Grok out hex value in URL 6.4.0


(marcus) #1

I'm very new to this, however very keen to learn... I have grokked out the IIS log file that contains exchange active sync data that i want to draw out.. I've tried using urlparam and urldecode with no real success. the string I'm trying to decode is below.

(A)Conn%3a0%2cHangingConn%3a0%2cAD%3a%24null%2f%24null%2f0%25%2cCAS%3a6000%2f4645%2f3%25%2cAB%3a%24null%2f%24null%2f0%25%2cRPC%3a%24null%2f%24null%2f1%25%2cFC%3a1000%2f0%2cPolicy%3aDefaultThrottlingPolicy%5F511d33fa-7b88-4859-94ba-0859891f0d47%2cNorm_