Edit tour

Windows Analysis Report
http://dhs.dist113.org/

Overview

General Information

Sample URL:	http://dhs.dist113.org/
Analysis ID:	1541601
Tags:	urlscan
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2212,i,14395703224993771535,7885939220849462094,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://dhs.dist113.org/" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

HTTP traffic detected: POST /Site/SiteController.aspx/InsertAnalyticsData HTTP/1.1Host: www.dist113.orgConnection: keep-aliveContent-Length: 124sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-NewRelic-ID: UQUPUFZADQUBVldQDwAHtracestate: 160756@nr=0-1-53810-594440961-243aef1635a63f5e----1729809547570traceparent: 00-3f6e72cb527432f27b61554807b2acb0-243aef1635a63f5e-01sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36newrelic: eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjUzODEwIiwiYXAiOiI1OTQ0NDA5NjEiLCJpZCI6IjI0M2FlZjE2MzVhNjNmNWUiLCJ0ciI6IjNmNmU3MmNiNTI3NDMyZjI3YjYxNTU0ODA3YjJhY2IwIiwidGkiOjE3Mjk4MDk1NDc1NzAsInRrIjoiMTYwNzU2In19Content-Type: application/jsonAccept: */*X-Requested-With: XMLHttpRequestsec-ch-ua-platform: "Windows"Origin: https://www.dist113.orgSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.dist113.org/dhsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PSN=TYQOVZnyPCoiWL2kw/FH8w==; PSDB=xgUzIAYHXSKJ7DVckJK8p9VX5p6e/6vQ3pxaxeP5zrc=; CSAN=Sy8EE/Wq0RPVlue4fTfQrA==; AccountID=Xogon24LhVEF1Gfd40nUZQ==; APIKey=fb61a9cf-6d4d-4f6d-87fc-0fbb46831d69; SWSessionID=5a8d3458-56ad-4eac-9725-45568bcc2d57; RedirectTo=http%3A%2F%2Fwww.dist113.org%2Fsite%2Fdefault.aspx%3FDomainID%3D8; SWScreenWidth=1280; SWClientWidth=1263

Source: https://www.dist113.org/dhs	HTTP Parser: No favicon
Source: https://www.dist113.org/dhs	HTTP Parser: No favicon
Source: https://www.dist113.org/Page/9	HTTP Parser: No favicon
Source: https://www.dist113.org/Page/9	HTTP Parser: No favicon
Source: https://www.dist113.org/Page/9	HTTP Parser: No favicon
Source: https://www.dist113.org/Page/9	HTTP Parser: No favicon
Source: https://www.dist113.org/Page/9	HTTP Parser: No favicon
Source: https://www.dist113.org/Page/9	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.11:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.11:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.11:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.11:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.11:50219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.11:50319 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.11:50471 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42

Source: chromecache_413.2.dr, chromecache_621.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/9cisb7Fe7ih/ equals www.facebook.com (Facebook)
Source: chromecache_372.2.dr, chromecache_729.2.dr, chromecache_382.2.dr, chromecache_662.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/A4tfXiHOGrs/ equals www.facebook.com (Facebook)
Source: chromecache_372.2.dr, chromecache_729.2.dr, chromecache_382.2.dr, chromecache_662.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/Ga6vBwdwgUx/ equals www.facebook.com (Facebook)
Source: chromecache_575.2.dr, chromecache_521.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/KRXTwBoPvVj/ equals www.facebook.com (Facebook)
Source: chromecache_413.2.dr, chromecache_465.2.dr, chromecache_394.2.dr, chromecache_659.2.dr, chromecache_348.2.dr, chromecache_621.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/MDzNl_j9yvg/ equals www.facebook.com (Facebook)
Source: chromecache_399.2.dr, chromecache_518.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/OKBVmODmb-W/ equals www.facebook.com (Facebook)
Source: chromecache_721.2.dr, chromecache_717.2.dr, chromecache_456.2.dr, chromecache_555.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/V9vdYColc4k/ equals www.facebook.com (Facebook)
Source: chromecache_383.2.dr, chromecache_622.2.dr, chromecache_563.2.dr, chromecache_376.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/WRsJ32R7YJG/ equals www.facebook.com (Facebook)
Source: chromecache_413.2.dr, chromecache_621.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/cr2jmG-CdKo/ equals www.facebook.com (Facebook)
Source: chromecache_575.2.dr, chromecache_413.2.dr, chromecache_717.2.dr, chromecache_465.2.dr, chromecache_477.2.dr, chromecache_456.2.dr, chromecache_525.2.dr, chromecache_521.2.dr, chromecache_659.2.dr, chromecache_621.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/t3hOLs8wlXy/ equals www.facebook.com (Facebook)
Source: chromecache_554.2.dr	String found in binary or memory: <!DOCTYPE html><html><head><meta charSet="utf-8"/><meta content="width=device-width, initial-scale=1" name="viewport"/><meta name="next-head-count" content="2"/><noscript data-n-css=""></noscript><script defer="" nomodule="" src="https://platform.twitter.com/_next/static/chunks/polyfills-a40ef1678bae11e696dba45124eadd70.js"></script><script src="https://platform.twitter.com/_next/static/chunks/runtime-b1c52fd0a13ead5fcf6b.js" defer=""></script><script src="https://platform.twitter.com/_next/static/chunks/modules-96ebc7ac3ad66d681a3d.js" defer=""></script><script src="https://platform.twitter.com/_next/static/chunks/main-babd9234dc048fb47339.js" defer=""></script><script src="https://platform.twitter.com/_next/static/chunks/pages/_app-a9c9f1a99e4414675fb1.js" defer=""></script><script src="https://platform.twitter.com/_next/static/chunks/pages/timeline-profile/screen-name/%5BscreenName%5D-0517bdda27d5006a5a2d.js" defer=""></script><script src="https://platform.twitter.com/_next/static/H8u53u8SWsWwviLqzqhm-/_buildManifest.js" defer=""></script><script src="https://platform.twitter.com/_next/static/H8u53u8SWsWwviLqzqhm-/_ssgManifest.js" defer=""></script></head><body><div id="__next"></div><script id="__NEXT_DATA__" type="application/json">{"props":{"pageProps":{"contextProvider":{"features":{"tfw_timeline_list":{"bucket":[],"version":null},"tfw_follower_count_sunset":{"bucket":true,"version":null},"tfw_tweet_edit_backend":{"bucket":"on","version":null},"tfw_refsrc_session":{"bucket":"on","version":null},"tfw_fosnr_soft_interventions_enabled":{"bucket":"on","version":null},"tfw_mixed_media_15897":{"bucket":"treatment","version":null},"tfw_experiments_cookie_expiration":{"bucket":1209600,"version":null},"tfw_show_birdwatch_pivots_enabled":{"bucket":"on","version":null},"tfw_duplicate_scribes_to_settings":{"bucket":"on","version":null},"tfw_use_profile_image_shape_enabled":{"bucket":"on","version":null},"tfw_video_hls_dynamic_manifests_15082":{"bucket":"true_bitrate","version":null},"tfw_legacy_timeline_sunset":{"bucket":true,"version":null},"tfw_tweet_edit_frontend":{"bucket":"on","version":null}},"scribeData":{"client_version":"2615f7e52b7e0:1702314776716","dnt":false,"widget_id":"twitter-widget-0","widget_origin":"https://www.dist113.org/Page/9","widget_frame":"false","widget_partner":"","widget_site_screen_name":"","widget_site_user_id":"","widget_creator_screen_name":"","widget_creator_user_id":"","widget_iframe_version":"30b4041:1715703883585","widget_data_source":"screen-name:DeerfieldHS","session_id":"5ceb826d01b3425d6b11b664de20d26ad2529b4e"},"messengerContext":{"embedId":"twitter-widget-0"},"hasResults":true,"lang":"en","theme":"light"},"lang":"en","maxHeight":500,"showHeader":true,"hideBorder":false,"hideFooter":false,"hideScrollBar":false,"transparent":false,"timeline":{"entries":[]},"headerProps":{"screenName":"DeerfieldHS"}},"__N_SSP":true},"page":"/timeline-profile/screen-name/[screenName]","query":{"dnt":"false","embedId":"twitter-widg
Source: chromecache_392.2.dr, chromecache_671.2.dr, chromecache_594.2.dr, chromecache_548.2.dr	String found in binary or memory: Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},lk:function(){e=zb()},ud:function(){d()}}};var gc=ma(["data-gtm-yt-inspected-"]),pD=["www.youtube.com","www.youtube-nocookie.com"],qD,rD=!1; equals www.youtube.com (Youtube)
Source: chromecache_579.2.dr	String found in binary or memory: __d("Chromedome",["fbt"],(function(a,b,c,d,e,f,g,h){function i(){if(document.domain==null)return null;var a=document.domain,b=/^intern\./.test(a);if(b)return null;b=/(^\|\.)facebook\.(com\|sg)$/.test(a);if(b)return"facebook";b=/(^\|\.)instagram\.com$/.test(a);if(b)return"instagram";b=/(^\|\.)threads\.net$/.test(a);if(b)return"threads";b=/(^\|\.)messenger\.com$/.test(a);return b?"messenger":null}function j(a){if(a==="instagram")return h._("This is a browser feature intended for developers. If someone told you to copy-paste something here to enable an Instagram feature or \"hack\" someone's account, it is a scam and will give them access to your Instagram account.");return a==="threads"?h._("This is a browser feature intended for developers. If someone told you to copy-paste something here to enable a Threads feature or \"hack\" someone's account, it is a scam and will give them access to your Threads account."):h._("This is a browser feature intended for developers. If someone told you to copy-paste something here to enable a Facebook feature or \"hack\" someone's account, it is a scam and will give them access to your Facebook account.")}function a(a){if(top!==window)return;a=i();if(a==null)return;var b=h._("Stop!");a=j(a);var c=h._("See {url} for more information.",[h._param("url","https://www.facebook.com/selfxss")]),d="font-family:helvetica; font-size:20px; ";[[b,d+"font-size:50px; font-weight:bold; color:red; -webkit-text-stroke:1px black;"],[a,d],[c,d],["",""]].map(function(a){window.setTimeout(console.log.bind(console,"\n%c"+a[0].toString(),a[1]))})}g.start=a}),226); equals www.facebook.com (Facebook)
Source: chromecache_616.2.dr	String found in binary or memory: __d("PolarisExternalRoutes",["PolarisLocales","URI"],(function(a,b,c,d,e,f,g){"use strict";var h;function a(a){return new(h\|\|(h=c("URI")))(a).addQueryData({locale:c("PolarisLocales").locale}).toString()}b=a("https://help.instagram.com/581066165581870/");d="https://about.instagram.com/blog/";e="https://about.instagram.com";f="https://about.meta.com";var i="https://www.meta.com/smart-glasses/",j="https://developers.facebook.com/docs/instagram",k="https://help.instagram.com",l="https://www.facebook.com/privacy/policy",m="https://privacycenter.instagram.com/policy/",n="https://www.instagram.com/privacy/cookie_settings/",o="/legal/cookies/",p="https://www.facebook.com/policies/cookies",q="https://privacycenter.instagram.com/policies/cookies/",r="https://privacycenter.instagram.com/policies/cookies/?annotations[0]=explanation%2F3_companies_list",s="https://www.facebook.com/help/instagram/261704639352628",t="https://www.whatsapp.com/legal/commerce-policy/",u="https://about.meta.com/technologies/meta-verified/",v=a("https://help.instagram.com/contact/543840232909258/"),w=a("https://help.instagram.com/contact/598671977756435/"),x=a("https://help.instagram.com/contact/406206379945942/");a=a("https://help.instagram.com/contact/383679321740945");var y="https://www.facebook.com/help/instagram/1164377657035425/",z="https://familycenter.instagram.com",A="https://familycenter.instagram.com/supervision",B="https://familycenter.instagram.com/education",C="https://business.facebook.com/latest/creator_marketplace?source=ig_web_profile&nav_ref=ig_web_profile",D="https://business.facebook.com/latest?nav_ref=ig_web_more_nav_menu",E="https://business.facebook.com/billing_hub/payment_settings?",F="https://m.facebook.com/billing_hub/payment_settings?",G="https://indonesia.fb.com/panduan-digital/",H="https://www.facebook.com/help/cancelcontracts?source=instagram.com",I="https://about.instagram.com/about-us/careers";g.NEW_LEGAL_TERMS_PATH=b;g.INSTAGRAM_PRESS_SITE_PATH=d;g.INSTAGRAM_ABOUT_SITE_PATH=e;g.META_ABOUT_SITE_PATH=f;g.META_RAY_BAN_SITE_PATH=i;g.INSTAGRAM_API_SITE_PATH=j;g.INSTAGRAM_HELP_SITE_PATH=k;g.NEW_PRIVACY_POLICY_PATH=l;g.INSTAGRAM_PRIVACY_POLICY_PATH=m;g.INSTAGRAM_COOKIE_SETTINGS_PATH=n;g.NEW_COOKIE_POLICY_PATH=o;g.FACEBOOK_COOKIE_POLICY_PATH=p;g.INSTAGRAM_COOKIE_POLICY_PATH_UPDATED=q;g.INSTAGRAM_COOKIE_POLICY_OTHER_COMPANIES_PATH=r;g.FACEBOOK_CONTACT_UPLOADING_AND_NON_USERS=s;g.WHATSAPP_COMMERCE_POLICY_PATH=t;g.META_VERIFIED_MARKETING_PATH=u;g.NETZDG_REPORT_CONTACT_FORM_PATH=v;g.CPA_REPORT_CONTACT_FORM_PATH=w;g.DSA_REPORT_CONTACT_FORM_PATH=x;g.COMMUNITY_VIOLATIONS_GUIDELINES_CONTACT_FORM_PATH=a;g.ACTIVITY_STATUS_HELP_PATH=y;g.FAMILY_CENTER_PATH=z;g.FAMILY_CENTER_HOME_PATH=A;g.EDUCATION_HUB_PATH=B;g.CREATOR_MARKETPLACE_PATH=C;g.MORE_NAV_MENU_META_BUSINESS_SUITE_PATH=D;g.BILLING_HUB_DESKTOP_PATH=E;g.BILLING_HUB_MSITE_PATH=F;g.META_IN_INDONESIA_PATH=G;g.CANCEL_SUBSCRIPTION=H;g.INSTAGRAM_JOBS_PATH=I}),98); equals www.facebook.com (Facebook)
Source: chromecache_348.2.dr	String found in binary or memory: __d("PolarisLinkshimURI",["PolarisInstapi","URI","promiseDone"],(function(a,b,c,d,e,f,g){"use strict";var h,i=["l.facebook.com","l.instagram.com"],j=["help.instagram.com","www.facebook.com","business.facebook.com"];function k(a){var b;try{b=new(h\|\|(h=c("URI")))(a)}catch(a){return!1}a=b.getDomain();var d=b.getProtocol().toLowerCase();return d!=null&&!d.startsWith("http")?!0:i.includes(a)&&!!b.getQueryData().u\|\|j.includes(a)}function a(a,b,e){e===void 0&&(e=""),k(a)&&b(a),c("promiseDone")(d("PolarisInstapi").apiPost("/api/v1/web/linkshim/link/",{body:{cs:e,u:a}}).then(function(a){b(a.data.uri)}))}g.shouldSkipLinkShim=k;g.asyncGet=a}),98); equals www.facebook.com (Facebook)
Source: chromecache_424.2.dr, chromecache_616.2.dr	String found in binary or memory: __d("isPolarisAdLink",["URI"],(function(a,b,c,d,e,f,g){"use strict";var h,i="www.facebook.com",j=/www\.[\w\-]+\.(od\|(sandcastle\|twshared)(\w+\.)+\w+)?\.?facebook\.com/,k="/ads/ig_redirect/";function a(a){a=new(h\|\|(h=c("URI")))(a);var b=a.getDomain();if(a.getPath()!==k)return!1;return b===i?!0:a.getDomain().match(j)!=null}g["default"]=a}),98); equals www.facebook.com (Facebook)
Source: chromecache_392.2.dr, chromecache_671.2.dr, chromecache_594.2.dr, chromecache_548.2.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=WA(a,c,e);U(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return U(122),!0;if(d&&f){for(var m=Kb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},ZA=function(){var a=[],b=function(c){return pb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_392.2.dr, chromecache_671.2.dr, chromecache_594.2.dr, chromecache_548.2.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={rh:e,ph:f,qh:g,bi:k,di:m,Je:n,Fb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(AD(w,"iframe_api")\|\|AD(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!rD&&yD(x[A],p.Je))return xc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_625.2.dr, chromecache_561.2.dr, chromecache_409.2.dr, chromecache_464.2.dr, chromecache_551.2.dr, chromecache_414.2.dr, chromecache_712.2.dr, chromecache_656.2.dr	String found in binary or memory: return b}nD.F="internal.enableAutoEventOnTimer";var gc=ma(["data-gtm-yt-inspected-"]),pD=["www.youtube.com","www.youtube-nocookie.com"],qD,rD=!1; equals www.youtube.com (Youtube)
Source: chromecache_392.2.dr, chromecache_671.2.dr, chromecache_594.2.dr, chromecache_548.2.dr	String found in binary or memory: var CC=function(a,b,c,d,e){var f=tA("fsl",c?"nv.mwt":"mwt",0),g;g=c?tA("fsl","nv.ids",[]):tA("fsl","ids",[]);if(!g.length)return!0;var k=yA(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);U(121);if(m==="https://www.facebook.com/tr/")return U(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!fz(k,hz(b, equals www.facebook.com (Facebook)
Source: chromecache_477.2.dr, chromecache_525.2.dr	String found in binary or memory: window.FB&&window.FB.__buffer&&(window.__buffer=babelHelpers["extends"]({},window.FB.__buffer)); } }).call(global);})();} catch (__fb_err) {var __fb_i = new Image();__fb_i.crossOrigin = 'anonymous';__fb_i.dataset.testid = 'fbSDKErrorReport';__fb_i.src='https://www.facebook.com/platform/scribe_endpoint.php/?c=jssdk_error&m='+encodeURIComponent('{"error":"LOAD", "extra": {"name":"'+__fb_err.name+'","line":"'+(__fb_err.lineNumber\|\|__fb_err.line)+'","script":"'+(__fb_err.fileName\|\|__fb_err.sourceURL\|\|__fb_err.script\|\|"sdk.js")+'","stack":"'+(__fb_err.stackTrace\|\|__fb_err.stack)+'","revision":"1017648540","namespace":"FB","message":"'+__fb_err.message+'"}}');document.body.appendChild(__fb_i);} equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: dhs.dist113.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.dist113.org
Source: global traffic	DNS traffic detected: DNS query: cdn.pendo.io
Source: global traffic	DNS traffic detected: DNS query: extend.schoolwires.com
Source: global traffic	DNS traffic detected: DNS query: vimeo.com
Source: global traffic	DNS traffic detected: DNS query: www.instagram.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: platform.twitter.com
Source: global traffic	DNS traffic detected: DNS query: f.vimeocdn.com
Source: global traffic	DNS traffic detected: DNS query: player.vimeo.com
Source: global traffic	DNS traffic detected: DNS query: i.vimeocdn.com
Source: global traffic	DNS traffic detected: DNS query: static.cdninstagram.com
Source: global traffic	DNS traffic detected: DNS query: cdn.userway.org
Source: global traffic	DNS traffic detected: DNS query: translate.google.com
Source: global traffic	DNS traffic detected: DNS query: js-agent.newrelic.com
Source: global traffic	DNS traffic detected: DNS query: syndication.twitter.com
Source: global traffic	DNS traffic detected: DNS query: fresnel-events.vimeocdn.com
Source: global traffic	DNS traffic detected: DNS query: bam.nr-data.net
Source: global traffic	DNS traffic detected: DNS query: api.userway.org
Source: global traffic	DNS traffic detected: DNS query: fresnel.vimeocdn.com
Source: global traffic	DNS traffic detected: DNS query: scontent.cdninstagram.com
Source: global traffic	DNS traffic detected: DNS query: graph.instagram.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: static.xx.fbcdn.net
Source: global traffic	DNS traffic detected: DNS query: scontent-sea1-1.xx.fbcdn.net
Source: global traffic	DNS traffic detected: DNS query: scontent.xx.fbcdn.net
Source: global traffic	DNS traffic detected: DNS query: csp-reporting.cloudflare.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2212,i,14395703224993771535,7885939220849462094,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://dhs.dist113.org/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2212,i,14395703224993771535,7885939220849462094,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://www.internalfb.com/intern/invariant/	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php	0%	URL Reputation	safe
https://stats.g.doubleclick.net/j/collect	0%	URL Reputation	safe
https://platform.twitter.com/widgets.js	0%	URL Reputation	safe

IP	Domain	Country	ASN	ASN Name	Malicious
54.212.160.43	unknown	United States	16509	AMAZON-02US	false
151.101.0.217	vimeo.map.fastly.net	United States	54113	FASTLYUS	false
104.244.42.72	syndication.twitter.com	United States	13414	TWITTERUS	false
157.240.253.63	scontent.cdninstagram.com	United States	32934	FACEBOOKUS	false
157.240.252.13	unknown	United States	32934	FACEBOOKUS	false
157.240.251.174	z-p42-instagram.c10r.instagram.com	United States	32934	FACEBOOKUS	false
104.18.20.157	csp-reporting.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
157.240.0.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
157.240.3.29	scontent-sea1-1.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
151.101.130.109	unknown	United States	54113	FASTLYUS	false
151.101.2.109	vimeo-video.map.fastly.net	United States	54113	FASTLYUS	false
212.102.56.179	1667503734.rsc.cdn77.org	Italy	60068	CDN77GB	false
34.225.93.18	unknown	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
44.220.109.230	unknown	United States	14618	AMAZON-AESUS	false
199.232.188.157	platform.twitter.map.fastly.net	United States	54113	FASTLYUS	false
18.172.112.119	unknown	United States	3	MIT-GATEWAYSUS	false
18.172.112.100	d2kz4bkat222l8.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
157.240.0.63	instagram.c10r.instagram.com	United States	32934	FACEBOOKUS	false
44.217.27.254	il01904711.schoolwires.net	United States	14618	AMAZON-AESUS	false
34.36.213.229	cdn.pendo.io	United States	2686	ATGS-MMD-ASUS	false
157.240.0.6	unknown	United States	32934	FACEBOOKUS	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
35.83.226.195	api.userway.org	United States	237	MERIT-AS-14US	false
157.240.251.63	unknown	United States	32934	FACEBOOKUS	false
162.247.243.39	js-agent.newrelic.com	United States	13335	CLOUDFLARENETUS	false
172.217.18.110	www3.l.google.com	United States	15169	GOOGLEUS	false
34.120.202.204	fresnel.vimeocdn.com	United States	15169	GOOGLEUS	false
195.181.170.19	unknown	United Kingdom	60068	CDN77GB	false
34.120.15.67	fresnel-events.vimeocdn.com	United States	15169	GOOGLEUS	false
3.233.143.41	swa-redir01-1456255166.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
157.240.253.1	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
162.247.243.29	fastly-tls12-bam.nr-data.net	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541601
Start date and time:	2024-10-25 00:37:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://dhs.dist113.org/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@22/614@102/34
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 21:38:52 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.98422701903611
Encrypted:	false
SSDEEP:	48:8F/dCTUPf4PH6idAKZdA1nehwiZUklqehgy+3:8FMQ4e/y
MD5:	F75236C3D7EDEDA360034C4BE9266756
SHA1:	FF6B2DA1A23F3A97D6DD0FD0BC09DCF3667C64EC
SHA-256:	85F05B18C40410944BE0B2F26D248EE1A707C8C3E27DF8E9E3F782B365D20EE2
SHA-512:	C48D5CD6B0111460F8370C0604C14834DBA3BE095EFF1D3C0BE6C7B26B47D7DB0FED5BF3567A4E429E7861CC58CC29B953AC67565B009D5F200BF1F2F85392B3
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....Y..e&......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.IXY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.VXY.....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.VXY...........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VXY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........q..\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 21:38:52 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.005704687159811
Encrypted:	false
SSDEEP:	48:8H/dCTUPf4PH6idAKZdA1geh/iZUkAQkqehvy+2:8HMQ469QWy
MD5:	4D8C6B6596E09CCCFA5C3D080C853C42
SHA1:	E5049434742BE7EC8C0921872D9E9881A1FD17E2
SHA-256:	0849A68B7FB3A07E41DC2BC22CA15400952893CEB782A9F3E1793312055CD309
SHA-512:	23889B5F31EC61F6E5781A74602538F29D09F09318AC8FA7741DAC2BCA9135E0767F71315237E07D1D3F2539A2E551C17397B2446651C06A4B844D8561265FF1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e&......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.IXY.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.VXY.....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.VXY...........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VXY.............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........q..\|.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Name	IP	Active	Malicious	Reputation
fastly-tls12-bam.nr-data.net	162.247.243.29	true	false	unknown
1667503734.rsc.cdn77.org	212.102.56.179	true	false	unknown
d2kz4bkat222l8.cloudfront.net	18.172.112.100	true	false	unknown
z-p42-instagram.c10r.instagram.com	157.240.251.174	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
platform.twitter.map.fastly.net	199.232.188.157	true	false	unknown
api.userway.org	35.83.226.195	true	false	unknown
scontent.xx.fbcdn.net	157.240.253.1	true	false	unknown
fresnel.vimeocdn.com	34.120.202.204	true	false	unknown
www.google.com	142.250.185.164	true	false	unknown
star-mini.c10r.facebook.com	157.240.0.35	true	false	unknown
swa-redir01-1456255166.us-east-1.elb.amazonaws.com	3.233.143.41	true	false	unknown
js-agent.newrelic.com	162.247.243.39	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
il01904711.schoolwires.net	44.217.27.254	true	false	unknown
csp-reporting.cloudflare.com	104.18.20.157	true	false	unknown
vimeo.com	162.159.128.61	true	false	unknown
scontent.cdninstagram.com	157.240.253.63	true	false	unknown
syndication.twitter.com	104.244.42.72	true	false	unknown
vimeo.map.fastly.net	151.101.0.217	true	false	unknown
fresnel-events.vimeocdn.com	34.120.15.67	true	false	unknown
scontent-sea1-1.xx.fbcdn.net	157.240.3.29	true	false	unknown
cdn.pendo.io	34.36.213.229	true	false	unknown
www3.l.google.com	172.217.18.110	true	false	unknown
instagram.c10r.instagram.com	157.240.0.63	true	false	unknown
vimeo-video.map.fastly.net	151.101.2.109	true	false	unknown
dhs.dist113.org	unknown	unknown	false	unknown
i.vimeocdn.com	unknown	unknown	false	unknown
graph.instagram.com	unknown	unknown	false	unknown
static.cdninstagram.com	unknown	unknown	false	unknown
f.vimeocdn.com	unknown	unknown	false	unknown
platform.twitter.com	unknown	unknown	false	unknown
www.facebook.com	unknown	unknown	false	unknown
extend.schoolwires.com	unknown	unknown	false	unknown
connect.facebook.net	unknown	unknown	false	unknown
bam.nr-data.net	unknown	unknown	false	unknown
static.xx.fbcdn.net	unknown	unknown	false	unknown
cdn.userway.org	unknown	unknown	false	unknown
www.instagram.com	unknown	unknown	false	unknown
www.dist113.org	unknown	unknown	false	unknown
translate.google.com	unknown	unknown	false	unknown
player.vimeo.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://bam.nr-data.net/events/1/689d5b4562?a=718354574&sa=1&v=1208.49599aa&t=Unnamed%20Transaction&rst=7721&ck=1&ref=https://vimeo.com/showcase/11380849/embed	false		unknown
https://static.cdninstagram.com/rsrc.php/v3/yZ/r/i2yEVh-cs27.js	false		unknown
https://platform.twitter.com/_next/static/chunks/3077.44bfeb00af01bc4020f6.js	false		unknown
https://www.dist113.org/Site/SiteController.aspx/InsertAnalyticsData	false		unknown
https://www.dist113.org//cms/lib/IL01904711/Centricity/Domain/4/IMG_2778.jpg	false		unknown
https://bam.nr-data.net/1/689d5b4562?a=718354574&sa=1&v=1208.49599aa&t=Unnamed%20Transaction&rst=1259&ck=1&ref=https://vimeo.com/showcase/11380849/embed&be=1227&fe=1246&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1729809555651,%22n%22:0,%22f%22:21,%22dn%22:21,%22dne%22:21,%22c%22:21,%22ce%22:21,%22rq%22:356,%22rp%22:673,%22rpe%22:908,%22dl%22:977,%22di%22:994,%22ds%22:1226,%22de%22:1229,%22dc%22:1245,%22l%22:1245,%22le%22:1248%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken	false		unknown
https://scontent-sea1-1.xx.fbcdn.net/v/t39.30808-6/462460487_1322213652135704_209495141046131901_n.jpg?stp=dst-jpg_p280x280&_nc_cat=101&ccb=1-7&_nc_sid=e5c1b6&_nc_ohc=DeGe9TMDHIwQ7kNvgFGqQJL&_nc_zt=23&_nc_ht=scontent-sea1-1.xx&edm=ALIZrNsEAAAA&_nc_gid=AllcbEDjyBZiE1wjBg_X5N7&oh=00_AYCpnlB5wUu2vKqF_LbEVdpHhec5YfpsJC1-QjXMJRovMg&oe=6720B845	false		unknown
https://www.dist113.org/Static/GlobalAssets/webfonts/OpenSans-Light.css	false		unknown
https://static.cdninstagram.com/rsrc.php/v3/yT/r/XKCjHBowTyg.js	false		unknown
https://f.vimeocdn.com/js_opt/app/embed/_next/static/chunks/650-e3e39be7a9d6b63b.js	false		unknown
https://www.dist113.org/Static/GlobalAssets/Scripts/ThirdParty/shepherd/shepherd-theme-default.css	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v4/yD/l/0,cross/xjSQ907nXKJ.css	false		unknown
https://static.cdninstagram.com/rsrc.php/v4/yt/l/0,cross/xNV22YzcSzu.css	false		unknown
https://scontent-sea1-1.xx.fbcdn.net/v/t39.30808-6/462690273_1324471341909935_7186608693260271113_n.jpg?stp=dst-jpg_p280x280&_nc_cat=107&ccb=1-7&_nc_sid=e5c1b6&_nc_ohc=CcWM3KKrlfwQ7kNvgExmWdO&_nc_zt=23&_nc_ht=scontent-sea1-1.xx&edm=ALIZrNsEAAAA&_nc_gid=AllcbEDjyBZiE1wjBg_X5N7&oh=00_AYDnVqKJ9DscQS3ySZD7jBpqdqQDU2WjNniYKa2J_JT2qg&oe=6720B26D	false		unknown
https://extend.schoolwires.com/creative/scripts/creative/global/js/cs.global.min.js	false		unknown
https://www.dist113.org/Static/GlobalAssets/jQuery.min.js	false		unknown
https://static.cdninstagram.com/rsrc.php/v3/yG/r/79Y5er0dFt4.js	false		unknown
https://www.dist113.org/Static/GlobalAssets/Scripts/ThirdParty/json2.js	false		unknown
https://www.dist113.org/cms/lib/IL01904711/Centricity/Template/GlobalAssets/icons/schoology-red1.png	false		unknown
https://scontent-sea1-1.xx.fbcdn.net/v/t39.30808-1/298536978_764143344609407_6494968095402526894_n.jpg?stp=c0.0.180.180a_cp0_dst-jpg_s50x50&_nc_cat=105&ccb=1-7&_nc_sid=6738e8&_nc_ohc=4amSsSQ2e7AQ7kNvgFUMnX5&_nc_zt=24&_nc_ht=scontent-sea1-1.xx&edm=ALIZrNsEAAAA&_nc_gid=AllcbEDjyBZiE1wjBg_X5N7&oh=00_AYB-kWQGprC2aSF9wsLCsrc1M28ey4WpGhym4ZWh_mDYDQ&oe=67209B47	false		unknown
https://static.cdninstagram.com/rsrc.php/v4/y_/l/0,cross/obc1Ghrr0Bo.css	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3/yz/r/c64elx0V1Fa.js	false		unknown
https://www.dist113.org/Static/GlobalAssets/Scripts/ThirdParty/shepherd/shepherd.min.js	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/p55HfXW__mM.js	false		unknown
https://cdn.pendo.io/agent/static/ca0f531d-af61-45a7-7c9a-079f24d9128a/pendo.js	false		unknown
https://i.vimeocdn.com/video/1939804832-0f2ce3cda7a2a7925490eeb2255d5bfe984e55d77dc76b3c67fd8a67674f0675-d_260	false		unknown
https://static.cdninstagram.com/rsrc.php/v3/yK/r/lNInKxOqejp.js	false		unknown
https://bam.nr-data.net/events/1/689d5b4562?a=718354574&sa=1&v=1208.49599aa&t=Unnamed%20Transaction&rst=11716&ck=1&ref=https://vimeo.com/showcase/11380849/embed	false		unknown
https://www.dist113.org//cms/lib/IL01904711/Centricity/Domain/4/Shutterstock_1184264401.jpg	false		unknown
https://f.vimeocdn.com/js_opt/app/embed/_next/static/media/play.b94f0133.svg	false		unknown
https://bam.nr-data.net/1/689d5b4562?a=718354574&sa=1&v=1208.49599aa&t=Unnamed%20Transaction&rst=6493&ck=1&ref=https://vimeo.com/showcase/11380849/embed&be=5026&fe=5042&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1729809546405,%22n%22:0,%22f%22:1,%22dn%22:45,%22dne%22:45,%22c%22:45,%22s%22:46,%22ce%22:674,%22rq%22:674,%22rp%22:1065,%22rpe%22:1355,%22dl%22:1104,%22di%22:1636,%22ds%22:5025,%22de%22:5032,%22dc%22:5041,%22l%22:5041,%22le%22:5046%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken	false		unknown
https://www.dist113.org/Static/GlobalAssets/jQueryUI.min.js	false		unknown
https://i.vimeocdn.com/video/1939805730-7a6f5109045e8f15aadd576fe91bf05cefc6d87f80fa76c3c5b99ed3a808af79-d_260	false		unknown
https://static.cdninstagram.com/rsrc.php/v3iJfX4/yC/l/en_US/yvAR92QRqiG.js	false		unknown
https://static.cdninstagram.com/rsrc.php/v3/yl/r/ywrhmAOvwK2.js	false		unknown
https://scontent.cdninstagram.com/v/t51.2885-19/14031556_314484125565113_1015223541_a.jpg?stp=dst-jpg_s240x240&_nc_ht=scontent.cdninstagram.com&_nc_cat=105&_nc_ohc=kxBQF4KU-IsQ7kNvgEld36D&_nc_gid=fe8e3d49bb734bafb69c2dd43657aec6&edm=APs17CUBAAAA&ccb=7-5&oh=00_AYBSxYy7Y7HG3H7pBoajXvDiqlXX2vMm-7YqfoAqulVGTQ&oe=6720ACBC&_nc_sid=10d13b	false		unknown
https://extend.schoolwires.com/creative/scripts/creative/responsive/cs.rs.tabbed.blocks.min.js	false		unknown
https://www.dist113.org/Static//site/assets/styles/apps_2590.css	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3/yu/r/hFp8JbjxADj.js	false		unknown
https://static.cdninstagram.com/rsrc.php/v4/y2/l/0,cross/AfjsYDHje7C.css	false		unknown
https://static.cdninstagram.com/rsrc.php/v3/y1/r/db_RQLQYjko.js	false		unknown
https://static.cdninstagram.com/rsrc.php/v3/yx/r/QqKREiSydF0.js	false		unknown
https://f.vimeocdn.com/js_opt/app/embed/_next/static/3gW3CZ-gN3OEVwIIvLvjG/_buildManifest.js	false		unknown
https://www.instagram.com/ajax/bz?__a=1&__ccg=UNKNOWN&__dyn=7xe6E5aU7ibwKBAg35xu13w8CewpUuwdK0lW4o3Bw5VCwjE3awbG0MU2awgo1EUhwnU6a0Rk2C0iK0D830wbu0oi0zE5W0PU1mUdEG0xo662O0Lo6-1Cw4pwr830wrd6goK1sAwHwtU5K0PUiw&__hs=20020.BP%3ADEFAULT.2.0..0.0&__hsi=7429475475644205491&__req=1&__rev=1017646842&__s=3o70xi%3A9bu7l5%3A8jjw7q&__spin_b=trunk&__spin_r=1017646842&__spin_t=1729809557&__user=0&dpr=1&jazoest=2942&lsd=AVoBPfg7cfI	false		unknown
https://static.cdninstagram.com/rsrc.php/v4/y4/l/0,cross/rhgRKiEMNMh.css	false		unknown
https://platform.twitter.com/_next/static/chunks/8283.f3e5048cca7cef5eed7f.js	false		unknown
https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.dist113.org	false		unknown
https://extend.schoolwires.com/creative/scripts/creative/tools/hex-to-filter/css-hex-to-filter.min.js	false		unknown
https://bam.nr-data.net/events/1/689d5b4562?a=718354574&sa=1&v=1208.49599aa&t=Unnamed%20Transaction&rst=3696&ck=1&ref=https://vimeo.com/showcase/11380849/embed	false		unknown
https://f.vimeocdn.com/js_opt/app/embed/_next/static/chunks/pages/showcase/%5BentityId%5D/embed-327b937d1f83642d.js	false		unknown
https://www.dist113.org/cms/lib/IL01904711/Centricity/Domain/4/BadgeHighSchoolsNationalYear.png	false		unknown
https://www.dist113.org/Static/GlobalAssets/Scripts/CheckScript_2780.js	false		unknown
https://static.cdninstagram.com/rsrc.php/v3/y6/r/SKdtG5PJSFi.js	false		unknown
https://extend.schoolwires.com/creative/css/sw-icon-library/sw-icon-library.min.css	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3i7M54/y4/l/en_US/crAC7cydGly.js	false		unknown
https://www.dist113.org/Static/GlobalAssets/Scripts/min/SW-UI_2680.min.js	false		unknown
https://platform.twitter.com/_next/static/chunks/pages/timeline-profile/screen-name/%5BscreenName%5D-0517bdda27d5006a5a2d.js	false		unknown
https://static.cdninstagram.com/rsrc.php/v3/yS/r/GYOifFEyq9Y.js	false		unknown
https://platform.twitter.com/_next/static/chunks/1362.42d432e02f7980bca032.js	false		unknown
https://i.vimeocdn.com/video/1941975605-e692ef974a9fdc846c359e2b09a3096b653b09f79947678f41e4a3c37d182919-d_260	false		unknown
https://i.vimeocdn.com/video/1939802247-9b046b8c49e5d4765a082d92d5653aa3cb66d423c94c97052417e5cbf637cae8-d_260	false		unknown
https://static.xx.fbcdn.net/rsrc.php/v3/yt/r/oUR-okb_iY2.js	false		unknown
https://www.dist113.org/Static//GlobalAssets/Scripts/min/ModuleViewRenderer_2750.js	false		unknown
https://www.dist113.org/Static/GlobalAssets/Scripts/min/swfobject.min.js	false		unknown
https://bam.nr-data.net/jserrors/1/689d5b4562?a=718354574&sa=1&v=1208.49599aa&t=Unnamed%20Transaction&rst=29680&ck=1&ref=https://vimeo.com/showcase/11380849/embed	false		unknown
https://f.vimeocdn.com/js_opt/app/embed/_next/static/chunks/82318e53-c27eb1519701b786.js	false		unknown
https://extend.schoolwires.com/creative/module_library/important-announcement/js/cs.important.announcement.app.min.js	false		unknown
https://platform.twitter.com/widgets.js	false	URL Reputation: safe	unknown
https://extend.schoolwires.com/creative/scripts/creative/tools/head.min.js	false		unknown
https://f.vimeocdn.com/js_opt/app/embed/_next/static/chunks/pages/_app-54d83d8c48ceef40.js	false		unknown
https://cdn.userway.org/remediation/2024-10-22-09-11-04/free/remediation-tool-free.js?ts=1729588264776	false		unknown
https://www.dist113.org/Static//globalassets/images/sw-mystart-search.png	false		unknown
https://i.vimeocdn.com/video/1935129223-12060b6b2003496258258fc7bc63bf3f98c4646079039a2988176dfd20665353-d_260	false		unknown
https://www.dist113.org/Static/App_Themes/SW/jquery.jgrowl.css	false		unknown
https://www.dist113.org/Static//site/assets/styles/system_2741.css	false		unknown
https://www.dist113.org/Static/GlobalAssets/Scripts/min/jquery.ajaxupload_2440.min.js	false		unknown
https://static.cdninstagram.com/rsrc.php/v3i3Rs4/yU/l/en_US/VCKrhAivEv4.js	false		unknown
https://f.vimeocdn.com/js_opt/app/embed/_next/static/chunks/1865-cfc9a38406ddc4b7.js	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_561.2.dr, chromecache_392.2.dr, chromecache_671.2.dr, chromecache_594.2.dr, chromecache_712.2.dr, chromecache_548.2.dr	false	URL Reputation: safe	unknown
https://codepen.io/sosuke/pen/Pjoqqp?editors=1111	chromecache_644.2.dr, chromecache_462.2.dr	false		unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_514.2.dr, chromecache_595.2.dr	false	URL Reputation: safe	unknown
http://jqueryui.com/themeroller/?ffDefault=Verdana	chromecache_612.2.dr	false		unknown
https://babeljs.io/repl/	chromecache_644.2.dr, chromecache_462.2.dr	false		unknown
https://www.internalfb.com/intern/invariant/	chromecache_372.2.dr, chromecache_729.2.dr, chromecache_382.2.dr, chromecache_477.2.dr, chromecache_525.2.dr, chromecache_662.2.dr	false	URL Reputation: safe	unknown
https://www.instagram.com	chromecache_424.2.dr, chromecache_616.2.dr	false		unknown
http://www.opensource.org/licenses/mit-license.php	chromecache_606.2.dr, chromecache_643.2.dr, chromecache_670.2.dr	false	URL Reputation: safe	unknown
https://play.google.com/store/apps/details?id=com.facebook.orca	chromecache_477.2.dr, chromecache_525.2.dr	false		unknown
https://stats.g.doubleclick.net/j/collect	chromecache_595.2.dr	false	URL Reputation: safe	unknown
https://agent.pendo.io/licenses	chromecache_583.2.dr, chromecache_406.2.dr	false		unknown
https://about.instagram.com/blog/	chromecache_424.2.dr, chromecache_616.2.dr	false		unknown
http://www.JSON.org/json2.js	chromecache_603.2.dr, chromecache_446.2.dr	false		unknown
https://twitter.com/intent/follow?	chromecache_631.2.dr, chromecache_560.2.dr	false		unknown
https://about.instagram.com	chromecache_424.2.dr, chromecache_616.2.dr	false		unknown
https://cdn.userway.org/	chromecache_607.2.dr, chromecache_608.2.dr, chromecache_454.2.dr, chromecache_701.2.dr	false		unknown
http://www.imagemagick.org	chromecache_639.2.dr	false		unknown
https://platform.twitter.com/_next/static/chunks/polyfills-a40ef1678bae11e696dba45124eadd70.js	chromecache_554.2.dr	false		unknown
https://www.google.com/images/cleardot.gif	chromecache_401.2.dr	false		unknown
https://api.userway.org/api	chromecache_607.2.dr, chromecache_608.2.dr	false		unknown
https://www.meta.com/smart-glasses/	chromecache_424.2.dr, chromecache_616.2.dr	false		unknown
https://twittercommunity.com/c/publisher/websites/	chromecache_435.2.dr, chromecache_537.2.dr	false		unknown

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 00:38:53.277550936 CEST	192.168.2.11	1.1.1.1	0xe4f6	Standard query (0)	dhs.dist113.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:38:53.278070927 CEST	192.168.2.11	1.1.1.1	0x60a3	Standard query (0)	dhs.dist113.org	65	IN (0x0001)	false
Oct 25, 2024 00:38:53.292476892 CEST	192.168.2.11	1.1.1.1	0x1bb6	Standard query (0)	dhs.dist113.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:38:53.292730093 CEST	192.168.2.11	1.1.1.1	0x6a1d	Standard query (0)	dhs.dist113.org	65	IN (0x0001)	false
Oct 25, 2024 00:38:55.723253012 CEST	192.168.2.11	1.1.1.1	0x381f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:38:55.723779917 CEST	192.168.2.11	1.1.1.1	0x22fc	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 25, 2024 00:38:55.901748896 CEST	192.168.2.11	1.1.1.1	0x7c88	Standard query (0)	www.dist113.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:38:55.901909113 CEST	192.168.2.11	1.1.1.1	0xf09	Standard query (0)	www.dist113.org	65	IN (0x0001)	false
Oct 25, 2024 00:38:56.289560080 CEST	192.168.2.11	1.1.1.1	0x2964	Standard query (0)	www.dist113.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:38:56.289725065 CEST	192.168.2.11	1.1.1.1	0xe1bc	Standard query (0)	www.dist113.org	65	IN (0x0001)	false
Oct 25, 2024 00:38:58.226605892 CEST	192.168.2.11	1.1.1.1	0xa703	Standard query (0)	cdn.pendo.io	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:38:58.226815939 CEST	192.168.2.11	1.1.1.1	0x4526	Standard query (0)	cdn.pendo.io	65	IN (0x0001)	false
Oct 25, 2024 00:38:58.609889030 CEST	192.168.2.11	1.1.1.1	0xd92c	Standard query (0)	extend.schoolwires.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:38:58.610084057 CEST	192.168.2.11	1.1.1.1	0x614e	Standard query (0)	extend.schoolwires.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:01.378566027 CEST	192.168.2.11	1.1.1.1	0xd7f3	Standard query (0)	extend.schoolwires.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:01.378743887 CEST	192.168.2.11	1.1.1.1	0xba8	Standard query (0)	extend.schoolwires.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:01.393393040 CEST	192.168.2.11	1.1.1.1	0xffd7	Standard query (0)	www.dist113.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:01.394185066 CEST	192.168.2.11	1.1.1.1	0x89bb	Standard query (0)	www.dist113.org	65	IN (0x0001)	false
Oct 25, 2024 00:39:02.004724026 CEST	192.168.2.11	1.1.1.1	0xc275	Standard query (0)	cdn.pendo.io	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:02.005084038 CEST	192.168.2.11	1.1.1.1	0x8197	Standard query (0)	cdn.pendo.io	65	IN (0x0001)	false
Oct 25, 2024 00:39:04.797786951 CEST	192.168.2.11	1.1.1.1	0x2b68	Standard query (0)	vimeo.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:04.798496008 CEST	192.168.2.11	1.1.1.1	0x2446	Standard query (0)	vimeo.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:04.804497957 CEST	192.168.2.11	1.1.1.1	0x722d	Standard query (0)	www.instagram.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:04.805042982 CEST	192.168.2.11	1.1.1.1	0xf90a	Standard query (0)	www.instagram.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:06.481585979 CEST	192.168.2.11	1.1.1.1	0x4385	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:06.482012987 CEST	192.168.2.11	1.1.1.1	0x14a5	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Oct 25, 2024 00:39:06.482532978 CEST	192.168.2.11	1.1.1.1	0x8aba	Standard query (0)	platform.twitter.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:06.482790947 CEST	192.168.2.11	1.1.1.1	0x3811	Standard query (0)	platform.twitter.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:06.932543039 CEST	192.168.2.11	1.1.1.1	0x68a8	Standard query (0)	f.vimeocdn.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:06.932813883 CEST	192.168.2.11	1.1.1.1	0x560	Standard query (0)	f.vimeocdn.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:06.933347940 CEST	192.168.2.11	1.1.1.1	0x1abf	Standard query (0)	player.vimeo.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:06.933564901 CEST	192.168.2.11	1.1.1.1	0x97a6	Standard query (0)	player.vimeo.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:06.934345007 CEST	192.168.2.11	1.1.1.1	0x98ca	Standard query (0)	i.vimeocdn.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:06.934568882 CEST	192.168.2.11	1.1.1.1	0xded3	Standard query (0)	i.vimeocdn.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:07.037014008 CEST	192.168.2.11	1.1.1.1	0x5f4	Standard query (0)	static.cdninstagram.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:07.037442923 CEST	192.168.2.11	1.1.1.1	0xd254	Standard query (0)	static.cdninstagram.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:07.670258999 CEST	192.168.2.11	1.1.1.1	0xab84	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:07.670469999 CEST	192.168.2.11	1.1.1.1	0x3dc6	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Oct 25, 2024 00:39:08.671863079 CEST	192.168.2.11	1.1.1.1	0x3039	Standard query (0)	platform.twitter.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:08.672003031 CEST	192.168.2.11	1.1.1.1	0xa577	Standard query (0)	platform.twitter.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:08.870748997 CEST	192.168.2.11	1.1.1.1	0x4537	Standard query (0)	platform.twitter.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:08.870907068 CEST	192.168.2.11	1.1.1.1	0xb0e7	Standard query (0)	platform.twitter.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:08.924845934 CEST	192.168.2.11	1.1.1.1	0x83d1	Standard query (0)	f.vimeocdn.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:08.925203085 CEST	192.168.2.11	1.1.1.1	0xc656	Standard query (0)	f.vimeocdn.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:09.229650974 CEST	192.168.2.11	1.1.1.1	0x2dfa	Standard query (0)	cdn.userway.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:09.229794979 CEST	192.168.2.11	1.1.1.1	0x4468	Standard query (0)	cdn.userway.org	65	IN (0x0001)	false
Oct 25, 2024 00:39:10.337379932 CEST	192.168.2.11	1.1.1.1	0xe8ef	Standard query (0)	cdn.userway.org	65	IN (0x0001)	false
Oct 25, 2024 00:39:10.337379932 CEST	192.168.2.11	1.1.1.1	0x4e0e	Standard query (0)	cdn.userway.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:10.514779091 CEST	192.168.2.11	1.1.1.1	0x796d	Standard query (0)	translate.google.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:10.514985085 CEST	192.168.2.11	1.1.1.1	0x7eeb	Standard query (0)	translate.google.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:11.384854078 CEST	192.168.2.11	1.1.1.1	0xbd73	Standard query (0)	static.cdninstagram.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:11.385103941 CEST	192.168.2.11	1.1.1.1	0xe530	Standard query (0)	static.cdninstagram.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:12.449942112 CEST	192.168.2.11	1.1.1.1	0x7a2e	Standard query (0)	js-agent.newrelic.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:12.450368881 CEST	192.168.2.11	1.1.1.1	0x798f	Standard query (0)	js-agent.newrelic.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:12.666183949 CEST	192.168.2.11	1.1.1.1	0x4198	Standard query (0)	syndication.twitter.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:12.666364908 CEST	192.168.2.11	1.1.1.1	0x2b36	Standard query (0)	syndication.twitter.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:13.382308960 CEST	192.168.2.11	1.1.1.1	0xde4c	Standard query (0)	fresnel-events.vimeocdn.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:13.382476091 CEST	192.168.2.11	1.1.1.1	0x5d3a	Standard query (0)	fresnel-events.vimeocdn.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:13.891433001 CEST	192.168.2.11	1.1.1.1	0x1724	Standard query (0)	bam.nr-data.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:13.891571999 CEST	192.168.2.11	1.1.1.1	0xcb07	Standard query (0)	bam.nr-data.net	65	IN (0x0001)	false
Oct 25, 2024 00:39:14.276197910 CEST	192.168.2.11	1.1.1.1	0x7344	Standard query (0)	translate.google.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:14.276348114 CEST	192.168.2.11	1.1.1.1	0x9f71	Standard query (0)	translate.google.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:14.775921106 CEST	192.168.2.11	1.1.1.1	0xf709	Standard query (0)	js-agent.newrelic.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:14.776096106 CEST	192.168.2.11	1.1.1.1	0x5b8f	Standard query (0)	js-agent.newrelic.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:14.789891958 CEST	192.168.2.11	1.1.1.1	0x60f4	Standard query (0)	syndication.twitter.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:14.790162086 CEST	192.168.2.11	1.1.1.1	0xe959	Standard query (0)	syndication.twitter.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:17.994679928 CEST	192.168.2.11	1.1.1.1	0x2f52	Standard query (0)	bam.nr-data.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:17.995223999 CEST	192.168.2.11	1.1.1.1	0x33a0	Standard query (0)	bam.nr-data.net	65	IN (0x0001)	false
Oct 25, 2024 00:39:18.579577923 CEST	192.168.2.11	1.1.1.1	0x3ec2	Standard query (0)	api.userway.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:18.579905033 CEST	192.168.2.11	1.1.1.1	0x47c2	Standard query (0)	api.userway.org	65	IN (0x0001)	false
Oct 25, 2024 00:39:20.667879105 CEST	192.168.2.11	1.1.1.1	0x3f7e	Standard query (0)	fresnel-events.vimeocdn.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:20.668060064 CEST	192.168.2.11	1.1.1.1	0x88ac	Standard query (0)	fresnel-events.vimeocdn.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:23.478151083 CEST	192.168.2.11	1.1.1.1	0x442	Standard query (0)	api.userway.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:23.478300095 CEST	192.168.2.11	1.1.1.1	0x8a81	Standard query (0)	api.userway.org	65	IN (0x0001)	false
Oct 25, 2024 00:39:24.497067928 CEST	192.168.2.11	1.1.1.1	0xe18d	Standard query (0)	fresnel.vimeocdn.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:24.497339010 CEST	192.168.2.11	1.1.1.1	0x2c92	Standard query (0)	fresnel.vimeocdn.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:29.042984009 CEST	192.168.2.11	1.1.1.1	0x7fcf	Standard query (0)	scontent.cdninstagram.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:29.043191910 CEST	192.168.2.11	1.1.1.1	0xc132	Standard query (0)	scontent.cdninstagram.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:29.086091042 CEST	192.168.2.11	1.1.1.1	0x8196	Standard query (0)	player.vimeo.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:29.086281061 CEST	192.168.2.11	1.1.1.1	0xbce4	Standard query (0)	player.vimeo.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:29.124864101 CEST	192.168.2.11	1.1.1.1	0x7b30	Standard query (0)	i.vimeocdn.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:29.125089884 CEST	192.168.2.11	1.1.1.1	0x2dad	Standard query (0)	i.vimeocdn.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:31.248162985 CEST	192.168.2.11	1.1.1.1	0x4db1	Standard query (0)	scontent.cdninstagram.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:31.248635054 CEST	192.168.2.11	1.1.1.1	0x9dbe	Standard query (0)	scontent.cdninstagram.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:34.458091974 CEST	192.168.2.11	1.1.1.1	0x1cb0	Standard query (0)	graph.instagram.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:34.459557056 CEST	192.168.2.11	1.1.1.1	0x7132	Standard query (0)	graph.instagram.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:37.237071991 CEST	192.168.2.11	1.1.1.1	0x1774	Standard query (0)	graph.instagram.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:37.237899065 CEST	192.168.2.11	1.1.1.1	0x42d9	Standard query (0)	graph.instagram.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:38.120867014 CEST	192.168.2.11	1.1.1.1	0xb74d	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:38.121320009 CEST	192.168.2.11	1.1.1.1	0x7902	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Oct 25, 2024 00:39:39.460846901 CEST	192.168.2.11	1.1.1.1	0x7499	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:39.460951090 CEST	192.168.2.11	1.1.1.1	0xf1ef	Standard query (0)	static.xx.fbcdn.net	65	IN (0x0001)	false
Oct 25, 2024 00:39:40.587187052 CEST	192.168.2.11	1.1.1.1	0x12	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:40.587321997 CEST	192.168.2.11	1.1.1.1	0xa2de	Standard query (0)	static.xx.fbcdn.net	65	IN (0x0001)	false
Oct 25, 2024 00:39:43.059334040 CEST	192.168.2.11	1.1.1.1	0x2ce4	Standard query (0)	scontent-sea1-1.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:43.059462070 CEST	192.168.2.11	1.1.1.1	0xe054	Standard query (0)	scontent-sea1-1.xx.fbcdn.net	65	IN (0x0001)	false
Oct 25, 2024 00:39:44.082103968 CEST	192.168.2.11	1.1.1.1	0xae87	Standard query (0)	scontent-sea1-1.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:44.082247972 CEST	192.168.2.11	1.1.1.1	0x1841	Standard query (0)	scontent-sea1-1.xx.fbcdn.net	65	IN (0x0001)	false
Oct 25, 2024 00:39:45.360564947 CEST	192.168.2.11	1.1.1.1	0x8cd3	Standard query (0)	scontent.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:39:45.360794067 CEST	192.168.2.11	1.1.1.1	0x5675	Standard query (0)	scontent.xx.fbcdn.net	65	IN (0x0001)	false
Oct 25, 2024 00:40:07.514797926 CEST	192.168.2.11	1.1.1.1	0x29ae	Standard query (0)	csp-reporting.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 00:40:07.515019894 CEST	192.168.2.11	1.1.1.1	0x6f34	Standard query (0)	csp-reporting.cloudflare.com	65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 00:38:55.734877110 CEST	430	OUT	GET / HTTP/1.1 Host: dhs.dist113.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 25, 2024 00:38:55.895597935 CEST	461	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 24 Oct 2024 22:38:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 163 Connection: keep-alive Cache-Control: private Location: http://www.dist113.org/dhs Server: Microsoft-IIS/10.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 64 69 73 74 31 31 33 2e 6f 72 67 2f 64 68 73 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 3c 62 72 2f 3e 64 68 73 2e 64 69 73 74 31 31 33 2e 6f 72 67 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="http://www.dist113.org/dhs">here</a>.</h2></body></html><br/>dhs.dist113.org
Oct 25, 2024 00:39:40.909945011 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 00:38:56.355288029 CEST	433	OUT	GET /dhs HTTP/1.1 Host: www.dist113.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Oct 25, 2024 00:38:57.007791042 CEST	338	IN	HTTP/1.1 301 Moved Permanently Server: awselb/2.0 Date: Thu, 24 Oct 2024 22:38:56 GMT Content-Type: text/html Content-Length: 134 Connection: keep-alive Location: https://www.dist113.org:443/dhs Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>
Oct 25, 2024 00:39:42.020113945 CEST	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:38:43 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:38:43 UTC	540	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:38:43 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 23 Oct 2024 06:30:03 GMT ETag: "0x8DCF32C20D7262E" x-ms-request-id: 39f98116-901e-0015-0fb5-25b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T223843Z-16849878b785g992cz2s9gk35c00000008bg00000000cyyk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:38:43 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-24 22:38:43 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-24 22:38:43 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-24 22:38:43 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-24 22:38:44 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-24 22:38:44 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-24 22:38:44 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-24 22:38:44 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-24 22:38:44 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-24 22:38:44 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:38:47 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:38:47 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:38:47 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c4ab37c7-901e-002a-3417-267a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T223847Z-15b8d89586fqj7k5h9gbd8vs9800000000s000000000epu7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:38:47 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:38:47 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:38:47 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:38:47 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 52fc638d-b01e-0070-36c5-201cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T223847Z-16849878b785jsrm4477mv3ezn000000087000000000q5cu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:38:47 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:38:47 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:38:47 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:38:47 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 2f084f0e-501e-0029-2021-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T223847Z-17c5cb586f677284pnx3kebuu400000001q0000000008squ x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:38:47 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://dhs.dist113.org/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 347

Chrome Cache Entry: 348

Chrome Cache Entry: 349

Chrome Cache Entry: 350

Chrome Cache Entry: 351

Chrome Cache Entry: 352

Chrome Cache Entry: 353

Chrome Cache Entry: 354

Chrome Cache Entry: 355

Chrome Cache Entry: 356

Chrome Cache Entry: 357

Chrome Cache Entry: 358

Chrome Cache Entry: 359

Chrome Cache Entry: 360

Chrome Cache Entry: 361

Chrome Cache Entry: 362

Chrome Cache Entry: 363

Chrome Cache Entry: 364

Chrome Cache Entry: 365

Chrome Cache Entry: 366

Chrome Cache Entry: 367

Windows Analysis Report
http://dhs.dist113.org/

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:38:47 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:38:47 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:38:47 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1a9c8bfd-301e-0000-1fee-25eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T223847Z-16849878b78gvgmlcfru6nuc54000000087g00000000mz3q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:38:47 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:38:47 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:38:47 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:38:47 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6b50d5b8-301e-005d-5751-26e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T223847Z-r197bdfb6b4kkrkjudg185sarw00000002f000000000a6wg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 22:38:47 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:38:48 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:38:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:38:48 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: b0d76b6d-d01e-002b-3e84-2525fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T223848Z-16849878b78bkvbz1ry47zvsas00000008f0000000000c88 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:38:48 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:38:48 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:38:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:38:48 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7aa3dd97-101e-005a-6a20-26882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T223848Z-r197bdfb6b4kzncf21qcaynxz800000002fg00000000qtqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:38:48 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:38:48 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:38:48 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:38:48 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: e5fe76b8-601e-0050-2e06-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T223848Z-r197bdfb6b4hsj5bywyqk9r2xw0000000130000000002rht x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:38:48 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:38:48 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:38:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:38:48 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4755be7f-e01e-0052-062b-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T223848Z-16849878b78c2tmb7nhatnd68s00000008f0000000000akz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:38:48 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:38:48 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:38:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:38:48 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 0a92035d-201e-00aa-57da-213928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T223848Z-16849878b78j5kdg3dndgqw0vg00000001a000000000k2ev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:38:48 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:38:50 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:38:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:38:50 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0fe0dd21-c01e-0066-771c-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T223850Z-16849878b78nx5sne3fztmu6xc00000000n000000000d2qq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:38:50 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:38:50 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:38:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:38:50 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 1b2fb3ba-201e-0033-65ce-20b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T223850Z-16849878b78bcpfn2qf7sm6hsn00000001bg000000003my4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:38:50 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Timestamp	Bytes transferred	Direction	Data
2024-10-24 22:38:50 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 22:38:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 22:38:50 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T223850Z-16849878b78gvgmlcfru6nuc54000000087g00000000mza0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 22:38:50 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">