350.2.dr	String found in binary or memory: https://www.msn.com/en-us/travel/news/divers-discover-mesmerizing-roman-mosaic-beneath-the-sea/ar-BB
Source: chromecache_350.2.dr	String found in binary or memory: https://www.msn.com/en-us/tv/news/seinfeld-will-finally-be-released-on-blu-ray-on-dec-17-just-in-tim
Source: chromecache_350.2.dr	String found in binary or memory: https://www.slashgear.com/862997/the-fascinating-history-of-nintendo/
Source: chromecache_350.2.dr	String found in binary or memory: https://www.svg.com/112351/wii-u-flopped/
Source: chromecache_350.2.dr	String found in binary or memory: https://www.svg.com/457200/zelda-games-ranked-from-worst-to-best/

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1968,i,16302990646006207657,489257779820627759,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://aka.ms/LearnAboutSenderIdentification.%5D"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1968,i,16302990646006207657,489257779820627759,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Link
sni1gl.wpc.omegacdn.net	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
s-part-0017.t-0009.t-msedge.net	0%	Virustotal	Browse

Source	Detection	Scanner	Label
https://login.microsoftonline.com	0%	URL Reputation	safe
http://knockoutjs.com/	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php)	0%	URL Reputation	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.186.164	true	false	0%, Virustotal, Browse	unknown
aka.ms	104.119.110.121	true	false		unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		unknown
assets.msn.com	unknown	unknown	false		unknown
www.msn.com	unknown	unknown	false		unknown
c.msn.com	unknown	unknown	false		unknown
aadcdn.msftauth.net	unknown	unknown	false		unknown
login.microsoftonline.com	unknown	unknown	false		unknown
browser.events.data.msn.com	unknown	unknown	false		unknown

Source: global traffic	HTTP traffic detected: GET /LearnAboutSenderIdentification.%5D HTTP/1.1Host: aka.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.microsoftonline.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

IP	Domain	Country	ASN	ASN Name	Malicious
104.119.110.121	aka.ms	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545886
Start date and time:	2024-10-31 09:16:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://aka.ms/LearnAboutSenderIdentification.%5D
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@19/585@24/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 72 x 72, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1963
Entropy (8bit):	7.811721131228544
Encrypted:	false
SSDEEP:	24:KRNWJ+7moYtgs/Mvk3O6Ix9/RDWboKRNNYvIa59M2Ly5L7O4FL22qoAct:1J+7mus/pE/dUfaiX5nO2L2voAQ
MD5:	0750BE1C3098BED72175E0BCD608D11B
SHA1:	4D67627E900073C6263091694CF2B4DA7AD970B4
SHA-256:	3E01D1D5CA786ABCB2149FBE8F3F3653C4AFF76A98EDEAABCD7FE34B8987F4D2
SHA-512:	0067D84487724895F330CF87E745B02E36FE5B35B690BE3C732C784C96D7DA6388F335495F9073B1B957C1CE46DF8AB02620EDB8E210C3137780D7EDC26CC210
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...H...H.....b3Cu....PLTE.................................................................................................................................................................................................>tRNS.(&%.,1510J6R;OT4V8?@GFQPM4L;@A=DC=:URLJ8NGEITLC%.+fX.a\RL1.......bIDATX...v.P...*.4@H....B....-....Z.}..`..Gj..~k..ayu..[o.\..........v...../....~R....b... .5....Z...]....+J~.....?0..)4......z.......F..W.h).]dvy..`........P..m...0...,.e#<2.X.....m.8.8..AA5.%...B}...r...Oo...-4h.....9.s.k...-CI{..e.M..y.....nO.R.l.Ci_.:+..T..x^.Z.{xTI.$..o.w....H_~7}.g...Q..,k.P..0?w.:..L.Q....cJ.;....N.X...Q.._...T"==>>/!.:&.X.N:.M[dTi..EJ..G..j...4..7......pL...........Z..p_ll.@......L.C...@..P..@?V.. ..I/....t.@_t.5+.R..o...j....'4.....8i...2....44l....+.T/o...6.:.j.q*....'C.S.....3.V..f.'....u..fct.(...Ui6MsO..W.:2j..I7....t.).^.6..b.0..6...OR.....\|......+3aL.........Ig...{2.L...:!4@.1N....].y}A..r..;.3.0.N....A..j.....Co.....@.^

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.msn.com/en-us/news/politics/uncomfortable-nikki-haley-backers-weigh-their-options-with-e	chromecache_200.2.dr, chromecache_350.2.dr	false		unknown
https://www.msn.com/en-us/money/news/bank-of-america-will-stop-accepting-1-bills/ar-AA1tdOCo	chromecache_350.2.dr	false		unknown
https://github.com/zloirock/core-js	chromecache_508.2.dr, chromecache_276.2.dr	false		unknown
https://www.familyhandyman.com/smart-homeowner/13-costco-tips-frequent-shoppers-keep-to-themselves/	chromecache_350.2.dr	false		unknown
https://msasg.visualstudio.com/Bing_Ads/_workitems/edit/3905327	chromecache_218.2.dr, chromecache_348.2.dr	false		unknown
https://www.msn.com/en-us/news/world/north-korea-launches-a-new-intercontinental-ballistic-missile-d	chromecache_200.2.dr, chromecache_350.2.dr	false		unknown
https://sns.qzone.qq.com/cgi-bin/qzshare/cgi_qzshare_onekey?title=	chromecache_180.2.dr, chromecache_529.2.dr	false		unknown
https://login.chinacloudapi.cn	chromecache_493.2.dr, chromecache_420.2.dr	false		unknown
https://www.familyhandyman.com/heating-cooling/furnace-repair/how-to-change-a-furnace-filter/	chromecache_350.2.dr	false		unknown
https://chachingqueen.com/states-the-average-buyer-can-still-afford-a-house/	chromecache_200.2.dr	false		unknown
https://login.windows-ppe.net	chromecache_493.2.dr, chromecache_420.2.dr	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13DrkE	chromecache_350.2.dr	false		unknown
https://www.costco.com/CatalogSearch?dept=All&keyword=EasyOn	chromecache_350.2.dr	false		unknown
https://login.microsoftonline.us	chromecache_493.2.dr, chromecache_420.2.dr	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gDvl	chromecache_350.2.dr	false		unknown
https://login.microsoftonline.com	chromecache_493.2.dr, chromecache_420.2.dr	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gDvl-dark	chromecache_350.2.dr	false		unknown
https://www.msn.com	chromecache_361.2.dr, chromecache_501.2.dr	false		unknown
https://www.svg.com/112351/wii-u-flopped/	chromecache_350.2.dr	false		unknown
https://www.familyhandyman.com/project/gutter-cleaning/	chromecache_350.2.dr	false		unknown
https://msasg.visualstudio.com/ContentServices/_workitems/edit/3620803	chromecache_218.2.dr, chromecache_348.2.dr	false		unknown
https://www.msn.com/en-us/sports/mlb/comeback-dodgers-come-back-home-as-champions/ar-AA1teVlu	chromecache_350.2.dr	false		unknown
https://www.msn.com/en-us/tv/news/seinfeld-will-finally-be-released-on-blu-ray-on-dec-17-just-in-tim	chromecache_350.2.dr	false		unknown
https://www.svg.com/457200/zelda-games-ranked-from-worst-to-best/	chromecache_350.2.dr	false		unknown
https://www.msn.com/en-us/foodanddrink/foodnews/arby-s-just-brought-back-2-fall-sandwiches-fans-wish	chromecache_350.2.dr	false		unknown
https://chachingqueen.com/usa-moving-trends/	chromecache_200.2.dr	false		unknown
https://businessofhome.com/articles/more-stores-a-restructure-and-trade-perks-crate-barrel-s-ceo-tal	chromecache_200.2.dr	false		unknown
https://github.com/zloirock/core-js/blob/v3.37.1/LICENSE	chromecache_508.2.dr, chromecache_276.2.dr	false		unknown
https://www.businessinsider.com/christmas-holiday-decor-shopping-review-pottery-barn-vs-crate-and-ba	chromecache_200.2.dr	false		unknown
https://login.microsoftonline.de	chromecache_493.2.dr, chromecache_420.2.dr	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13DrkE-dark	chromecache_350.2.dr	false		unknown
https://unsplash.com/s/photos/investment-properties	chromecache_200.2.dr	false		unknown
https://www.msn.com/en-us/entertainment/news/wicked-viewers-demand-oscar-consideration-for-ariana-gr	chromecache_200.2.dr, chromecache_350.2.dr	false		unknown
http://adaptivecards.io/schemas/adaptive-card.json	chromecache_218.2.dr, chromecache_348.2.dr	false		unknown
https://www.familyhandyman.com/project/how-to-change-a-dirty-furnace-filter/	chromecache_350.2.dr	false		unknown
https://www.msn.com/en-us/travel/news/divers-discover-mesmerizing-roman-mosaic-beneath-the-sea/ar-BB	chromecache_350.2.dr	false		unknown
https://www.businessinsider.com/crate-and-barrel-best-things-there-interior-decorator-says-2024	chromecache_200.2.dr	false		unknown
http://knockoutjs.com/	chromecache_437.2.dr, chromecache_536.2.dr	false	URL Reputation: safe	unknown
https://assets.msn.com/content/view/v1/Preview/$	chromecache_218.2.dr, chromecache_348.2.dr	false		unknown
https://www.msn.com/en-us/money/other/17-things-you-can-get-for-free-at-grocery-stores/vi-AA1r3cxM	chromecache_350.2.dr	false		unknown
https://github.com/douglascrockford/JSON-js	chromecache_437.2.dr, chromecache_536.2.dr	false		unknown
https://affiliate.insider.com?h=e27784aee7e38b7f8d88b7f533052a39d3bcb430fafa7ad4ce4ce1f503d86204&pla	chromecache_200.2.dr	false		unknown
https://chachingqueen.com/free-grocery-store-items/	chromecache_350.2.dr	false		unknown
https://www.msn.com/en-us/news/us/supreme-court-s-conservative-justices-leave-in-place-virginia-s-pu	chromecache_200.2.dr, chromecache_350.2.dr	false		unknown
https://www.msn.com/en-us/lifestyle/home-and-garden/30-products-diyers-shouldn-t-pass-up-at-costco/s	chromecache_350.2.dr	false		unknown
https://www.msn.com/en-us/news/crime/delphi-murder-suspect-s-alleged-jail-confessions-revealed-in-co	chromecache_200.2.dr, chromecache_350.2.dr	false		unknown
https://service.weibo.com/share/share.php?url=	chromecache_180.2.dr, chromecache_529.2.dr	false		unknown
https://www.msn.com/en-us/news/world/locked-in-mideast-wars-and-battered-by-sanctions-iran-is-wary-o	chromecache_200.2.dr, chromecache_350.2.dr	false		unknown
https://www.businessinsider.com/things-interior-designer-would-never-get-at-ikea-what-to-buy	chromecache_200.2.dr	false		unknown
http://www.opensource.org/licenses/mit-license.php)	chromecache_437.2.dr, chromecache_536.2.dr	false	URL Reputation: safe	unknown
https://chachingqueen.com/passive-real-estate-investing/	chromecache_200.2.dr	false		unknown
https://www.slashgear.com/862997/the-fascinating-history-of-nintendo/	chromecache_350.2.dr	false		unknown
https://assets.msn.$	chromecache_492.2.dr, chromecache_298.2.dr	false		unknown
https://www.msn.com/en-us/news/world/ukrainian-front-line-school-system-goes-underground-to-protect-	chromecache_200.2.dr, chromecache_350.2.dr	false		unknown

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 09:17:12.867254972 CET	53	63294	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:12.867297888 CET	53	57412	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:14.154094934 CET	53	52103	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:15.040098906 CET	54487	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:15.040273905 CET	59728	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:15.046880007 CET	53	54487	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:15.047436953 CET	53	59728	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:17.558969975 CET	59272	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:17.558969975 CET	58455	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:17.565655947 CET	53	58455	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:17.565800905 CET	53	59272	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:23.221182108 CET	138	138	192.168.2.4	192.168.2.255
Oct 31, 2024 09:17:30.154813051 CET	57346	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:30.155131102 CET	56787	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:31.271753073 CET	53	56092	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:31.339481115 CET	54437	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:31.339648962 CET	58117	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:31.502984047 CET	58772	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:31.503146887 CET	51045	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:31.509907007 CET	53	51045	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:32.845846891 CET	52189	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:32.846012115 CET	50410	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:32.853368044 CET	53	50410	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:42.775860071 CET	52320	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:42.776072025 CET	52881	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:44.362576008 CET	49292	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:44.362786055 CET	58893	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:44.369345903 CET	53	49292	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:44.369952917 CET	53	58893	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:45.147053957 CET	59554	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:45.147269964 CET	59820	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:45.154654980 CET	53	59820	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:46.601526976 CET	64355	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:46.602129936 CET	64197	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:46.608325958 CET	53	64355	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:46.609935045 CET	53	64197	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:49.117809057 CET	50585	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:49.118449926 CET	64772	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:49.354517937 CET	57492	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:49.354856014 CET	53092	53	192.168.2.4	1.1.1.1
Oct 31, 2024 09:17:49.362018108 CET	53	53092	1.1.1.1	192.168.2.4
Oct 31, 2024 09:17:50.432693005 CET	53	61188	1.1.1.1	192.168.2.4
Oct 31, 2024 09:18:12.829289913 CET	53	57240	1.1.1.1	192.168.2.4
Oct 31, 2024 09:18:13.279123068 CET	53	60618	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:17:15 UTC	683	OUT	GET /LearnAboutSenderIdentification.%5D HTTP/1.1 Host: aka.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 08:17:16 UTC	476	IN	HTTP/1.1 302 Moved Temporarily Content-Length: 0 Server: Kestrel Location: https://www.bing.com?ref=aka&shorturl=LearnAboutSenderIdentification.] Request-Context: appId=cid-v1:b47e5e27-bf85-45ba-a97c-0377ce0e5779 X-Response-Cache-Status: True Expires: Thu, 31 Oct 2024 08:17:16 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Thu, 31 Oct 2024 08:17:16 GMT Connection: close Strict-Transport-Security: max-age=31536000 ; includeSubDomains

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:17:20 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 08:17:20 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=203292 Date: Thu, 31 Oct 2024 08:17:20 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:17:21 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 08:17:21 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=203330 Date: Thu, 31 Oct 2024 08:17:21 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-31 08:17:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:17:45 UTC	635	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://login.microsoftonline.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 08:17:45 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2442891 Cache-Control: public, max-age=31536000 Content-MD5: m5bMCfnonQM0ui+8IrUZeg== Content-Type: application/x-javascript Date: Thu, 31 Oct 2024 08:17:45 GMT Etag: 0x8DCE31CBE97473C Last-Modified: Wed, 02 Oct 2024 19:59:37 GMT Server: ECAcc (lhc/78AB) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: fb7c97c3-801e-0062-1535-154340000000 x-ms-version: 2009-09-19 Content-Length: 142367 Connection: close
2024-10-31 08:17:45 UTC	15652	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-10-31 08:17:45 UTC	16383	IN	Data Raw: 69 74 65 29 20 7b 20 20 2e 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 2d 64 65 74 65 63 74 69 6f 6e 3a 3a 62 65 66 6f 72 65 20 7b 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 22 77 68 69 74 65 22 3b 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 20 20 7d 7d 40 6d 65 64 69 61 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 20 77 68 69 74 65 2d 6f 6e 2d 62 6c 61 63 6b 29 20 7b 20 20 2e 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 2d 64 65 74 65 63 74 69 6f 6e 3a 3a 62 65 66 6f 72 65 20 7b 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 22 62 6c 61 63 6b 22 3b 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 20 20 7d 7d 27 2c 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 3b 76 61 72 20 6e 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 Data Ascii: ite) { .high-contrast-detection::before { content: "white"; display: none; }}@media (-ms-high-contrast: white-on-black) { .high-contrast-detection::before { content: "black"; display: none; }}',e.appendChild(t);var n=document.createElement
2024-10-31 08:17:45 UTC	16383	IN	Data Raw: 6f 6e 49 6e 76 61 6c 69 64 3a 31 30 32 34 2c 54 4f 54 50 49 6e 76 61 6c 69 64 3a 31 30 32 35 2c 53 65 73 73 69 6f 6e 4e 6f 74 41 70 70 72 6f 76 65 64 3a 31 30 32 36 2c 50 68 6f 6e 65 4e 75 6d 62 65 72 49 6e 76 61 6c 69 64 3a 31 30 32 37 2c 50 68 6f 6e 65 46 6f 72 6d 61 74 74 69 6e 67 49 6e 76 61 6c 69 64 3a 31 30 32 38 2c 50 6f 6c 6c 69 6e 67 54 69 6d 65 64 4f 75 74 3a 31 30 32 39 2c 53 65 6e 64 4e 6f 74 69 66 69 63 61 74 69 6f 6e 46 61 69 6c 65 64 3a 31 30 33 30 2c 53 65 72 76 65 72 5f 4d 65 73 73 61 67 65 4f 6e 6c 79 3a 39 39 39 39 2c 50 50 5f 45 5f 44 42 5f 4d 45 4d 42 45 52 44 4f 45 53 4e 4f 54 45 58 49 53 54 3a 22 43 46 46 46 46 43 31 35 22 2c 50 50 5f 45 5f 45 58 43 4c 55 44 45 44 3a 22 38 30 30 34 31 30 31 30 22 2c 50 50 5f 45 5f 4d 45 4d 42 45 52 Data Ascii: onInvalid:1024,TOTPInvalid:1025,SessionNotApproved:1026,PhoneNumberInvalid:1027,PhoneFormattingInvalid:1028,PollingTimedOut:1029,SendNotificationFailed:1030,Server_MessageOnly:9999,PP_E_DB_MEMBERDOESNOTEXIST:"CFFFFC15",PP_E_EXCLUDED:"80041010",PP_E_MEMBER
2024-10-31 08:17:46 UTC	16383	IN	Data Raw: 2e 67 64 28 29 29 7d 76 61 72 20 68 2c 67 2c 6d 2c 76 2c 62 2c 79 2c 53 3d 76 6f 69 64 20 30 21 3d 3d 65 3f 65 3a 7b 7d 3b 53 2e 62 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 65 2e 73 70 6c 69 74 28 22 2e 22 29 2c 72 3d 53 2c 6f 3d 30 3b 6f 3c 6e 2e 6c 65 6e 67 74 68 2d 31 3b 6f 2b 2b 29 72 3d 72 5b 6e 5b 6f 5d 5d 3b 72 5b 6e 5b 6e 2e 6c 65 6e 67 74 68 2d 31 5d 5d 3d 74 7d 2c 53 2e 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 5b 74 5d 3d 6e 7d 2c 53 2e 76 65 72 73 69 6f 6e 3d 22 33 2e 35 2e 31 22 2c 53 2e 62 28 22 76 65 72 73 69 6f 6e 22 2c 53 2e 76 65 72 73 69 6f 6e 29 2c 53 2e 6f 70 74 69 6f 6e 73 3d 7b 64 65 66 65 72 55 70 64 61 74 65 73 3a 21 31 2c 75 73 65 4f 6e 6c 79 4e 61 74 69 76 65 45 76 65 6e 74 73 3a Data Ascii: .gd())}var h,g,m,v,b,y,S=void 0!==e?e:{};S.b=function(e,t){for(var n=e.split("."),r=S,o=0;o<n.length-1;o++)r=r[n[o]];r[n[n.length-1]]=t},S.L=function(e,t,n){e[t]=n},S.version="3.5.1",S.b("version",S.version),S.options={deferUpdates:!1,useOnlyNativeEvents:
2024-10-31 08:17:46 UTC	16383	IN	Data Raw: 7d 7d 3b 53 2e 4c 28 45 2c 22 69 6e 69 74 22 2c 45 2e 71 62 29 2c 53 2e 4c 28 45 2c 22 73 75 62 73 63 72 69 62 65 22 2c 45 2e 73 75 62 73 63 72 69 62 65 29 2c 53 2e 4c 28 45 2c 22 65 78 74 65 6e 64 22 2c 45 2e 65 78 74 65 6e 64 29 2c 53 2e 4c 28 45 2c 22 67 65 74 53 75 62 73 63 72 69 70 74 69 6f 6e 73 43 6f 75 6e 74 22 2c 45 2e 42 64 29 2c 53 2e 61 2e 42 61 26 26 53 2e 61 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 45 2c 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 29 2c 53 2e 54 2e 66 6e 3d 45 2c 53 2e 51 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 2e 73 75 62 73 63 72 69 62 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 Data Ascii: }};S.L(E,"init",E.qb),S.L(E,"subscribe",E.subscribe),S.L(E,"extend",E.extend),S.L(E,"getSubscriptionsCount",E.Bd),S.a.Ba&&S.a.setPrototypeOf(E,Function.prototype),S.T.fn=E,S.Qc=function(e){return null!=e&&"function"==typeof e.subscribe&&"function"==typeof
2024-10-31 08:17:46 UTC	16383	IN	Data Raw: 61 73 42 69 6e 64 69 6e 67 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 73 77 69 74 63 68 28 65 2e 6e 6f 64 65 54 79 70 65 29 7b 63 61 73 65 20 31 3a 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 62 69 6e 64 22 29 7c 7c 53 2e 6a 2e 67 65 74 43 6f 6d 70 6f 6e 65 6e 74 4e 61 6d 65 46 6f 72 4e 6f 64 65 28 65 29 3b 63 61 73 65 20 38 3a 72 65 74 75 72 6e 20 53 2e 68 2e 43 64 28 65 29 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 21 31 7d 7d 2c 67 65 74 42 69 6e 64 69 6e 67 73 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 28 6e 3d 74 68 69 73 2e 67 65 74 42 69 6e 64 69 6e 67 73 53 74 72 69 6e 67 28 65 2c 74 29 29 3f 74 68 69 73 2e 70 61 72 73 65 42 69 6e 64 69 6e 67 73 53 74 72 69 6e 67 28 6e Data Ascii: asBindings:function(e){switch(e.nodeType){case 1:return null!=e.getAttribute("data-bind")\|\|S.j.getComponentNameForNode(e);case 8:return S.h.Cd(e);default:return!1}},getBindings:function(e,t){var n=(n=this.getBindingsString(e,t))?this.parseBindingsString(n
2024-10-31 08:17:46 UTC	16383	IN	Data Raw: 21 31 2c 21 30 29 2c 65 28 22 77 69 74 68 22 2c 21 30 29 7d 28 29 2c 53 2e 63 5b 22 6c 65 74 22 5d 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 2c 6f 29 7b 72 65 74 75 72 6e 20 74 3d 6f 2e 65 78 74 65 6e 64 28 74 29 2c 53 2e 4f 61 28 74 2c 65 29 2c 7b 63 6f 6e 74 72 6f 6c 73 44 65 73 63 65 6e 64 61 6e 74 42 69 6e 64 69 6e 67 73 3a 21 30 7d 7d 7d 2c 53 2e 68 2e 65 61 5b 22 6c 65 74 22 5d 3d 21 30 3b 76 61 72 20 44 3d 7b 7d 3b 53 2e 63 2e 6f 70 74 69 6f 6e 73 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 22 73 65 6c 65 63 74 22 21 3d 3d 53 2e 61 2e 52 28 65 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6f 70 74 69 6f 6e 73 20 62 69 6e 64 69 6e 67 20 61 70 70 6c 69 65 73 20 6f 6e 6c 79 20 74 6f 20 53 45 4c 45 43 54 Data Ascii: !1,!0),e("with",!0)}(),S.c["let"]={init:function(e,t,n,r,o){return t=o.extend(t),S.Oa(t,e),{controlsDescendantBindings:!0}}},S.h.ea["let"]=!0;var D={};S.c.options={init:function(e){if("select"!==S.a.R(e))throw Error("options binding applies only to SELECT
2024-10-31 08:17:46 UTC	16383	IN	Data Raw: 73 65 74 44 6f 6d 4e 6f 64 65 43 68 69 6c 64 72 65 6e 46 72 6f 6d 41 72 72 61 79 4d 61 70 70 69 6e 67 22 2c 53 2e 61 2e 65 63 29 2c 53 2e 62 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 61 6c 6c 6f 77 54 65 6d 70 6c 61 74 65 52 65 77 72 69 74 69 6e 67 3d 21 31 7d 2c 53 2e 62 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 65 77 20 53 2e 63 61 2c 53 2e 62 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 53 2e 62 61 2c 53 2e 62 61 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 6e 64 65 72 54 65 6d 70 6c 61 74 65 53 6f 75 72 63 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 72 65 74 75 72 6e 28 74 3d 39 3e 53 2e 61 2e 57 7c 7c 21 65 2e 6e 6f 64 65 73 3f 6e 75 6c 6c 3a 65 2e 6e 6f 64 65 73 28 29 29 3f 53 2e 61 2e 6c 61 28 74 2e 63 Data Ascii: setDomNodeChildrenFromArrayMapping",S.a.ec),S.ba=function(){this.allowTemplateRewriting=!1},S.ba.prototype=new S.ca,S.ba.prototype.constructor=S.ba,S.ba.prototype.renderTemplateSource=function(e,t,n,r){return(t=9>S.a.W\|\|!e.nodes?null:e.nodes())?S.a.la(t.c
2024-10-31 08:17:46 UTC	12034	IN	Data Raw: 65 6e 28 6e 75 6c 6c 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 3f 6e 2e 72 65 6c 6f 61 64 4f 6e 46 61 69 6c 75 72 65 3f 7b 72 65 64 69 72 65 63 74 55 72 6c 3a 76 28 29 7d 3a 7b 72 65 64 69 72 65 63 74 55 72 6c 3a 6e 2e 66 61 69 6c 75 72 65 52 65 64 69 72 65 63 74 55 72 6c 7d 3a 73 2e 72 65 6a 65 63 74 28 65 29 7d 29 29 29 3a 73 2e 72 65 6a 65 63 74 28 22 62 73 73 6f 44 69 73 61 62 6c 65 64 22 29 7d 2c 74 68 69 73 2e 69 73 45 6e 61 62 6c 65 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 6e 2e 65 6e 61 62 6c 65 64 7d 2c 6e 2e 65 6e 61 62 6c 65 64 26 26 28 6d 3d 7b 72 65 73 75 6c 74 3a 6e 75 6c 6c 2c 65 72 72 6f 72 3a 6e 75 6c 6c 2c 74 79 70 65 3a 6e 2e 74 65 6c 65 6d 65 74 72 79 2e 74 79 70 65 7c 7c 6e 75 6c 6c 2c 64 Data Ascii: en(null,(function(e){return t?n.reloadOnFailure?{redirectUrl:v()}:{redirectUrl:n.failureRedirectUrl}:s.reject(e)}))):s.reject("bssoDisabled")},this.isEnabled=function(){return!!n.enabled},n.enabled&&(m={result:null,error:null,type:n.telemetry.type\|\|null,d

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:17:47 UTC	410	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 08:17:48 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 2442893 Cache-Control: public, max-age=31536000 Content-MD5: m5bMCfnonQM0ui+8IrUZeg== Content-Type: application/x-javascript Date: Thu, 31 Oct 2024 08:17:47 GMT Etag: 0x8DCE31CBE97473C Last-Modified: Wed, 02 Oct 2024 19:59:37 GMT Server: ECAcc (lhc/78AB) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: fb7c97c3-801e-0062-1535-154340000000 x-ms-version: 2009-09-19 Content-Length: 142367 Connection: close
2024-10-31 08:17:48 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2024-10-31 08:17:48 UTC	16383	IN	Data Raw: 29 29 7d 66 6f 72 28 76 61 72 20 6f 3d 30 3b 6f 3c 74 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 6f 5d 2e 73 70 6c 69 74 28 22 2c 22 29 2e 6d 61 70 28 4e 75 6d 62 65 72 29 2c 61 3d 69 5b 30 5d 2c 73 3d 69 5b 31 5d 2c 75 3d 69 5b 32 5d 3b 69 66 28 72 28 65 2c 61 2c 73 2c 75 29 29 72 65 74 75 72 6e 21 30 7d 72 65 74 75 72 6e 21 21 6c 2e 66 69 72 73 74 28 6e 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 3d 3d 3d 65 2e 74 72 69 6d 28 29 7d 29 29 7d 69 66 28 5f 2e 69 73 48 69 67 68 43 6f 6e 74 72 61 73 74 28 29 29 7b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 62 6f 64 79 22 29 5b 30 5d 2c 6e 3d 5f 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 74 Data Ascii: ))}for(var o=0;o<t.length;o++){var i=t[o].split(",").map(Number),a=i[0],s=i[1],u=i[2];if(r(e,a,s,u))return!0}return!!l.first(n,(function(t){return t===e.trim()}))}if(_.isHighContrast()){var t=document.getElementsByTagName("body")[0],n=_.getComputedStyle(t
2024-10-31 08:17:48 UTC	16383	IN	Data Raw: 50 50 5f 45 5f 4e 41 4d 45 5f 54 4f 4f 5f 53 48 4f 52 54 3a 22 38 30 30 34 31 31 30 31 22 2c 50 50 5f 45 5f 4e 41 4d 45 5f 49 4e 56 41 4c 49 44 3a 22 38 30 30 34 31 31 30 33 22 2c 50 50 5f 45 5f 49 4e 56 41 4c 49 44 41 52 47 3a 22 38 30 30 34 38 33 38 38 22 2c 50 50 5f 45 5f 53 41 5f 54 4f 4f 53 48 4f 52 54 3a 22 38 30 30 34 31 31 32 30 22 2c 50 50 5f 45 5f 53 41 5f 54 4f 4f 4c 4f 4e 47 3a 22 38 30 30 34 31 31 32 31 22 2c 50 50 5f 45 5f 49 4e 56 41 4c 49 44 5f 50 48 4f 4e 45 4e 55 4d 42 45 52 3a 22 38 30 30 34 31 31 33 46 22 2c 50 50 5f 45 5f 53 45 43 52 45 54 51 5f 43 4f 4e 54 41 49 4e 53 5f 53 45 43 52 45 54 41 3a 22 38 30 30 34 31 31 36 35 22 2c 50 50 5f 45 5f 53 45 43 52 45 54 41 5f 43 4f 4e 54 41 49 4e 53 5f 53 45 43 52 45 54 51 3a 22 38 30 30 34 31 Data Ascii: PP_E_NAME_TOO_SHORT:"80041101",PP_E_NAME_INVALID:"80041103",PP_E_INVALIDARG:"80048388",PP_E_SA_TOOSHORT:"80041120",PP_E_SA_TOOLONG:"80041121",PP_E_INVALID_PHONENUMBER:"8004113F",PP_E_SECRETQ_CONTAINS_SECRETA:"80041165",PP_E_SECRETA_CONTAINS_SECRETQ:"80041
2024-10-31 08:17:48 UTC	3	IN	Data Raw: 3a 22 55 Data Ascii: :"U
2024-10-31 08:17:48 UTC	16383	IN	Data Raw: 49 45 76 65 6e 74 73 22 5d 3d 5b 22 6b 65 79 75 70 22 2c 22 6b 65 79 64 6f 77 6e 22 2c 22 6b 65 79 70 72 65 73 73 22 5d 2c 70 2e 4d 6f 75 73 65 45 76 65 6e 74 73 3d 22 63 6c 69 63 6b 20 64 62 6c 63 6c 69 63 6b 20 6d 6f 75 73 65 64 6f 77 6e 20 6d 6f 75 73 65 75 70 20 6d 6f 75 73 65 6d 6f 76 65 20 6d 6f 75 73 65 6f 76 65 72 20 6d 6f 75 73 65 6f 75 74 20 6d 6f 75 73 65 65 6e 74 65 72 20 6d 6f 75 73 65 6c 65 61 76 65 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 65 28 70 2c 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 74 2e 6c 65 6e 67 74 68 29 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 74 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 68 5b 74 5b 6e 5d 5d 3d 65 7d 29 29 3b 76 61 72 20 67 2c 6d 3d 7b 70 72 6f 70 65 72 74 79 63 68 61 6e 67 65 3a 21 30 7d 2c Data Ascii: IEvents"]=["keyup","keydown","keypress"],p.MouseEvents="click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave".split(" "),e(p,(function(e,t){if(t.length)for(var n=0,r=t.length;n<r;n++)h[t[n]]=e}));var g,m={propertychange:!0},
2024-10-31 08:17:48 UTC	16383	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6e 29 72 65 74 75 72 6e 20 6e 2e 6f 7d 7d 7d 28 29 2c 53 2e 62 28 22 63 6f 6d 70 75 74 65 64 43 6f 6e 74 65 78 74 22 2c 53 2e 53 29 2c 53 2e 62 28 22 63 6f 6d 70 75 74 65 64 43 6f 6e 74 65 78 74 2e 67 65 74 44 65 70 65 6e 64 65 6e 63 69 65 73 43 6f 75 6e 74 22 2c 53 2e 53 2e 71 61 29 2c 53 2e 62 28 22 63 6f 6d 70 75 74 65 64 43 6f 6e 74 65 78 74 2e 67 65 74 44 65 70 65 6e 64 65 6e 63 69 65 73 22 2c 53 2e 53 2e 56 61 29 2c 53 2e 62 28 22 63 6f 6d 70 75 74 65 64 43 6f 6e 74 65 78 74 2e 69 73 49 6e 69 74 69 61 6c 22 2c 53 2e 53 2e 59 61 29 2c 53 2e 62 28 22 63 6f 6d 70 75 74 65 64 43 6f 6e 74 65 78 74 2e 72 65 67 69 73 74 65 72 44 65 70 65 6e 64 65 6e 63 79 22 2c 53 2e 53 2e 63 63 29 2c 53 2e 62 28 22 69 67 6e 6f Data Ascii: :function(){if(n)return n.o}}}(),S.b("computedContext",S.S),S.b("computedContext.getDependenciesCount",S.S.qa),S.b("computedContext.getDependencies",S.S.Va),S.b("computedContext.isInitial",S.S.Ya),S.b("computedContext.registerDependency",S.S.cc),S.b("igno
2024-10-31 08:17:48 UTC	16383	IN	Data Raw: 2e 6d 2e 76 62 28 65 2c 72 29 2b 22 7d 7d 7d 22 3b 73 3d 6e 65 77 20 46 75 6e 63 74 69 6f 6e 28 22 24 63 6f 6e 74 65 78 74 22 2c 22 24 65 6c 65 6d 65 6e 74 22 2c 75 29 2c 6f 3d 69 5b 61 5d 3d 73 7d 72 65 74 75 72 6e 20 6f 28 74 2c 6e 29 7d 63 61 74 63 68 28 63 29 7b 74 68 72 6f 77 20 63 2e 6d 65 73 73 61 67 65 3d 22 55 6e 61 62 6c 65 20 74 6f 20 70 61 72 73 65 20 62 69 6e 64 69 6e 67 73 2e 5c 6e 42 69 6e 64 69 6e 67 73 20 76 61 6c 75 65 3a 20 22 2b 65 2b 22 5c 6e 4d 65 73 73 61 67 65 3a 20 22 2b 63 2e 6d 65 73 73 61 67 65 2c 63 7d 7d 7d 29 2c 53 2e 67 61 2e 69 6e 73 74 61 6e 63 65 3d 6e 65 77 20 53 2e 67 61 2c 53 2e 62 28 22 62 69 6e 64 69 6e 67 50 72 6f 76 69 64 65 72 22 2c 53 2e 67 61 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 Data Ascii: .m.vb(e,r)+"}}}";s=new Function("$context","$element",u),o=i[a]=s}return o(t,n)}catch(c){throw c.message="Unable to parse bindings.\nBindings value: "+e+"\nMessage: "+c.message,c}}}),S.ga.instance=new S.ga,S.b("bindingProvider",S.ga),function(){function e
2024-10-31 08:17:48 UTC	16383	IN	Data Raw: 73 65 74 22 29 26 26 6e 2e 68 61 73 28 22 76 61 6c 75 65 22 29 2c 64 3d 6e 2e 67 65 74 28 22 6f 70 74 69 6f 6e 73 49 6e 63 6c 75 64 65 44 65 73 74 72 6f 79 65 64 22 29 3b 74 3d 7b 7d 3b 76 61 72 20 66 2c 70 3d 5b 5d 3b 6c 7c 7c 28 73 3f 70 3d 53 2e 61 2e 4d 62 28 72 28 29 2c 53 2e 77 2e 4d 29 3a 30 3c 3d 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 26 26 70 2e 70 75 73 68 28 53 2e 77 2e 4d 28 65 2e 6f 70 74 69 6f 6e 73 5b 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 5d 29 29 29 2c 63 26 26 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 63 2e 6c 65 6e 67 74 68 26 26 28 63 3d 5b 63 5d 29 2c 66 3d 53 2e 61 2e 6a 62 28 63 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 64 7c 7c 65 3d 3d 3d 61 7c 7c 6e 75 6c 6c 3d 3d 3d 65 7c 7c Data Ascii: set")&&n.has("value"),d=n.get("optionsIncludeDestroyed");t={};var f,p=[];l\|\|(s?p=S.a.Mb(r(),S.w.M):0<=e.selectedIndex&&p.push(S.w.M(e.options[e.selectedIndex]))),c&&("undefined"==typeof c.length&&(c=[c]),f=S.a.jb(c,(function(e){return d\|\|e===a\|\|null===e\|\|
2024-10-31 08:17:49 UTC	16383	IN	Data Raw: 75 72 6e 20 69 7c 7c 28 69 3d 74 2e 74 65 78 74 28 29 7c 7c 22 22 2c 69 3d 6c 2e 74 65 6d 70 6c 61 74 65 28 6e 75 6c 6c 2c 22 7b 7b 6b 6f 5f 77 69 74 68 20 24 69 74 65 6d 2e 6b 6f 42 69 6e 64 69 6e 67 43 6f 6e 74 65 78 74 7d 7d 22 2b 69 2b 22 7b 7b 2f 6b 6f 5f 77 69 74 68 7d 7d 22 29 2c 74 2e 64 61 74 61 28 22 70 72 65 63 6f 6d 70 69 6c 65 64 22 2c 69 29 29 2c 74 3d 5b 6e 2e 24 64 61 74 61 5d 2c 6e 3d 6c 2e 65 78 74 65 6e 64 28 7b 6b 6f 42 69 6e 64 69 6e 67 43 6f 6e 74 65 78 74 3a 6e 7d 2c 72 2e 74 65 6d 70 6c 61 74 65 4f 70 74 69 6f 6e 73 29 2c 28 6e 3d 6c 2e 74 6d 70 6c 28 69 2c 74 2c 6e 29 29 2e 61 70 70 65 6e 64 54 6f 28 6f 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 29 2c 6c 2e 66 72 61 67 6d 65 6e 74 73 3d 7b 7d 2c 6e 7d 2c 74 68 Data Ascii: urn i\|\|(i=t.text()\|\|"",i=l.template(null,"{{ko_with $item.koBindingContext}}"+i+"{{/ko_with}}"),t.data("precompiled",i)),t=[n.$data],n=l.extend({koBindingContext:n},r.templateOptions),(n=l.tmpl(i,t,n)).appendTo(o.createElement("div")),l.fragments={},n},th
2024-10-31 08:17:49 UTC	11300	IN	Data Raw: 3d 65 2e 6e 6f 74 69 66 79 4f 6e 43 6c 69 65 6e 74 41 62 6f 72 74 7c 7c 21 31 2c 6d 3d 6c 2e 53 65 72 76 65 72 44 61 74 61 2e 66 53 61 73 45 6e 64 41 75 74 68 50 6f 73 74 54 6f 47 65 74 53 77 69 74 63 68 2c 76 3d 6c 2e 53 65 72 76 65 72 44 61 74 61 2e 66 46 69 78 55 49 43 72 61 73 68 46 6f 72 41 70 69 52 65 71 75 65 73 74 48 61 6e 64 6c 65 72 3b 66 75 6e 63 74 69 6f 6e 20 62 28 65 29 7b 76 61 72 20 74 3d 7b 68 70 67 69 64 3a 64 2e 68 70 67 69 64 7c 7c 30 2c 68 70 67 61 63 74 3a 64 2e 68 70 67 61 63 74 7c 7c 30 7d 3b 72 65 74 75 72 6e 20 65 7c 7c 28 74 2e 41 63 63 65 70 74 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 2c 6e 26 26 64 2e 61 70 69 43 61 6e 61 72 79 26 26 28 74 2e 63 61 6e 61 72 79 3d 64 2e 61 70 69 43 61 6e 61 72 79 29 29 2c 64 2e Data Ascii: =e.notifyOnClientAbort\|\|!1,m=l.ServerData.fSasEndAuthPostToGetSwitch,v=l.ServerData.fFixUICrashForApiRequestHandler;function b(e){var t={hpgid:d.hpgid\|\|0,hpgact:d.hpgact\|\|0};return e\|\|(t.Accept="application/json",n&&d.apiCanary&&(t.canary=d.apiCanary)),d.

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:18:03 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:18:03 UTC	540	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:18:03 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T081803Z-16849878b78p8hrf1se7fucxk80000000a7g000000000qr1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:18:03 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-31 08:18:03 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-31 08:18:03 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-31 08:18:03 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-31 08:18:03 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-31 08:18:04 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-31 08:18:04 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-31 08:18:04 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-31 08:18:04 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-31 08:18:04 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:18:05 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:18:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:18:05 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T081805Z-16849878b78j5kdg3dndgqw0vg0000000b10000000003h9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:18:05 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:18:05 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:18:05 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:18:05 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 2923fc04-801e-0047-2d8c-2a7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T081805Z-159b85dff8f7x84jhC1DFWaghs0000000120000000003azz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:18:05 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://aka.ms/LearnAboutSenderIdentification.%5D

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Chrome Cache Entry: 172

Chrome Cache Entry: 173

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 188

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Windows Analysis Report
https://aka.ms/LearnAboutSenderIdentification.%5D

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:18:05 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:18:05 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:18:05 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T081805Z-15b8d89586flzzksdx5d6q7g1000000004c00000000074qx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:18:05 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:18:05 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:18:05 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:18:05 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T081805Z-16849878b78qg9mlz11wgn0wcc00000008r000000000h8de x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:18:05 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:18:05 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:18:05 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:18:05 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: cb5553aa-e01e-001f-3f7b-2a1633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T081805Z-159b85dff8fq4v8mhC1DFW70kw00000001tg000000002x33 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:18:05 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:18:06 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:18:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:18:06 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: bbf1142f-f01e-0085-589b-2788ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T081806Z-15b8d89586fhl2qtatrz3vfkf00000000fhg000000008k25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:18:06 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:18:06 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:18:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:18:06 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T081806Z-16849878b7828dsgct3vrzta7000000007r0000000004pc4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:18:06 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:18:06 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:18:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:18:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T081806Z-16849878b7828dsgct3vrzta7000000007rg000000003h2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:18:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:18:06 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:18:06 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:18:06 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1f7bc680-101e-0065-6904-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T081806Z-16849878b78g2m84h2v9sta29000000008600000000072gu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:18:06 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:18:06 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:18:06 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:18:06 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 80c74b81-d01e-00a1-16c0-2a35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T081806Z-159b85dff8fx9jp8hC1DFWp25400000000zg00000000c4n3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 08:18:06 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:18:07 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:18:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:18:07 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T081807Z-16849878b78nzcqcd7bed2fb6n00000001sg000000003q4c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:18:07 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-31 08:18:07 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 08:18:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 08:18:08 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T081808Z-16849878b78smng4k6nq15r6s40000000avg0000000020kd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 08:18:08 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />