Edit tour

Windows Analysis Report
http://lumberlandnorth.com/

Overview

General Information

Sample URL:	http://lumberlandnorth.com/
Analysis ID:	1526014
Tags:	urlscan
Infos:

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on logo match)

Detected non-DNS traffic on DNS port

Found iframes

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4404 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2676 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2016,i,801008427431916171,10880037438399477180,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://lumberlandnorth.com/" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

HTTP traffic detected: POST /bolt-performance?src=72&evid=21&appName=thunderbolt&is_rollout=1&is_sav_rollout=0&is_dac_rollout=0&dc=uw2-pub-1&microPop=fastly_g&is_cached=true&msid=0c261842-4db6-4c83-a58d-dbcd3be876e1&session_id=14f50723-d6f0-499d-a915-bed961927010&ish=false&isb=false&vsi=d1319760-1c65-4d8b-b336-62fe7a321c58&caching=hit,hit_hit&pv=visible&pn=1&v=1.14621.0&url=https%3A%2F%2Fwww.vanitysource.ca%2F&st=2&ts=479&tsn=4727&platformOnSite=true HTTP/1.1Host: frog.wix.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.vanitysource.caSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.vanitysource.ca/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://www.vanitysource.ca/contact-us	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-5768FVH
Source: https://www.vanitysource.ca/contact-us	HTTP Parser: Iframe src: https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/media/googleMap.ea5928de.html?defaultLocation=0&showZoom=true&showStreetView=true&showMapType=true&language=en&id=dataItem-llcgommn&googleMapsScriptPath=%2Fservices%2Feditor-elements-library%2Fdist%2Fthunderbolt%2Fmedia%2Fgoogle-map.min.cd54fd50.js&origin=https%3A%2F%2Fwww.vanitysource.ca
Source: https://www.vanitysource.ca/contact-us	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-5768FVH
Source: https://www.vanitysource.ca/contact-us	HTTP Parser: Iframe src: https://static.parastorage.com/services/editor-elements-library/dist/thunderbolt/media/googleMap.ea5928de.html?defaultLocation=0&showZoom=true&showStreetView=true&showMapType=true&language=en&id=dataItem-llcgommn&googleMapsScriptPath=%2Fservices%2Feditor-elements-library%2Fdist%2Fthunderbolt%2Fmedia%2Fgoogle-map.min.cd54fd50.js&origin=https%3A%2F%2Fwww.vanitysource.ca
Source: https://www.vanitysource.ca/contact-us	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-5768FVH
Source: https://www.vanitysource.ca/contact-us	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/874964038?random=1728054869135&cv=11&fst=1728054869135&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a20z8810534036za201zb810534036&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=101671035~101747727&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.vanitysource.ca%2Fcontact-us&label=DPEGCIeQw5ABEMbIm6ED&hn=www.googleadservices.com&frm=0&tiba=Lumberland%20North%20Inc%20%7C%20Brampton%2C%20ON%20%7C%20Contact%20Us&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=580618711.1728054817&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&ct_cookie_present=0

Source: https://www.vanitysource.ca/contact-us	HTTP Parser: No <meta name="author".. found
Source: https://www.vanitysource.ca/contact-us	HTTP Parser: No <meta name="author".. found
Source: https://www.vanitysource.ca/contact-us	HTTP Parser: No <meta name="author".. found

Source: https://www.vanitysource.ca/contact-us	HTTP Parser: No <meta name="copyright".. found
Source: https://www.vanitysource.ca/contact-us	HTTP Parser: No <meta name="copyright".. found
Source: https://www.vanitysource.ca/contact-us	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.10:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.10:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.10:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.10:49983 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.10:57975 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.10:57979 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55

Source: chromecache_696.2.dr, chromecache_509.2.dr	String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},bk:function(){e=zb()},nd:function(){d()}}};var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)
Source: chromecache_514.2.dr, chromecache_589.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=rA(a,c,e);Q(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return Q(122),!0;if(d&&f){for(var m=Kb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},uA=function(){var a=[],b=function(c){return pb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_696.2.dr, chromecache_509.2.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={hh:e,fh:f,gh:g,Rh:k,Sh:m,He:n,Cb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(WC(w,"iframe_api")\|\|WC(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!NC&&UC(x[A],p.He))return wc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_514.2.dr, chromecache_603.2.dr, chromecache_729.2.dr, chromecache_589.2.dr, chromecache_760.2.dr, chromecache_513.2.dr, chromecache_803.2.dr, chromecache_601.2.dr, chromecache_466.2.dr, chromecache_470.2.dr, chromecache_799.2.dr, chromecache_648.2.dr	String found in binary or memory: return b}JC.F="internal.enableAutoEventOnTimer";var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)
Source: chromecache_514.2.dr, chromecache_589.2.dr, chromecache_513.2.dr, chromecache_648.2.dr	String found in binary or memory: var YB=function(a,b,c,d,e){var f=Pz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Pz("fsl","nv.ids",[]):Pz("fsl","ids",[]);if(!g.length)return!0;var k=Uz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);Q(121);if(m==="https://www.facebook.com/tr/")return Q(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!Cy(k,Ey(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: lumberlandnorth.com
Source: global traffic	DNS traffic detected: DNS query: www.vanitysource.ca
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: static.wixstatic.com
Source: global traffic	DNS traffic detected: DNS query: frog.wix.com
Source: global traffic	DNS traffic detected: DNS query: panorama.wixapps.net
Source: global traffic	DNS traffic detected: DNS query: siteassets.parastorage.com
Source: global traffic	DNS traffic detected: DNS query: static.parastorage.com
Source: global traffic	DNS traffic detected: DNS query: rw1.marchex.io
Source: global traffic	DNS traffic detected: DNS query: www-vanitysource-ca.filesusr.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: browser.sentry-cdn.com
Source: global traffic	DNS traffic detected: DNS query: sentry-next.wixpress.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2016,i,801008427431916171,10880037438399477180,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://lumberlandnorth.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2016,i,801008427431916171,10880037438399477180,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
http://g.co/dev/maps-no-account	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://openjsf.org/	0%	URL Reputation	safe
https://developers.google.com/maps/documentation/javascript/styling#cloud_tooling	0%	URL Reputation	safe
https://support.google.com/fusiontables/answer/9185417).	0%	URL Reputation	safe
https://developers.google.com/maps/deprecations	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
http://underscorejs.org/LICENSE	0%	URL Reputation	safe
https://static.parastorage.com/services/forms-viewer/1.878.0/viewerScript.bundle.min.js	0%	URL Reputation	safe
https://npms.io/search?q=ponyfill.	0%	URL Reputation	safe
https://developers.google.com/maps/documentation/javascript/error-messages#unsupported-browsers	0%	URL Reputation	safe
https://developers.google.com/maps/documentation/javascript/libraries	0%	URL Reputation	safe
https://frog.wix.com/	0%	URL Reputation	safe
http://polymer.github.io/CONTRIBUTORS.txt	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://static.parastorage.com/services/wix-thunderbolt/dist/platformPubsub.236f41ee.chunk.min.js.ma	chromecache_556.2.dr, chromecache_540.2.dr	false		unknown
https://static.parastorage.com/services/editor-elements-design-systems/dist/thunderbolt/	chromecache_736.2.dr, chromecache_508.2.dr, chromecache_581.2.dr, chromecache_728.2.dr	false		unknown
http://g.co/dev/maps-no-account	chromecache_410.2.dr, chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/group_7.13d622e8.chunk.min.js.map	chromecache_497.2.dr, chromecache_793.2.dr	false		unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_495.2.dr, chromecache_554.2.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/AUTHORS.txt	chromecache_358.2.dr, chromecache_738.2.dr, chromecache_571.2.dr, chromecache_750.2.dr, chromecache_740.2.dr, chromecache_590.2.dr	false	URL Reputation: safe	unknown
https://static.wixstatic.com/media/c84706_c53ef727bb8c4aefb90e96e044efdc83~mv2.jpg/v1/fill/w_87	chromecache_571.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/webpack-runtime.838a26ee.bundle.min.js.	chromecache_358.2.dr, chromecache_738.2.dr, chromecache_571.2.dr, chromecache_750.2.dr, chromecache_740.2.dr, chromecache_590.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/platform.08affa9c.chunk.min.js.map	chromecache_754.2.dr, chromecache_658.2.dr	false		unknown
https://www.instagram.com/lumberlandnorth/	chromecache_358.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/triggersAndReactions.66bcbb0c.chunk.min	chromecache_638.2.dr, chromecache_804.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/createPlatformWorker.inline.08729d0b.bu	chromecache_590.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/initCustomElements.inline.1d2da1fc.bund	chromecache_358.2.dr, chromecache_738.2.dr, chromecache_571.2.dr, chromecache_750.2.dr, chromecache_740.2.dr, chromecache_590.2.dr	false		unknown
https://openjsf.org/	chromecache_366.2.dr, chromecache_452.2.dr, chromecache_585.2.dr, chromecache_536.2.dr	false	URL Reputation: safe	unknown
https://developers.google.com/maps/documentation/javascript/styling#cloud_tooling	chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://static.wixstatic.com/ufonts/2c3634_7eb06d5877bd4102b2dd4b19ae3ac518/woff/file.woff	chromecache_358.2.dr, chromecache_738.2.dr, chromecache_571.2.dr, chromecache_750.2.dr, chromecache_740.2.dr, chromecache_590.2.dr	false		unknown
https://support.google.com/fusiontables/answer/9185417).	chromecache_410.2.dr, chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://developers.google.com/maps/deprecations	chromecache_410.2.dr, chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://static.wixstatic.com/ufonts/8aaa1f_03b1ac441698400493eb6a55084d976f/ttf/file.ttf	chromecache_358.2.dr, chromecache_738.2.dr, chromecache_571.2.dr, chromecache_750.2.dr, chromecache_740.2.dr, chromecache_590.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/group_23.3eeabd9c.chunk.min.js.map	chromecache_364.2.dr, chromecache_543.2.dr	false		unknown
http://polymer.github.io/PATENTS.txt	chromecache_358.2.dr, chromecache_738.2.dr, chromecache_571.2.dr, chromecache_750.2.dr, chromecache_740.2.dr, chromecache_590.2.dr	false	URL Reputation: safe	unknown
https://static.wixstatic.com/media/ba2cd3_4c50e4f3c26b44c38f1f6882db03d5ca~mv2.png/v1/fill/w_200	chromecache_590.2.dr	false		unknown
https://static.wixstatic.com/media/ba2cd3_a629644f090147be9db95f6b6022397c%7Emv2.jpg/v1/fill/w_192%2	chromecache_358.2.dr, chromecache_738.2.dr, chromecache_571.2.dr, chromecache_750.2.dr, chromecache_740.2.dr, chromecache_590.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/cyclicTabbing.e156be92.chunk.min.js.map	chromecache_362.2.dr, chromecache_584.2.dr	false		unknown
https://static.wixstatic.com/media/ba2cd3_0ed932748ad44d579106341c6afa3fd7~mv2.jpg/v1/fill/w_137	chromecache_358.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/reporter-api.d81e6559.chunk.min.js.map	chromecache_721.2.dr, chromecache_616.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/animations.0c47ed2a.chunk.min.js.map	chromecache_460.2.dr, chromecache_670.2.dr	false		unknown
http://underscorejs.org/LICENSE	chromecache_366.2.dr, chromecache_452.2.dr, chromecache_585.2.dr, chromecache_536.2.dr	false	URL Reputation: safe	unknown
https://developers.google.com/maps/documentation/javascript/versions#beta-channel	chromecache_414.2.dr	false		unknown
https://static.wixstatic.com/media/ba2cd3_a629644f090147be9db95f6b6022397c%7Emv2.jpg/v1/fill/w_180%2	chromecache_358.2.dr, chromecache_738.2.dr, chromecache_571.2.dr, chromecache_750.2.dr, chromecache_740.2.dr, chromecache_590.2.dr	false		unknown
https://static.wixstatic.com/ufonts/2c3634_acf5e5be93dd41ec8f729923eab39f24/woff/file.woff	chromecache_358.2.dr, chromecache_738.2.dr, chromecache_750.2.dr, chromecache_740.2.dr, chromecache_590.2.dr	false		unknown
https://npms.io/search?q=ponyfill.	chromecache_366.2.dr, chromecache_452.2.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/group_11.3fa95a07.chunk.min.js.map	chromecache_557.2.dr, chromecache_440.2.dr	false		unknown
https://developers.google.com/maps/documentation/javascript/error-messages#unsupported-browsers	chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/svgLoader.67cd7ecf.chunk.min.js.map	chromecache_388.2.dr, chromecache_399.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/sendBeat12.inline.1d5ac45a.bundle.min.j	chromecache_358.2.dr, chromecache_738.2.dr, chromecache_571.2.dr, chromecache_750.2.dr, chromecache_740.2.dr, chromecache_590.2.dr	false		unknown
https://developers.google.com/maps/documentation/javascript/libraries	chromecache_410.2.dr, chromecache_414.2.dr	false	URL Reputation: safe	unknown
https://www.vanitysource.ca/accessories	chromecache_740.2.dr	false		unknown
https://static.wixstatic.com/	chromecache_628.2.dr	false		unknown
https://static.parastorage.com/services/wix-thunderbolt/dist/group_0.6a56df09.chunk.min.js.map	chromecache_597.2.dr, chromecache_709.2.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
34.236.137.27	sentry-ssl-462500017.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
151.101.130.217	unknown	United States	54113	FASTLYUS	false
99.86.4.125	unknown	United States	16509	AMAZON-02US	false
99.86.4.105	d1cq301dpr7fww.cloudfront.net	United States	16509	AMAZON-02US	false
185.230.63.107	lumberlandnorth.com	Israel	58182	WIX_COMIL	false
142.250.181.238	analytics.google.com	United States	15169	GOOGLEUS	false
34.196.93.134	unknown	United States	14618	AMAZON-AESUS	false
66.102.1.157	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
151.101.194.217	browser.sentry-cdn.com	United States	54113	FASTLYUS	false
142.250.185.162	td.doubleclick.net	United States	15169	GOOGLEUS	false
34.149.87.45	td-ccm-neg-87-45.wixdns.net	United States	2686	ATGS-MMD-ASUS	false
172.217.18.98	unknown	United States	15169	GOOGLEUS	false
34.149.206.255	glb-editor.wix.com	United States	2686	ATGS-MMD-ASUS	false
142.250.74.196	unknown	United States	15169	GOOGLEUS	false
3.168.122.96	d1buhjvxj128v2.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.185.68	unknown	United States	15169	GOOGLEUS	false
216.239.32.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
216.58.206.66	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
34.49.229.81	td-static-34-49-229-81.parastorage.com	United States	2686	ATGS-MMD-ASUS	false
142.250.185.132	unknown	United States	15169	GOOGLEUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
44.196.142.215	bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
3.228.197.26	mca-common-ext-prod-1885623255.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
34.227.209.108	unknown	United States	14618	AMAZON-AESUS	false

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Name	IP	Active	Malicious	Reputation
browser.sentry-cdn.com	151.101.194.217	true	false	unknown
lumberlandnorth.com	185.230.63.107	true	false	unknown
td-ccm-neg-87-45.wixdns.net	34.149.87.45	true	false	unknown
d1buhjvxj128v2.cloudfront.net	3.168.122.96	true	false	unknown
stats.g.doubleclick.net	66.102.1.157	true	false	unknown
analytics-alv.google.com	216.239.32.181	true	false	unknown
glb-editor.wix.com	34.149.206.255	true	false	unknown
googleads.g.doubleclick.net	216.58.206.66	true	false	unknown
sentry-ssl-462500017.us-east-1.elb.amazonaws.com	34.236.137.27	true	false	unknown
d1cq301dpr7fww.cloudfront.net	99.86.4.105	true	false	unknown
td-static-34-49-229-81.parastorage.com	34.49.229.81	true	false	unknown
www.google.com	216.58.206.68	true	false	unknown
analytics.google.com	142.250.181.238	true	false	unknown
td.doubleclick.net	142.250.185.162	true	false	unknown
mca-common-ext-prod-1885623255.us-east-1.elb.amazonaws.com	3.228.197.26	true	false	unknown
bi-flogger-alb-ext-343643057.us-east-1.elb.amazonaws.com	44.196.142.215	true	false	unknown
static.wixstatic.com	unknown	unknown	false	unknown
siteassets.parastorage.com	unknown	unknown	false	unknown
sentry-next.wixpress.com	unknown	unknown	false	unknown
rw1.marchex.io	unknown	unknown	false	unknown
panorama.wixapps.net	unknown	unknown	false	unknown
www-vanitysource-ca.filesusr.com	unknown	unknown	false	unknown
www.vanitysource.ca	unknown	unknown	false	unknown
frog.wix.com	unknown	unknown	false	unknown
static.parastorage.com	unknown	unknown	false	unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526014
Start date and time:	2024-10-04 17:12:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://lumberlandnorth.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus22.phis.win@30/712@68/28
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.vanitysource.ca/testimonials Browse: https://www.vanitysource.ca/products Browse: https://www.vanitysource.ca/about-us Browse: https://www.vanitysource.ca/contact-us Browse: https://www.vanitysource.ca/deals

Input	Output
URL: https://www.vanitysource.ca/ Model: jbxai	{ "brand":["LUMBERLANDNORTHINC", "VANITY SOURCE", "LUMBERLANDNORTHINC", "MARBLE & GRANITE DIVISION"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.vanitysource.ca/testimonials Model: jbxai	{ "brand":["VANITY SOURCE", "LUMBERLANDNORTHINC", "LUMBERLANDNORTHINC.MARBLE & GRANITE DIVISION"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.vanitysource.ca/products Model: jbxai	{ "brand":["VANITY SOURCE", "LUMBERLANDNORTHINC", "LUMBERLANDNORTHINC.MARBLE&GRANITEDIVISION"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.vanitysource.ca/contact-us Model: jbxai	{ "brand":["VANITY SOURCE", "LUMBERLANDNORTHINC", "LUMBERLAND NORTH INC."], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.vanitysource.ca/deals Model: jbxai	{ "brand":["VANITY SOURCE", "LUMBERLAND NORTH INC.", "LUMBERLAND NORTH INC. MARBLE & GRANITE DIVISION"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"CHECK OUT OUR DEALS", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.vanitysource.ca/deals Model: jbxai	{ "brand":["VANITY SOURCE", "LUMBERLANDNORTHINC", "LUMBERLANDNORTHINC.MARBLE & GRANITE DIVISION"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"CHECK OUT OUR DEALS", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 14:13:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9790763996876364
Encrypted:	false
SSDEEP:	48:8E9ubdeT0xHRidAKZdA1uehwiZUklqehLy+3:8EpYCMy
MD5:	4271413A63FAF167D91ABD93DDBD67F0
SHA1:	86BADB4ACEF1DBC411F7206CBCB359135F7B05B7
SHA-256:	191CE7EBD0F85F66CD014A41EDE7472E16AE3D95BB12C463FF4296006E7A1099
SHA-512:	971931ECE2B0465DAE1FF9D52370D27EA8255D899D675B55830F41B1BD96FEBD2E909788697F099C4A100867023321F61206E779B906E0C3BA6DB97ABB432D71
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........o.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IDY.y....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY.y....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VDY.y....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VDY.y...........................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VDY.y....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............b.>.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 17:13:17.589121103 CEST	192.168.2.10	1.1.1.1	0x99d5	Standard query (0)	lumberlandnorth.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:17.589482069 CEST	192.168.2.10	1.1.1.1	0x1177	Standard query (0)	lumberlandnorth.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:18.351768970 CEST	192.168.2.10	1.1.1.1	0x9fc9	Standard query (0)	lumberlandnorth.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:18.352324009 CEST	192.168.2.10	1.1.1.1	0x38d1	Standard query (0)	lumberlandnorth.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:20.083064079 CEST	192.168.2.10	1.1.1.1	0xbc7f	Standard query (0)	www.vanitysource.ca	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:20.083769083 CEST	192.168.2.10	1.1.1.1	0xd06b	Standard query (0)	www.vanitysource.ca	65	IN (0x0001)	false
Oct 4, 2024 17:13:20.151175022 CEST	192.168.2.10	1.1.1.1	0x2452	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:20.151289940 CEST	192.168.2.10	1.1.1.1	0x2cc7	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:22.127274036 CEST	192.168.2.10	1.1.1.1	0x44df	Standard query (0)	static.wixstatic.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:22.133709908 CEST	192.168.2.10	1.1.1.1	0x70d1	Standard query (0)	static.wixstatic.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:22.297193050 CEST	192.168.2.10	1.1.1.1	0xf551	Standard query (0)	frog.wix.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:22.297338963 CEST	192.168.2.10	1.1.1.1	0xbb9b	Standard query (0)	frog.wix.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:22.297995090 CEST	192.168.2.10	1.1.1.1	0x2d9	Standard query (0)	panorama.wixapps.net	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:22.298147917 CEST	192.168.2.10	1.1.1.1	0xf3b5	Standard query (0)	panorama.wixapps.net	65	IN (0x0001)	false
Oct 4, 2024 17:13:22.697479963 CEST	192.168.2.10	1.1.1.1	0x1b2c	Standard query (0)	siteassets.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:22.698033094 CEST	192.168.2.10	1.1.1.1	0x7fad	Standard query (0)	siteassets.parastorage.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:22.704547882 CEST	192.168.2.10	1.1.1.1	0x694b	Standard query (0)	static.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:22.705468893 CEST	192.168.2.10	1.1.1.1	0x8f33	Standard query (0)	static.parastorage.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:25.198177099 CEST	192.168.2.10	1.1.1.1	0xc8e2	Standard query (0)	www.vanitysource.ca	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:25.198499918 CEST	192.168.2.10	1.1.1.1	0x40db	Standard query (0)	www.vanitysource.ca	65	IN (0x0001)	false
Oct 4, 2024 17:13:25.306848049 CEST	192.168.2.10	1.1.1.1	0x964f	Standard query (0)	static.wixstatic.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:25.307079077 CEST	192.168.2.10	1.1.1.1	0xe8bb	Standard query (0)	static.wixstatic.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:25.314639091 CEST	192.168.2.10	1.1.1.1	0xd69e	Standard query (0)	static.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:25.314822912 CEST	192.168.2.10	1.1.1.1	0xbf94	Standard query (0)	static.parastorage.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:38.195265055 CEST	192.168.2.10	1.1.1.1	0xcd3f	Standard query (0)	rw1.marchex.io	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:38.195755959 CEST	192.168.2.10	1.1.1.1	0x72d1	Standard query (0)	rw1.marchex.io	65	IN (0x0001)	false
Oct 4, 2024 17:13:38.815466881 CEST	192.168.2.10	1.1.1.1	0xb73d	Standard query (0)	www-vanitysource-ca.filesusr.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:38.815618038 CEST	192.168.2.10	1.1.1.1	0xb19f	Standard query (0)	www-vanitysource-ca.filesusr.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:39.079164982 CEST	192.168.2.10	1.1.1.1	0xfe60	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:39.079308033 CEST	192.168.2.10	1.1.1.1	0x45dc	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:39.105779886 CEST	192.168.2.10	1.1.1.1	0x7403	Standard query (0)	rw1.marchex.io	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:39.105928898 CEST	192.168.2.10	1.1.1.1	0xee54	Standard query (0)	rw1.marchex.io	65	IN (0x0001)	false
Oct 4, 2024 17:13:40.052692890 CEST	192.168.2.10	1.1.1.1	0x6c3f	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:40.052795887 CEST	192.168.2.10	1.1.1.1	0x7bd8	Standard query (0)	analytics.google.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:40.053725004 CEST	192.168.2.10	1.1.1.1	0x443d	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:40.054096937 CEST	192.168.2.10	1.1.1.1	0x27c3	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Oct 4, 2024 17:13:40.219098091 CEST	192.168.2.10	1.1.1.1	0x131d	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:40.219400883 CEST	192.168.2.10	1.1.1.1	0xd063	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Oct 4, 2024 17:13:40.434663057 CEST	192.168.2.10	1.1.1.1	0xc40f	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:40.434812069 CEST	192.168.2.10	1.1.1.1	0x8dab	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Oct 4, 2024 17:13:41.133920908 CEST	192.168.2.10	1.1.1.1	0x33a3	Standard query (0)	siteassets.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:41.134022951 CEST	192.168.2.10	1.1.1.1	0x158c	Standard query (0)	siteassets.parastorage.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:42.229583025 CEST	192.168.2.10	1.1.1.1	0xc4c	Standard query (0)	browser.sentry-cdn.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:42.229790926 CEST	192.168.2.10	1.1.1.1	0x5d07	Standard query (0)	browser.sentry-cdn.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:43.406038046 CEST	192.168.2.10	1.1.1.1	0x8e94	Standard query (0)	browser.sentry-cdn.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:43.406217098 CEST	192.168.2.10	1.1.1.1	0x40c	Standard query (0)	browser.sentry-cdn.com	65	IN (0x0001)	false
Oct 4, 2024 17:13:44.462968111 CEST	192.168.2.10	1.1.1.1	0xef23	Standard query (0)	sentry-next.wixpress.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:13:44.463484049 CEST	192.168.2.10	1.1.1.1	0x8b8c	Standard query (0)	sentry-next.wixpress.com	65	IN (0x0001)	false
Oct 4, 2024 17:14:20.220478058 CEST	192.168.2.10	1.1.1.1	0xbb22	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:14:20.221066952 CEST	192.168.2.10	1.1.1.1	0xe627	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 4, 2024 17:14:23.321213961 CEST	192.168.2.10	1.1.1.1	0x47c3	Standard query (0)	frog.wix.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:14:23.321872950 CEST	192.168.2.10	1.1.1.1	0x58ed	Standard query (0)	frog.wix.com	65	IN (0x0001)	false
Oct 4, 2024 17:14:26.560420990 CEST	192.168.2.10	1.1.1.1	0xd189	Standard query (0)	static.wixstatic.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:14:26.560635090 CEST	192.168.2.10	1.1.1.1	0x6aa7	Standard query (0)	static.wixstatic.com	65	IN (0x0001)	false
Oct 4, 2024 17:14:28.683183908 CEST	192.168.2.10	1.1.1.1	0xa3d7	Standard query (0)	static.parastorage.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:14:28.683351040 CEST	192.168.2.10	1.1.1.1	0x45ed	Standard query (0)	static.parastorage.com	65	IN (0x0001)	false
Oct 4, 2024 17:14:31.117088079 CEST	192.168.2.10	1.1.1.1	0x4e89	Standard query (0)	static.wixstatic.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:14:31.117315054 CEST	192.168.2.10	1.1.1.1	0xc8fb	Standard query (0)	static.wixstatic.com	65	IN (0x0001)	false
Oct 4, 2024 17:14:41.600697041 CEST	192.168.2.10	1.1.1.1	0xdb1a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:14:41.600965023 CEST	192.168.2.10	1.1.1.1	0xceba	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 4, 2024 17:14:41.987942934 CEST	192.168.2.10	1.1.1.1	0xa816	Standard query (0)	rw1.marchex.io	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:14:41.988440990 CEST	192.168.2.10	1.1.1.1	0xa479	Standard query (0)	rw1.marchex.io	65	IN (0x0001)	false
Oct 4, 2024 17:14:42.116137981 CEST	192.168.2.10	1.1.1.1	0xa34c	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:14:42.116517067 CEST	192.168.2.10	1.1.1.1	0xc2d2	Standard query (0)	analytics.google.com	65	IN (0x0001)	false
Oct 4, 2024 17:14:42.137923002 CEST	192.168.2.10	1.1.1.1	0x7bd6	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:14:42.138079882 CEST	192.168.2.10	1.1.1.1	0x2032	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Oct 4, 2024 17:14:43.533911943 CEST	192.168.2.10	1.1.1.1	0x3ce	Standard query (0)	rw1.marchex.io	A (IP address)	IN (0x0001)	false
Oct 4, 2024 17:14:43.534267902 CEST	192.168.2.10	1.1.1.1	0x6e85	Standard query (0)	rw1.marchex.io	65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 17:13:17.883413076 CEST	434	OUT	GET / HTTP/1.1 Host: lumberlandnorth.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 4, 2024 17:13:18.333514929 CEST	169	IN	HTTP/1.1 301 Moved Permanently Location: https://lumberlandnorth.com/ X-Seen-By: vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k= Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-04 15:13:06 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 15:13:06 UTC	540	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 15:13:06 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 30 Sep 2024 13:16:38 GMT ETag: "0x8DCE1521DF74B57" x-ms-request-id: 90766f9b-701e-006f-578c-15afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T151306Z-15767c5fc55ncqdn59ub6rndq00000000cdg000000007m6h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 15:13:06 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-04 15:13:06 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-04 15:13:06 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-04 15:13:06 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-04 15:13:06 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-04 15:13:06 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-04 15:13:06 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-04 15:13:07 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-04 15:13:07 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-04 15:13:07 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Timestamp	Bytes transferred	Direction	Data
2024-10-04 15:13:08 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 15:13:08 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 15:13:08 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 39d43082-801e-00ac-658c-15fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T151308Z-15767c5fc55dtdv4d4saq7t47n0000000ck0000000003up9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 15:13:08 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 15:13:08 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 15:13:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 15:13:08 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4b0a31e7-c01e-00ad-448c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T151308Z-15767c5fc55dtdv4d4saq7t47n0000000ceg00000000gzkb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 15:13:08 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://lumberlandnorth.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 350

Chrome Cache Entry: 351

Chrome Cache Entry: 352

Chrome Cache Entry: 353

Chrome Cache Entry: 354

Chrome Cache Entry: 355

Chrome Cache Entry: 356

Chrome Cache Entry: 357

Chrome Cache Entry: 358

Chrome Cache Entry: 359

Chrome Cache Entry: 360

Chrome Cache Entry: 361

Chrome Cache Entry: 362

Chrome Cache Entry: 363

Chrome Cache Entry: 364

Chrome Cache Entry: 365

Chrome Cache Entry: 366

Chrome Cache Entry: 367

Chrome Cache Entry: 368

Chrome Cache Entry: 369

Windows Analysis Report
http://lumberlandnorth.com/

Timestamp	Bytes transferred	Direction	Data
2024-10-04 15:13:08 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 15:13:08 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 15:13:08 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b9d87bc3-001e-008d-128c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T151308Z-15767c5fc55xsgnlxyxy40f4m00000000cm000000000fe3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 15:13:08 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2024-10-04 15:13:08 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 15:13:08 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 15:13:08 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1cc2ff82-e01e-0071-478c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T151308Z-15767c5fc55rg5b7sh1vuv8t7n0000000d4g00000000041c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 15:13:08 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-10-04 15:13:08 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 15:13:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 15:13:08 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: b9d87bc4-001e-008d-138c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T151308Z-15767c5fc55rv8zjq9dg0musxg0000000csg00000000681q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 15:13:08 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-10-04 15:13:09 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 15:13:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 15:13:09 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 757ce4f4-401e-000a-128c-154a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T151309Z-15767c5fc55qdcd62bsn50hd6s0000000ce000000000mhy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 15:13:09 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2024-10-04 15:13:09 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 15:13:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 15:13:09 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: aa8826a4-b01e-0053-608c-15cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T151309Z-15767c5fc55jdxmppy6cmd24bn0000000510000000001gvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 15:13:09 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 15:13:09 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 15:13:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 15:13:09 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 24b39cfc-301e-0096-2a8c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T151309Z-15767c5fc55fdfx81a30vtr1fw0000000cy000000000ty85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 15:13:09 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 15:13:09 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 15:13:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 15:13:09 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: b2393cc3-501e-005b-768c-15d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T151309Z-15767c5fc55gs96cphvgp5f5vc0000000ck000000000m6x3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 15:13:09 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 15:13:09 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 15:13:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 15:13:09 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 3a0dc1eb-601e-0032-608c-15eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T151309Z-15767c5fc55472x4k7dmphmadg0000000cbg00000000eh1r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 15:13:09 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Timestamp	Bytes transferred	Direction	Data
2024-10-04 15:13:09 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 15:13:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 15:13:09 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 023e3708-a01e-003d-568c-1598d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T151309Z-15767c5fc55dtdv4d4saq7t47n0000000cdg00000000nmrq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 15:13:09 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-04 15:13:09 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 15:13:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 15:13:09 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 1cc301c6-e01e-0071-6b8c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T151309Z-15767c5fc554wklc0x4mc5pq0w0000000d1g00000000bru1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 15:13:09 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />