Play interactive tourEdit tour

Windows Analysis Report
https://ncibrokers-my.sharepoint.com/:w:/g/personal/prudence_chang_nci_com_au/EXaCJ-JQmm9KhSRIWRDlfVUBQD8VWGMakiitwEFCoHGPrg?e=4%3aHW5r1V&fromShare=true&at=31

Overview

General Information

Sample URL:	https://ncibrokers-my.sharepoint.com/:w:/g/personal/prudence_chang_nci_com_au/EXaCJ-JQmm9KhSRIWRDlfVUBQD8VWGMakiitwEFCoHGPrg?e=4%3aHW5r1V&fromShare=true&at=31
Analysis ID:	1302499
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML body with high number of embedded SVGs detected

Classification

×

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Phishing

HTML body with high number of embedded SVGs detected

Source: https://auc-word-edit.officeapps.live.com/we/wordeditorframe.aspx?ui=en%2DUS&rs=en%2DUS&wopisrc=https%3A%2F%2Fncibrokers-my.sharepoint.com%2Fpersonal%2Fprudence_chang_nci_com_au%2F_vti_bin%2Fwopi.ashx%2Ffiles%2Fe22782769a504a6f8524485910e57d55&wdenableroaming=1&mscc=0&wdodb=1&hid=93F8D6A0-80DD-2000-8FE8-1EAA137CC93A&wdorigin=Sharing.ClientRedirect&jsapi=1&jsapiver=v1&newsession=1&corrid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&sftc=1&cac=1&mtf=1&sfp=1&instantedit=1&wopicomplete=1&wdredirectionreason=Unified_SingleFlush&rct=Normal&ctp=LeastProtected

HTTP Parser: Total embedded SVG size: 136637

HTML page is missing a favicon

Source: https://store.office.com/anonymousserviceextension.aspx?1d857d26_726167fa_1693783472099#&_disabledChangeGates=%5B%22OfficeVSO%3A7445267_RoamingServiceBaseURLFix%22%2C%22Microsoft.Office.SharedOnline.ChangeGate.UseCopilotEntrypointForDeckGen%22%2C%22Microsoft.Office.SharedOnline.ChangeGate.CanaryChangeGate%22%2C%22Microsoft.Office.SharedOnline.ChangeGate.OfficeVSO_8117458_bUlsUploadsFailingUnexpectedlyHeaderIsEnabled%22%5D&_flights=%5B2%2C22%2C%22Microsoft.Office.SharedOnline.InsertionDialogFixesEnabled%22%2C%22Microsoft.Office.SharedOnline.WopiUseNewActivate%22%2C%22Microsoft.Office.SharedOnline.AddinDetailsServiceSupportEnabled%22%2C%22Microsoft.Office.SharedOnline.GetAddinFlyoutEnabled%22%5D&_serializer_version=1&_xdm_Info=1d857d26_726167fa_1693783472099|__omexExtensionAnonymousProxy|https://auc-word-edit.officeapps.live.com

HTTP Parser: No favicon

Compliance

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_4816_102570404			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4816_703368849			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4816_703368849\ssl_error_assistant.pb			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4816_703368849\manifest.json			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4816_703368849\_metadata\			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4816_703368849\_metadata\verified_contents.json			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4816_703368849\manifest.fingerprint			Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: this.pdb().qSn(T.KQ,T.zBl)),this.G0c=k.ActionManager.Yla)}Tyj(T,X){this.ahf(4);this.Imd=!1;this.Ujc=[];this.Ase=null;T&&!X&&(this.Vtf=!0);this.u4e()}wXm(T){t.a.mark(7147);var X=null;this.P4m&&(X=w.a.instance.tu(U.a.M4m));var V=new u.a(T.lMh,(ea,ha)=>this.xXm(ea,ha),new M(T.hK,T.WJd,X,T.lMh));V.Bq("UpdateAllViews");this.rnh&&(this.aMc=V);V.hl=!this.lJd;X=null;this.lJd||(this.Nig=n.a.qf(),X=this.tIg,this.oTc=!0);V.run();this.oTc&&X&&(V=n.a.qf()-this.Nig,this.oTc&&2E3<=V&&G.ULS.sendTraceTag(579700875, source: chromecache_402.1.dr
Source:	Binary string: void 0===X?void 0:X.suspend(),ea.Yqm());this.odc=this.eHa+1;this.Mtc(V)||(this.j1c=this.Tna+1);this.Xtc(V)&&(this.FCg&&G.ULS.sendTraceTag(17043994,329,50,"CompletingOutermostViewTransaction is not finished."),this.Q7a||(this.GWc=new A.a,this.t4e()),T.pNh&&this.GWc.add(T.pNh),this.r4d=this.Q7a+1);this.Muc(V)&&(this.Vtf&&(this.Vtf=!1,this.pdb()&&this.pdb().EVn()),this.Oae=this.U$a+1,1===this.U$a&&this.pdb()&&(this.Fii=this.pdb().e3a()));this.olc(this.Mtc(V))}}vz(T){var X,V,ea=T.V_b;const ha=this.Xtc(ea)&& source: chromecache_402.1.dr
Source:	Binary string: this.yI=this.zX=null;this.Olm=Ja;this.fr=0}}Object(D.a)(J,"AddSelectionToCollectionArguments",null,[]);var K=c(91);class T{constructor(){this.pVc=this.Rhb=null;this.mpa=this.pDb=!1;this.run=Ja=>{this.mpa=!0;this.Rhb&&this.Rhb(Ja);this.Rhb=null;this.pVc&&this.pVc(Ja);this.pVc=null;this.mpa=this.pDb=!1};this.lQ=new K.a(0,1,16,this.run,42)}$vm(Ja){this.mpa?this.Rhb?this.Rhb=Ja:Ja(this.lQ):(this.Rhb=Ja,this.Vub())}uUg(){this.pDb&&(e.AFrameworkApplication.wc.mf(this.lQ),this.run(this.lQ))}Npj(){this.pDb&& source: chromecache_402.1.dr
Source:	Binary string: 0;this.lJd=!1;this.ta=new e.a;this.QTj=null===(Fa=a.AFrameworkApplication.J)||void 0===Fa?void 0:Fa.getBooleanFeatureGate("Microsoft.Office.WordOnline.DoNotSuppressError",!1);null===(Ea=a.AFrameworkApplication.J)||void 0===Ea||Ea.getBooleanFeatureGate("Microsoft.Office.WordOnline.StopFloatingElementCleanup",!1);this.lFa=!1;this.pdb=T;this.bVd=X;this.v6b=V;this.AKi=ea;this.rYf=ha;this.Iia=oa;this.xOf=qa;this.bJ=ka;this.rtd=this.rtd.bind(this);this.std=this.std.bind(this);this.Yud=this.Yud.bind(this); source: chromecache_402.1.dr
Source:	Binary string: this.hJc||1!==uf.gFe||this.qfb(),this.Wff(Ue),this.BW.ofg()):this.hJc=this.gJb=!1)};this.rbf=this.Ih.Sha;this.Ima=Eg.a.Une;this.nu=this.Ih.nu;this.Ih.w4h()}get Zce(){return this.BW.x_f()}get Ima(){return this.Ih.Ima}set Ima(ja){this.Ih.Ima=ja}get rSh(){return"1"===this.nu.hH.style.opacity}vPj(ja){this.Xod||(this.Xod=!0,this.Ih.nsj(),this.pDb=ja(this.nu.yla,this.Ih.rBj,()=>{this.updatePosition()}),this.Ih.S8i(this.pDb),this.BW.initialize(this.pDb,this),this.Ih.initialize(this.pDb,this.BW.gvb),this.Ih.Pyj(), source: chromecache_444.1.dr
Source:	Binary string: Md;this.lS=Od;this.pDb=null;this.p$e=0;this.CEd=!1;this.bJd=0;this.Y1b=this.Xod=this.y$g=this.hJc=this.gJb=!1;this.qAc=()=>{this.BW.ABg()&&this.Ih.qAc(this.CEd,this.sgg)};this.evb=()=>{this.Ih.vqa.ota()&&(this.ljd(this.Ih.vqa.Jc),this.Ih.vqa.Guc(this.evb))};this.sgg=()=>{this.qfb();this.BW.rgg()};this.vEg=()=>{!this.gJb&&this.BW.OAg()&&(this.bJd=this.rbf.scrollTop,this.gJb=!0,this.W0a.eNa(2))};this.lpg=(Ue,uf)=>{this.gJb&&(Ue=this.rbf.scrollTop,Ue-this.bJd?(this.hJc||uf.gFe||this.updatePosition(), source: chromecache_444.1.dr
Source:	Binary string: (e.AFrameworkApplication.wc.mf(this.lQ),this.pVc=this.Rhb=null,this.pDb=!1)}Vub(){this.pDb?e.AFrameworkApplication.wc.a1(this.lQ,16):(e.AFrameworkApplication.wc.Yb(this.lQ),this.pDb=!0)}}Object(D.a)(T,"DelayedSelectionTask",null,[]);var X=c(369),V=c(306);class ea{constructor(){this.adh=this.Ild=this.ich=this.hasBookmark=this.akh=this.isEmpty=this.Nt=this.Nph=this.$ch=this.h4=this.Q3a=this.ki=!1;this.annotationTypes=[]}}Object(D.a)(ea,"ParagraphTraits",null,[]);class ha{constructor(){}}Object(D.a)(ha, source: chromecache_402.1.dr
Source:	Binary string: !0;this.hJc=this.gJb;this.W0a.eNa(10)}rLf(ja){return this.Ih.kUa({contentAnchorPositions:ja.contentAnchorPositions})}qxf(){this.CEd=!1;if(this.nu.yla&&this.pDb&&this.xi.kBa()){this.Ih.D0d();var ja=0;this.kj.$d(()=>{ja=this.Ih.b5d()},"FCM:UP:GET");var Ta=null,zb=null;this.kj.$d(()=>{const Wb=this.BW.Wti(ja,this.Ih.Ri);Ta=Wb.pul;zb=this.rLf(Wb)},"FCM:UP:GP");this.kj.$d(()=>{this.gJb?(this.Ih.Ehi(zb),this.gJb=!1):this.pDb.emitEvent(3,zb);this.f1.Vre()},"FCM:UP:RC");this.pDb.setFirstCommentRenderDone(); source: chromecache_444.1.dr
Source:	Binary string: this.VDd,this.PDb);ua.removeChild(Ca);Ca=ua.ownerDocument.createElement("div");Ca.id="screenReaderDetectionDiv";Ca.setAttribute(Y.a.Ph,Y.a.vA);Ca.setAttribute(Y.a.uA,Y.a.fq);ua.appendChild(Ca)}get aXa(){return this.VDd}get mWa(){return this.PDb}get QRf(){!this.yTe&&this.VDd&&this.PDb&&this.BJe&&(this.yTe=String.format("{0}_{1}_{2}",this.PDb.A0c,this.PDb.backgroundColor,this.PDb.linkColor));return this.yTe}ozm(ua,Ca,va){let Sa,Ra,ob;const Ya=({Zag:Sa}=this.dJg(ua)).returnValue,vb=({Zag:Ra}=this.dJg(Ca)).returnValue, source: chromecache_345.1.dr
Source:	Binary string: this.eHa-1);this.Iff||(null===(V=this.bVd())||void 0===V?void 0:V.resume(),T.hK.qAg())}else 1<this.eHa&&(this.odc=this.eHa-1)}Yyj(T){this.tjf(!0);this.ahf(3);this.v6b()&&!this.AKi()?K.nq.Je(()=>{this.wXm(T)},"GT:UAV"):(this.zDd(),this.tjf(!1))}zDd(){this.Tna!==this.eHa&&G.ULS.sendTraceTag(38293641,329,15,"Misaligned transaction count view: {0}, total: {1}. Callstack: {3}",this.Tna,this.eHa,h.Debug.Mmb());this.odc=this.j1c=0}Wyj(T){T&&(this.ahf(8),this.pdb()&&(this.pdb().bzh(this.G0c,this.Fii),T.ptc&& source: chromecache_402.1.dr
Source:	Binary string: K,d){d.d(K,"a",function(){return f});J=d(0);K=d(443);var m=d(20);d=d(286);class f extends K.a{constructor(a,l){super(a,l)}get bab(){return!!f.Yg&&f.Yg.bab}Acb(){if(this.$ya.aL())return super.Acb();this.$ya.Xt(this.kob);return!!this.$ya.aL()}shd(a,l){this.yod(a)&&this.$ya.Pdb(a,l)}vhd(a){this.yod(a)&&this.$ya.removeProperty(a)}thd(a,l,w){this.yod(a)&&this.$ya.Pdb(a,w)}yod(a){return!this.Yin(a.flags)||this.bab}Yin(a){return!!(a&2048)}static get Yg(){return null!=f.a5g?f.a5g:f.a5g=m.a.instance.Oa(44)}} source: chromecache_345.1.dr
Source:	Binary string: ba=d(218),X=d(196),Y=d(70),ca=d(170);class ia{constructor(){this.linkColor=this.backgroundColor=this.A0c=null}toString(){return String.format("ForegroundTextColor: {0}, BackgroundColor: {1}, LinkColor: {2}",this.A0c,this.backgroundColor,this.linkColor)}}Object(J.a)(ia,"HighContrastColors",null,[]);var la=d(18);class ta{constructor(ua){this.BJe=!0;this.RPk=RegExp("#[0-9A-Fa-f]{6}");this.yTe=this.PDb=null;this.reh="rgb(50, 50, 50)";this.coh=l.AFrameworkApplication.J.$("HighContrastDetectionMechanism"); source: chromecache_345.1.dr
Source:	Binary string: this.VDd=Ra||ob;Sa&&va||m.ULS.sendTraceTag(25523335,334,50,"HighContrastDetector foregroundBackgroundCurrentStyle is null:[{0}] and linkCurrentStyle is null:[{1}]",!Sa,!va);this.VDd&&(this.PDb=Sa?this.ozm(Sa.color.toLowerCase(),Sa.backgroundColor.toLowerCase(),va.color.toLowerCase()):null,this.BJe||m.ULS.sendTraceTag(19223450,334,15,"We believe the user is in high contrast mode, but encountered an invalid color value (transparent or window)"));m.ULS.sendTraceTag(18458837,334,50,"HighContrastDetector.ctor: IsInHighContrastMode=[{0}], HighContrastColors=[{1}]", source: chromecache_345.1.dr

Networking

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=115.0.5790.171&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-115.0.5790.171Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /:w:/g/personal/prudence_chang_nci_com_au/EXaCJ-JQmm9KhSRIWRDlfVUBQD8VWGMakiitwEFCoHGPrg?e=4%3aHW5r1V&fromShare=true&at=31 HTTP/1.1Host: ncibrokers-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/prudence_chang_nci_com_au/_layouts/15/Doc.aspx?sourcedoc=%7Be2278276-9a50-4a6f-8524-485910e57d55%7D&action=default&fromShare=true&slrid=93f8d6a0-707d-2000-8a76-894cb55a961d&originalPath=aHR0cHM6Ly9uY2licm9rZXJzLW15LnNoYXJlcG9pbnQuY29tLzp3Oi9nL3BlcnNvbmFsL3BydWRlbmNlX2NoYW5nX25jaV9jb21fYXUvRVhhQ0otSlFtbTlLaFNSSVdSRGxmVlVCUUQ4VldHTWFraWl0d0VGQ29IR1ByZz9ydGltZT1ZbFlvNE5TczIwZw&cid=e00a5448-acb7-4754-a2c0-12c50c6468b2 HTTP/1.1Host: ncibrokers-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EzNTZlYTBkNzY3MzQxNjg4YTMzZWM4OWRkNzkyYzliMDUxMzU5MTEyYWNhMGQwZDkxYjhlMmE1MDQwZDQyMWIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiwxMzMzODI1NzM0OTAwMDAwMDAsMCwxMzMzODM0MzQ0OTY2ODQxNjQsMC4wLjAuMCwyNTgsYjQ3ZTQ3YTItNWM1Ni00M2M2LTg1YzQtMTNkMWU2NWExOWVjLCwsOTNmOGQ2YTAtNzA3ZC0yMDAwLThhNzYtODk0Y2I1NWE5NjFkLDkzZjhkNmEwLTcwN2QtMjAwMC04YTc2LTg5NGNiNTVhOTYxZCxDWkdON3FHUVUwK2lmaitoVjRXeWx3LDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTU1NTUsR0FkeFdYM3FnLXBsUDRlOVhCUDF5MTZpZmpVLGdOdkcydk5qNVV4Ky9WZmR0MUVRbnBTQkJBdTh1WFhOVGJVemh4Uy9FQWxnUXNJc1lNOXg2VGdUWnpncmJqMkQ0VXY3d0cvUFV4Yk9KbDdHTTdvQXd0eFRXUTNMWTlBVUpUN2tPQ0trb3U0T0ZYL0xlZStybkl0c0RPN0lrdFdRdmswbm5aUEhaM2tvVm12K29sY2piNklDVWc0U09UWjJvNURQZ0JnOUNnQ1JYMTk0ZDZoM3RzQ3NlYkNrOTJ3MG44WXVQOEhCajIwdkIxQTlGYnloTG5MRFhNUGtHL24yQmlLRy9aRmpUZU5mczZPQ0FuaytDb0VMMmRJMjBoZjVHTlAvNlluV1FEUEh5MHk3UW9HTjhWMnJDeVBMRDU0MjZxbWpyaUhXWUg1MDRPUDgwc3Y0eFZkNEhoZ2RSOFVOZzRYNkt4eWxIUHhjUEpncTZXVWhNdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /we/OneNote.ashx?perfTag=GetCells_1&GetCellsBootstrapper=1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Source: global traffic	HTTP traffic detected: GET /we/RemoteTelemetry.ashx?usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&build=16.0.16830.41006&waccluster=GAU1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Source: global traffic	HTTP traffic detected: GET /we/RemoteTelemetry.ashx?usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&build=16.0.16830.41006&waccluster=GAU1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Source: global traffic	HTTP traffic detected: GET /we/RemoteTelemetry.ashx?usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&build=16.0.16830.41006&waccluster=GAU1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Source: global traffic	HTTP traffic detected: GET /we/RemoteTelemetry.ashx?usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&build=16.0.16830.41006&waccluster=GAU1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Source: global traffic	HTTP traffic detected: GET /we/OneNote.ashx?perfTag=UserSessionDataUpdate HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1
Source: global traffic	HTTP traffic detected: GET /we/OneNote.ashx?perfTag=HotStoreStatus_1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1
Source: global traffic	HTTP traffic detected: GET /we/RemoteTelemetry.ashx?usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&build=16.0.16830.41006&waccluster=GAU1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Source: global traffic	HTTP traffic detected: GET /afhs/CloudPolicySettings.ashx HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"X-WacFrontEnd: SY3PEPF00001BEAX-OfficeVersion: 16.0.16830.41006X-Key: 8Eu3srxZ3WuJdM2f+sA9t7pJwg0Q1IPPnGuNV3eT+Dw=,638293802530127526x-OcpsIsEnabled: trueX-Requested-With: XMLHttpRequestX-xhr: 1x-CacheIsEnabled: falsex-LicensingAADIdIsEnabled: falsesec-ch-ua-platform: "Windows"haep: 6X-AccessToken: eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IkdBZHhXWDNxZy1wbFA0ZTlYQlAxeTE2aWZqVSJ9.eyJhdWQiOiJ3b3BpL25jaWJyb2tlcnMtbXkuc2hhcmVwb2ludC5jb21AYjQ3ZTQ3YTItNWM1Ni00M2M2LTg1YzQtMTNkMWU2NWExOWVjIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwQDkwMTQwMTIyLTg1MTYtMTFlMS04ZWZmLTQ5MzA0OTI0MDE5YiIsIm5iZiI6IjE2OTM3ODM0NTEiLCJleHAiOiIxNjkzODE5NDUxIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsIm5paSI6Im1pY3Jvc29mdC5zaGFyZXBvaW50IiwiaXN1c2VyIjoidHJ1ZSIsImNhY2hla2V5IjoiMGguZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsInNoYXJpbmdpZCI6IkNaR043cUdRVTAraWZqK2hWNFd5bHciLCJpc2xvb3BiYWNrIjoiVHJ1ZSIsImFwcGN0eCI6ImUyMjc4Mjc2OWE1MDRhNmY4NTI0NDg1OTEwZTU3ZDU1O2R5TW4zakFsUzdFU0E1ZUpGZ3FNNkFteDh0ST07RGVmYXVsdDtkODhhMjQzN2IyMWQ0OTNiYjZhMjExMzNkY2NkMWE0Njs7VHJ1ZTs7OzA7OTNmOGQ2YTAtODBkZC0yMDAwLThmZTgtMWVhYTEzN2NjOTNhIiwiZmlkIjoiMTk1NTU1In0.luSZ1grXrmE9y_48hR5MGPEE9d7-M4ccdxVZ5fi7bsCfGDhiBte9-kNk3Nm3VnJOTcra96qR2-Xx_9frkXQ7oVtu8I_3Nu0vaNXukWjswWdBTw2NDrF0XX6twQMqVffHB9N4VOC55hR9hULhpxYDYsQzKaxCitXpD2wSHIR9qAnX-Dsp_GRWzzIzmBe3l5yixyY5B-r-6tY-yH-VTY2jXi1Qk07FfX922DhhL7G6MZsNTTqag6FubT4G1ilkGrZHT61NBj2pJvskSa5hffGgojL1crA1E4OIvxbLp9REwBHiVZ5cnCk4ZFZ0rjPT5NgmVOwYKSugVd6cFPPU-P2H8wX-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edX-AccessTokenTtl: 1693819451127sec-ch-ua-mobile: ?0x-UserDataSignature: eyJhbGciOiJSUzI1NiIsImtpZCI6IjNCQ0Q3NEFBNjI2MDVEQUYwQjg0Nzk2RTFDOTcyQUQ5MTQ1QjY2NDciLCJ4NXQiOiJPODEwcW1KZ1hhOExoSGx1SEpjcTJSUmJaa2MiLCJ0eXAiOiJKV1QifQ.eyJVUE4iOiJ1cm46c3BvOmFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsIlBVSUQiOiIiLCJUZW5hbnRJZCI6ImI0N2U0N2EyLTVjNTYtNDNjNi04NWM0LTEzZDFlNjVhMTllYyIsIkZpbGVUZW5hbnRJZCI6IiIsIklzQ29uc3VtZXJVc2VyIjoiRmFsc2UiLCJJc0Fub255bW91c1VzZXIiOiJUcnVlIiwiSG9zdEVuYWJsZWRGZWF0dXJlcyI6IltdIiwiSXNPMzY1Q29uc3VtZXJIb3N0IjoiRmFsc2UiLCJJc08zNjVDb21tZXJjaWFsSG9zdCI6IlRydWUiLCJVc2VyT2JqZWN0SWQiOiIiLCJMb2NhbFN0b3JhZ2VLZXkiOiIzemFCcHpLMGRoVjBjanZHWkhqeFBvQjJGb3htMG5qaHhFUWY2d20rdVVnPSIsIm5iZiI6MTY5Mzc4MzQ1MywiZXhwIjoxNjkzNzg0NzczLCJpYXQiOjE2OTM3ODM0NTMsImlzcyI6IldBQyJ9.FZ0tIeUFA2_Stcm77dSVsEkbgpzE5ltNLrwcyQ1QLx6gHm5lbUzt8zjAobEFxarJ_KTJ3oLkIM-mEeei0peutJG4H9X3ViVzXyuT-LHtVkXlbY4T4gv5e8X_5TL2Wn62nrWgEGjNVDSlcE_KoR9jltnoZ_gTI1GcechZYueBsyOBAn9DpCYJ986YrRa3uTuu3H-k662imuslfOfCR61ypTQ1oOjOZ43odt7kAjJ7bTX2Bj6RFMHXc17Hg6-J
Source: global traffic	HTTP traffic detected: GET /we/App_Scripts/Acl/Acl1033.js HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"X-WacFrontEnd: SY3PEPF00001BEAX-OfficeVersion: 16.0.16830.41006X-Key: 8Eu3srxZ3WuJdM2f+sA9t7pJwg0Q1IPPnGuNV3eT+Dw=,638293802530127526X-Requested-With: XMLHttpRequestX-xhr: 1sec-ch-ua-platform: "Windows"haep: 6X-AccessToken: eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IkdBZHhXWDNxZy1wbFA0ZTlYQlAxeTE2aWZqVSJ9.eyJhdWQiOiJ3b3BpL25jaWJyb2tlcnMtbXkuc2hhcmVwb2ludC5jb21AYjQ3ZTQ3YTItNWM1Ni00M2M2LTg1YzQtMTNkMWU2NWExOWVjIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwQDkwMTQwMTIyLTg1MTYtMTFlMS04ZWZmLTQ5MzA0OTI0MDE5YiIsIm5iZiI6IjE2OTM3ODM0NTEiLCJleHAiOiIxNjkzODE5NDUxIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsIm5paSI6Im1pY3Jvc29mdC5zaGFyZXBvaW50IiwiaXN1c2VyIjoidHJ1ZSIsImNhY2hla2V5IjoiMGguZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsInNoYXJpbmdpZCI6IkNaR043cUdRVTAraWZqK2hWNFd5bHciLCJpc2xvb3BiYWNrIjoiVHJ1ZSIsImFwcGN0eCI6ImUyMjc4Mjc2OWE1MDRhNmY4NTI0NDg1OTEwZTU3ZDU1O2R5TW4zakFsUzdFU0E1ZUpGZ3FNNkFteDh0ST07RGVmYXVsdDtkODhhMjQzN2IyMWQ0OTNiYjZhMjExMzNkY2NkMWE0Njs7VHJ1ZTs7OzA7OTNmOGQ2YTAtODBkZC0yMDAwLThmZTgtMWVhYTEzN2NjOTNhIiwiZmlkIjoiMTk1NTU1In0.luSZ1grXrmE9y_48hR5MGPEE9d7-M4ccdxVZ5fi7bsCfGDhiBte9-kNk3Nm3VnJOTcra96qR2-Xx_9frkXQ7oVtu8I_3Nu0vaNXukWjswWdBTw2NDrF0XX6twQMqVffHB9N4VOC55hR9hULhpxYDYsQzKaxCitXpD2wSHIR9qAnX-Dsp_GRWzzIzmBe3l5yixyY5B-r-6tY-yH-VTY2jXi1Qk07FfX922DhhL7G6MZsNTTqag6FubT4G1ilkGrZHT61NBj2pJvskSa5hffGgojL1crA1E4OIvxbLp9REwBHiVZ5cnCk4ZFZ0rjPT5NgmVOwYKSugVd6cFPPU-P2H8wX-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edX-AccessTokenTtl: 1693819451127sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36X-UserType: WOPIX-IsCoauthSession: falseX-WacCluster: GAU2Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://auc-word-edit.officeapps.live.com/we/wordeditorframe.aspx?ui=en%2DUS&rs=en%2DUS&wopisrc=https%3A%2F%2Fncibrokers-my.sharepoint.com%2Fpersonal%2Fprudence_chang_nci_com_au%2F_vti_bin%2Fwopi.ashx%2Ffiles%2Fe22782769a504a6f8524485910e57d55&wdenableroaming=1&mscc=0&wdodb=1&hid=93F8D6A0-80DD-2000-8FE8-1EAA137CC93A&wdorigin=Sharing.ClientRedirect&jsapi=1&jsapiver=v1&newsession=1&corrid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&sftc=1&cac=1&mtf=1&sfp=1&instantedit=1&wopicomplete=1&wdredirectionreason=Unified_SingleFlush&rct=Normal&ctp=LeastProtectedAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=00000000000000000000000000000000000000000000000000000000000000000000000000
Source: global traffic	HTTP traffic detected: GET /we/RoamingServiceHandler.ashx?action=getAutoCorrectOptionsSettings&WOPIsrc=https%3A%2F%2Fncibrokers%2Dmy%2Esharepoint%2Ecom%2Fpersonal%2Fprudence%5Fchang%5Fnci%5Fcom%5Fau%2F%5Fvti%5Fbin%2Fwopi%2Eashx%2Ffiles%2Fe22782769a504a6f8524485910e57d55&access_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IkdBZHhXWDNxZy1wbFA0ZTlYQlAxeTE2aWZqVSJ9.eyJhdWQiOiJ3b3BpL25jaWJyb2tlcnMtbXkuc2hhcmVwb2ludC5jb21AYjQ3ZTQ3YTItNWM1Ni00M2M2LTg1YzQtMTNkMWU2NWExOWVjIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwQDkwMTQwMTIyLTg1MTYtMTFlMS04ZWZmLTQ5MzA0OTI0MDE5YiIsIm5iZiI6IjE2OTM3ODM0NTEiLCJleHAiOiIxNjkzODE5NDUxIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsIm5paSI6Im1pY3Jvc29mdC5zaGFyZXBvaW50IiwiaXN1c2VyIjoidHJ1ZSIsImNhY2hla2V5IjoiMGguZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsInNoYXJpbmdpZCI6IkNaR043cUdRVTAraWZqK2hWNFd5bHciLCJpc2xvb3BiYWNrIjoiVHJ1ZSIsImFwcGN0eCI6ImUyMjc4Mjc2OWE1MDRhNmY4NTI0NDg1OTEwZTU3ZDU1O2R5TW4zakFsUzdFU0E1ZUpGZ3FNNkFteDh0ST07RGVmYXVsdDtkODhhMjQzN2IyMWQ0OTNiYjZhMjExMzNkY2NkMWE0Njs7VHJ1ZTs7OzA7OTNmOGQ2YTAtODBkZC0yMDAwLThmZTgtMWVhYTEzN2NjOTNhIiwiZmlkIjoiMTk1NTU1In0.luSZ1grXrmE9y_48hR5MGPEE9d7-M4ccdxVZ5fi7bsCfGDhiBte9-kNk3Nm3VnJOTcra96qR2-Xx_9frkXQ7oVtu8I_3Nu0vaNXukWjswWdBTw2NDrF0XX6twQMqVffHB9N4VOC55hR9hULhpxYDYsQzKaxCitXpD2wSHIR9qAnX-Dsp_GRWzzIzmBe3l5yixyY5B-r-6tY-yH-VTY2jXi1Qk07FfX922DhhL7G6MZsNTTqag6FubT4G1ilkGrZHT61NBj2pJvskSa5hffGgojL1crA1E4OIvxbLp9REwBHiVZ5cnCk4ZFZ0rjPT5NgmVOwYKSugVd6cFPPU-P2H8w&access_token_ttl=1693819451751&requestedSettings=ReplaceTextAsYouType;CapitalizeFirstLetterOfSentences;ReplaceOrdianalsWithSuperscript;ReplaceHyphensWithDash;ReplaceFractionsWithFractionCharacter;ReplaceQuoteWithSmartQuote HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"haep: 6X-WacFrontEnd: SY3PEPF00001BEAX-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edsec-ch-ua-mobile: ?0X-OfficeVersion: 16.0.16830.41006X-Key: 8Eu3srxZ3WuJdM2f+sA9t7pJwg0Q1IPPnGuNV3eT+Dw=,638293802530127526User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestX-UserType: WOPIX-xhr: 1X-IsCoauthSession: falseX-WacCluster: GAU2sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://auc-word-edit.officeapps.live.com/we/wordeditorframe.aspx?ui=en%2DUS&rs=en%2DUS&wopisrc=https%3A%2F%2Fncibrokers-my.sharepoint.com%2Fpersonal%2Fprudence_chang_nci_com_au%2F_vti_bin%2Fwopi.ashx%2Ffiles%2Fe22782769a504a6f8524485910e57d55&wdenableroaming=1&mscc=0&wdodb=1&hid=93F8D6A0-80DD-2000-8FE8-1EAA137CC93A&wdorigin=Sharing.ClientRedirect&jsapi=1&jsapiver=v1&newsession=1&corrid=5b655ac8-0896-4c45-a8d6-6dd5
Source: global traffic	HTTP traffic detected: GET /we/RoamingServiceHandler.ashx?action=getProofingGrammarSettings&WOPIsrc=https%3A%2F%2Fncibrokers%2Dmy%2Esharepoint%2Ecom%2Fpersonal%2Fprudence%5Fchang%5Fnci%5Fcom%5Fau%2F%5Fvti%5Fbin%2Fwopi%2Eashx%2Ffiles%2Fe22782769a504a6f8524485910e57d55&access_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IkdBZHhXWDNxZy1wbFA0ZTlYQlAxeTE2aWZqVSJ9.eyJhdWQiOiJ3b3BpL25jaWJyb2tlcnMtbXkuc2hhcmVwb2ludC5jb21AYjQ3ZTQ3YTItNWM1Ni00M2M2LTg1YzQtMTNkMWU2NWExOWVjIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwQDkwMTQwMTIyLTg1MTYtMTFlMS04ZWZmLTQ5MzA0OTI0MDE5YiIsIm5iZiI6IjE2OTM3ODM0NTEiLCJleHAiOiIxNjkzODE5NDUxIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsIm5paSI6Im1pY3Jvc29mdC5zaGFyZXBvaW50IiwiaXN1c2VyIjoidHJ1ZSIsImNhY2hla2V5IjoiMGguZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsInNoYXJpbmdpZCI6IkNaR043cUdRVTAraWZqK2hWNFd5bHciLCJpc2xvb3BiYWNrIjoiVHJ1ZSIsImFwcGN0eCI6ImUyMjc4Mjc2OWE1MDRhNmY4NTI0NDg1OTEwZTU3ZDU1O2R5TW4zakFsUzdFU0E1ZUpGZ3FNNkFteDh0ST07RGVmYXVsdDtkODhhMjQzN2IyMWQ0OTNiYjZhMjExMzNkY2NkMWE0Njs7VHJ1ZTs7OzA7OTNmOGQ2YTAtODBkZC0yMDAwLThmZTgtMWVhYTEzN2NjOTNhIiwiZmlkIjoiMTk1NTU1In0.luSZ1grXrmE9y_48hR5MGPEE9d7-M4ccdxVZ5fi7bsCfGDhiBte9-kNk3Nm3VnJOTcra96qR2-Xx_9frkXQ7oVtu8I_3Nu0vaNXukWjswWdBTw2NDrF0XX6twQMqVffHB9N4VOC55hR9hULhpxYDYsQzKaxCitXpD2wSHIR9qAnX-Dsp_GRWzzIzmBe3l5yixyY5B-r-6tY-yH-VTY2jXi1Qk07FfX922DhhL7G6MZsNTTqag6FubT4G1ilkGrZHT61NBj2pJvskSa5hffGgojL1crA1E4OIvxbLp9REwBHiVZ5cnCk4ZFZ0rjPT5NgmVOwYKSugVd6cFPPU-P2H8w&access_token_ttl=1693819451751&requestedSettings=ProofingSettingsCritiqueTypes HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"haep: 6X-WacFrontEnd: SY3PEPF00001BD6X-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edsec-ch-ua-mobile: ?0X-OfficeVersion: 16.0.16830.41006X-Key: 8Eu3srxZ3WuJdM2f+sA9t7pJwg0Q1IPPnGuNV3eT+Dw=,638293802530127526User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestX-UserType: WOPIX-xhr: 1X-IsCoauthSession: falseX-WacCluster: GAU2sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://auc-word-edit.officeapps.live.com/we/wordeditorframe.aspx?ui=en%2DUS&rs=en%2DUS&wopisrc=https%3A%2F%2Fncibrokers-my.sharepoint.com%2Fpersonal%2Fprudence_chang_nci_com_au%2F_vti_bin%2Fwopi.ashx%2Ffiles%2Fe22782769a504a6f8524485910e57d55&wdenableroaming=1&mscc=0&wdodb=1&hid=93F8D6A0-80DD-2000-8FE8-1EAA137CC93A&wdorigin=Sharing.ClientRedirect&jsapi=1&jsapiver=v1&newsession=1&corrid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&sftc=1&cac=1&mtf=1&sfp=1&instantedit=1&wopicomplete=1&wdredirectionreason=Unified_SingleFlush&rc
Source: global traffic	HTTP traffic detected: GET /we/RemoteTelemetry.ashx?usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&build=16.0.16830.41006&waccluster=GAU1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6
Source: global traffic	HTTP traffic detected: GET /we/App_Scripts/Acl/Acl1033.js HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6
Source: global traffic	HTTP traffic detected: GET /afhs/CloudPolicySettings.ashx HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6
Source: global traffic	HTTP traffic detected: GET /we/RemoteTelemetry.ashx?usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&build=16.0.16830.41006&waccluster=GAU1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6
Source: global traffic	HTTP traffic detected: GET /we/people.ashx?oid=3&bdqs=WOPIsrc%3Dhttps%253A%252F%252Fncibrokers%252Dmy%252Esharepoint%252Ecom%252Fpersonal%252Fprudence%255Fchang%255Fnci%255Fcom%255Fau%252F%255Fvti%255Fbin%252Fwopi%252Eashx%252Ffiles%252Fe22782769a504a6f8524485910e57d55%26access_token%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IkdBZHhXWDNxZy1wbFA0ZTlYQlAxeTE2aWZqVSJ9%252EeyJhdWQiOiJ3b3BpL25jaWJyb2tlcnMtbXkuc2hhcmVwb2ludC5jb21AYjQ3ZTQ3YTItNWM1Ni00M2M2LTg1YzQtMTNkMWU2NWExOWVjIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwQDkwMTQwMTIyLTg1MTYtMTFlMS04ZWZmLTQ5MzA0OTI0MDE5YiIsIm5iZiI6IjE2OTM3ODM0NTEiLCJleHAiOiIxNjkzODE5NDUxIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsIm5paSI6Im1pY3Jvc29mdC5zaGFyZXBvaW50IiwiaXN1c2VyIjoidHJ1ZSIsImNhY2hla2V5IjoiMGguZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsInNoYXJpbmdpZCI6IkNaR043cUdRVTAraWZqK2hWNFd5bHciLCJpc2xvb3BiYWNrIjoiVHJ1ZSIsImFwcGN0eCI6ImUyMjc4Mjc2OWE1MDRhNmY4NTI0NDg1OTEwZTU3ZDU1O2R5TW4zakFsUzdFU0E1ZUpGZ3FNNkFteDh0ST07RGVmYXVsdDtkODhhMjQzN2IyMWQ0OTNiYjZhMjExMzNkY2NkMWE0Njs7VHJ1ZTs7OzA7OTNmOGQ2YTAtODBkZC0yMDAwLThmZTgtMWVhYTEzN2NjOTNhIiwiZmlkIjoiMTk1NTU1In0%252EluSZ1grXrmE9y%255F48hR5MGPEE9d7%252DM4ccdxVZ5fi7bsCfGDhiBte9%252DkNk3Nm3VnJOTcra96qR2%252DXx%255F9frkXQ7oVtu8I%255F3Nu0vaNXukWjswWdBTw2NDrF0XX6twQMqVffHB9N4VOC55hR9hULhpxYDYsQzKaxCitXpD2wSHIR9qAnX%252DDsp%255FGRWzzIzmBe3l5yixyY5B%252Dr%252D6tY%252DyH%252DVTY2jXi1Qk07FfX922DhhL7G6MZsNTTqag6FubT4G1ilkGrZHT61NBj2pJvskSa5hffGgojL1crA1E4OIvxbLp9REwBHiVZ5cnCk4ZFZ0rjPT5NgmVOwYKSugVd6cFPPU%252DP2H8w%26access_token_ttl%3D1693819451127&uid=undefined&p=O365&usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&WacUserType=WOPI HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://auc-word-edit.officeapps.live.com/we/wordeditorframe.aspx?ui=en%2DUS&rs=en%2DUS&wopisrc=https%3A%2F%2Fncibrokers-my.sharepoint.com%2Fpersonal%2Fprudence_chang_nci_com_au%2F_vti_bin%2Fwopi.ashx%2Ffiles%2Fe22782769a504a6f8524485910e57d55&wdenableroaming=1&mscc=0&wdodb=1&hid=93F8D6A0-80DD-2000-8FE8-1EAA137CC93A&wdorigin=Sharing.ClientRedirect&jsapi=1&jsapiver=v1&newsession=1&corrid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&sftc=1&cac=1&mtf=1&sfp=1&instantedit=1&wopicomplete=1&wdredirectionreason=Unified_SingleFlush&rct=Normal&ctp=LeastProtectedAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovemen
Source: global traffic	HTTP traffic detected: GET /we/RemoteTelemetry.ashx?usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&build=16.0.16830.41006&waccluster=GAU1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6
Source: global traffic	HTTP traffic detected: GET /mydata/myprofile/expressionprofile/profilephoto:UserTileStatic,UserTileSmall/MeControlMediumUserTile?ck=1&ex=24&fofoff=1&sc=1693783468452 HTTP/1.1Host: storage.live.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://auc-word-edit.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /we/OneNote.ashx?perfTag=GetChanges_1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6; GAU1-ARRAffinity=2496a0fb080ddc1ba306d6d8a04d9a447ac9908c79b61c3d5b7e411eadcfa9cf
Source: global traffic	HTTP traffic detected: GET /we/AddinServiceHandler.ashx?action=laststoreupdate&app=3&lc=EN-US&WOPIsrc=https%3A%2F%2Fncibrokers%2Dmy%2Esharepoint%2Ecom%2Fpersonal%2Fprudence%5Fchang%5Fnci%5Fcom%5Fau%2F%5Fvti%5Fbin%2Fwopi%2Eashx%2Ffiles%2Fe22782769a504a6f8524485910e57d55&access_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IkdBZHhXWDNxZy1wbFA0ZTlYQlAxeTE2aWZqVSJ9.eyJhdWQiOiJ3b3BpL25jaWJyb2tlcnMtbXkuc2hhcmVwb2ludC5jb21AYjQ3ZTQ3YTItNWM1Ni00M2M2LTg1YzQtMTNkMWU2NWExOWVjIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwQDkwMTQwMTIyLTg1MTYtMTFlMS04ZWZmLTQ5MzA0OTI0MDE5YiIsIm5iZiI6IjE2OTM3ODM0NTEiLCJleHAiOiIxNjkzODE5NDUxIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsIm5paSI6Im1pY3Jvc29mdC5zaGFyZXBvaW50IiwiaXN1c2VyIjoidHJ1ZSIsImNhY2hla2V5IjoiMGguZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsInNoYXJpbmdpZCI6IkNaR043cUdRVTAraWZqK2hWNFd5bHciLCJpc2xvb3BiYWNrIjoiVHJ1ZSIsImFwcGN0eCI6ImUyMjc4Mjc2OWE1MDRhNmY4NTI0NDg1OTEwZTU3ZDU1O2R5TW4zakFsUzdFU0E1ZUpGZ3FNNkFteDh0ST07RGVmYXVsdDtkODhhMjQzN2IyMWQ0OTNiYjZhMjExMzNkY2NkMWE0Njs7VHJ1ZTs7OzA7OTNmOGQ2YTAtODBkZC0yMDAwLThmZTgtMWVhYTEzN2NjOTNhIiwiZmlkIjoiMTk1NTU1In0.luSZ1grXrmE9y_48hR5MGPEE9d7-M4ccdxVZ5fi7bsCfGDhiBte9-kNk3Nm3VnJOTcra96qR2-Xx_9frkXQ7oVtu8I_3Nu0vaNXukWjswWdBTw2NDrF0XX6twQMqVffHB9N4VOC55hR9hULhpxYDYsQzKaxCitXpD2wSHIR9qAnX-Dsp_GRWzzIzmBe3l5yixyY5B-r-6tY-yH-VTY2jXi1Qk07FfX922DhhL7G6MZsNTTqag6FubT4G1ilkGrZHT61NBj2pJvskSa5hffGgojL1crA1E4OIvxbLp9REwBHiVZ5cnCk4ZFZ0rjPT5NgmVOwYKSugVd6cFPPU-P2H8w&access_token_ttl=1693819451751 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"haep: 6X-WacFrontEnd: SY3PEPF00001BD6X-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edsec-ch-ua-mobile: ?0X-OfficeVersion: 16.0.16830.41006X-Key: 8Eu3srxZ3WuJdM2f+sA9t7pJwg0Q1IPPnGuNV3eT+Dw=,638293802530127526User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestX-UserType: WOPIX-xhr: 1X-IsCoauthSession: trueX-WacCluster: GAU2sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://auc-word-edit.officeapps.live.com/we/wordeditorframe.aspx?ui=en%2DUS&rs=en%2DUS&wopisrc=https%3A%2F%2Fncibrokers-my.sharepoint.com%2Fpersonal%2Fprudence_chang_nci_com_au%2F_vti_bin%2Fwopi.ashx%2Ffiles%2Fe22782769a504a6f8524485910e57d55&wdenableroaming=1&mscc=0&wdodb=1&hid=93F8D6A0-80DD-2000-8FE8-1EAA137CC93A&wdorigin=Sharing.ClientRedirect&jsapi=1&jsapiver=v1&newsession=1&corrid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&sftc=1&cac=1&mtf=1&sfp=1&instantedit=1&wopicomplete=1&wdredirectionreason=Unified_SingleFlush&rct=Normal&ctp=LeastProtectedAccept-Encoding: g
Source: global traffic	HTTP traffic detected: GET /we/AddinServiceHandler.ashx?action=getUserId&app=word&corr=abeac5d5-a812-bf67-d033-2e4877fc293d&WOPIsrc=https%3A%2F%2Fncibrokers%2Dmy%2Esharepoint%2Ecom%2Fpersonal%2Fprudence%5Fchang%5Fnci%5Fcom%5Fau%2F%5Fvti%5Fbin%2Fwopi%2Eashx%2Ffiles%2Fe22782769a504a6f8524485910e57d55&access_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IkdBZHhXWDNxZy1wbFA0ZTlYQlAxeTE2aWZqVSJ9.eyJhdWQiOiJ3b3BpL25jaWJyb2tlcnMtbXkuc2hhcmVwb2ludC5jb21AYjQ3ZTQ3YTItNWM1Ni00M2M2LTg1YzQtMTNkMWU2NWExOWVjIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwQDkwMTQwMTIyLTg1MTYtMTFlMS04ZWZmLTQ5MzA0OTI0MDE5YiIsIm5iZiI6IjE2OTM3ODM0NTEiLCJleHAiOiIxNjkzODE5NDUxIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsIm5paSI6Im1pY3Jvc29mdC5zaGFyZXBvaW50IiwiaXN1c2VyIjoidHJ1ZSIsImNhY2hla2V5IjoiMGguZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsInNoYXJpbmdpZCI6IkNaR043cUdRVTAraWZqK2hWNFd5bHciLCJpc2xvb3BiYWNrIjoiVHJ1ZSIsImFwcGN0eCI6ImUyMjc4Mjc2OWE1MDRhNmY4NTI0NDg1OTEwZTU3ZDU1O2R5TW4zakFsUzdFU0E1ZUpGZ3FNNkFteDh0ST07RGVmYXVsdDtkODhhMjQzN2IyMWQ0OTNiYjZhMjExMzNkY2NkMWE0Njs7VHJ1ZTs7OzA7OTNmOGQ2YTAtODBkZC0yMDAwLThmZTgtMWVhYTEzN2NjOTNhIiwiZmlkIjoiMTk1NTU1In0.luSZ1grXrmE9y_48hR5MGPEE9d7-M4ccdxVZ5fi7bsCfGDhiBte9-kNk3Nm3VnJOTcra96qR2-Xx_9frkXQ7oVtu8I_3Nu0vaNXukWjswWdBTw2NDrF0XX6twQMqVffHB9N4VOC55hR9hULhpxYDYsQzKaxCitXpD2wSHIR9qAnX-Dsp_GRWzzIzmBe3l5yixyY5B-r-6tY-yH-VTY2jXi1Qk07FfX922DhhL7G6MZsNTTqag6FubT4G1ilkGrZHT61NBj2pJvskSa5hffGgojL1crA1E4OIvxbLp9REwBHiVZ5cnCk4ZFZ0rjPT5NgmVOwYKSugVd6cFPPU-P2H8w&access_token_ttl=1693819451751 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"haep: 6X-WacFrontEnd: SY3PEPF00001BD6X-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edsec-ch-ua-mobile: ?0X-OfficeVersion: 16.0.16830.41006X-Key: 8Eu3srxZ3WuJdM2f+sA9t7pJwg0Q1IPPnGuNV3eT+Dw=,638293802530127526User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36X-Requested-With: XMLHttpRequestX-UserType: WOPIX-xhr: 1X-IsCoauthSession: trueX-WacCluster: GAU2sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://auc-word-edit.officeapps.live.com/we/wordeditorframe.aspx?ui=en%2DUS&rs=en%2DUS&wopisrc=https%3A%2F%2Fncibrokers-my.sharepoint.com%2Fpersonal%2Fprudence_chang_nci_com_au%2F_vti_bin%2Fwopi.ashx%2Ffiles%2Fe22782769a504a6f8524485910e57d55&wdenableroaming=1&mscc=0&wdodb=1&hid=93F8D6A0-80DD-2000-8FE8-1EAA137CC93A&wdorigin=Sharing.ClientRedirect&jsapi=1&jsapiver=v1&newsession=1&corrid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&sftc=1&cac=1&mtf=1&sfp=1&instantedit=1&wopicomplete=1&wdredirectionreason=Unified_SingleFlush&rct=Normal&ctp=Leas
Source: global traffic	HTTP traffic detected: GET /we/PolicyHandler.ashx?action=datalosspolicy&WOPIsrc=https%3A%2F%2Fncibrokers%2Dmy%2Esharepoint%2Ecom%2Fpersonal%2Fprudence%5Fchang%5Fnci%5Fcom%5Fau%2F%5Fvti%5Fbin%2Fwopi%2Eashx%2Ffiles%2Fe22782769a504a6f8524485910e57d55&access_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IkdBZHhXWDNxZy1wbFA0ZTlYQlAxeTE2aWZqVSJ9.eyJhdWQiOiJ3b3BpL25jaWJyb2tlcnMtbXkuc2hhcmVwb2ludC5jb21AYjQ3ZTQ3YTItNWM1Ni00M2M2LTg1YzQtMTNkMWU2NWExOWVjIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwQDkwMTQwMTIyLTg1MTYtMTFlMS04ZWZmLTQ5MzA0OTI0MDE5YiIsIm5iZiI6IjE2OTM3ODM0NTEiLCJleHAiOiIxNjkzODE5NDUxIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsIm5paSI6Im1pY3Jvc29mdC5zaGFyZXBvaW50IiwiaXN1c2VyIjoidHJ1ZSIsImNhY2hla2V5IjoiMGguZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsInNoYXJpbmdpZCI6IkNaR043cUdRVTAraWZqK2hWNFd5bHciLCJpc2xvb3BiYWNrIjoiVHJ1ZSIsImFwcGN0eCI6ImUyMjc4Mjc2OWE1MDRhNmY4NTI0NDg1OTEwZTU3ZDU1O2R5TW4zakFsUzdFU0E1ZUpGZ3FNNkFteDh0ST07RGVmYXVsdDtkODhhMjQzN2IyMWQ0OTNiYjZhMjExMzNkY2NkMWE0Njs7VHJ1ZTs7OzA7OTNmOGQ2YTAtODBkZC0yMDAwLThmZTgtMWVhYTEzN2NjOTNhIiwiZmlkIjoiMTk1NTU1In0.luSZ1grXrmE9y_48hR5MGPEE9d7-M4ccdxVZ5fi7bsCfGDhiBte9-kNk3Nm3VnJOTcra96qR2-Xx_9frkXQ7oVtu8I_3Nu0vaNXukWjswWdBTw2NDrF0XX6twQMqVffHB9N4VOC55hR9hULhpxYDYsQzKaxCitXpD2wSHIR9qAnX-Dsp_GRWzzIzmBe3l5yixyY5B-r-6tY-yH-VTY2jXi1Qk07FfX922DhhL7G6MZsNTTqag6FubT4G1ilkGrZHT61NBj2pJvskSa5hffGgojL1crA1E4OIvxbLp9REwBHiVZ5cnCk4ZFZ0rjPT5NgmVOwYKSugVd6cFPPU-P2H8w&access_token_ttl=1693819451751 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"hascn: 1X-WacFrontEnd: SY3PEPF00001BD6X-OfficeVersion: 16.0.16830.41006X-Key: 8Eu3srxZ3WuJdM2f+sA9t7pJwg0Q1IPPnGuNV3eT+Dw=,638293802530127526X-Requested-With: XMLHttpRequestX-xhr: 1sec-ch-ua-platform: "Windows"haep: 6X-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36hascnt: 1X-UserType: WOPIX-IsCoauthSession: trueX-WacCluster: GAU2Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://auc-word-edit.officeapps.live.com/we/wordeditorframe.aspx?ui=en%2DUS&rs=en%2DUS&wopisrc=https%3A%2F%2Fncibrokers-my.sharepoint.com%2Fpersonal%2Fprudence_chang_nci_com_au%2F_vti_bin%2Fwopi.ashx%2Ffiles%2Fe22782769a504a6f8524485910e57d55&wdenableroaming=1&mscc=0&wdodb=1&hid=93F8D6A0-80DD-2000-8FE8-1EAA137CC93A&wdorigin=Sharing.ClientRedirect&jsapi=1&jsapiver=v1&newsession=1&corrid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&sftc=1&cac=1&mtf=1&sfp=1&instantedit=1&wopicomplete=1&wdredirectionreason=Unified_SingleFlush&rct=Normal&ctp=LeastProtectedAccept-Encoding: gz
Source: global traffic	HTTP traffic detected: GET /we/RemoteTelemetry.ashx?usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&build=16.0.16830.41006&waccluster=GAU1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6; GAU1-ARRAffinity=2496a0fb080ddc1ba306d6d8a04d9a447ac9908c79b61c3d5b7e411eadcfa9cf
Source: global traffic	HTTP traffic detected: GET /we/OneNote.ashx?perfTag=EditorsTable_1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6; GAU1-ARRAffinity=2496a0fb080ddc1ba306d6d8a04d9a447ac9908c79b61c3d5b7e411eadcfa9cf
Source: global traffic	HTTP traffic detected: GET /we/RemoteTelemetry.ashx?usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&build=16.0.16830.41006&waccluster=GAU1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6; GAU1-ARRAffinity=2496a0fb080ddc1ba306d6d8a04d9a447ac9908c79b61c3d5b7e411eadcfa9cf
Source: global traffic	HTTP traffic detected: GET /we/OneNote.ashx?perfTag=EditorsTable_1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6; GAU1-ARRAffinity=2496a0fb080ddc1ba306d6d8a04d9a447ac9908c79b61c3d5b7e411eadcfa9cf
Source: global traffic	HTTP traffic detected: GET /we/renamehandler.ashx?qs=WOPIsrc%3Dhttps%253A%252F%252Fncibrokers%252Dmy%252Esharepoint%252Ecom%252Fpersonal%252Fprudence%255Fchang%255Fnci%255Fcom%255Fau%252F%255Fvti%255Fbin%252Fwopi%252Eashx%252Ffiles%252Fe22782769a504a6f8524485910e57d55%26access_token%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IkdBZHhXWDNxZy1wbFA0ZTlYQlAxeTE2aWZqVSJ9%252EeyJhdWQiOiJ3b3BpL25jaWJyb2tlcnMtbXkuc2hhcmVwb2ludC5jb21AYjQ3ZTQ3YTItNWM1Ni00M2M2LTg1YzQtMTNkMWU2NWExOWVjIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwQDkwMTQwMTIyLTg1MTYtMTFlMS04ZWZmLTQ5MzA0OTI0MDE5YiIsIm5iZiI6IjE2OTM3ODM0NTEiLCJleHAiOiIxNjkzODE5NDUxIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsIm5paSI6Im1pY3Jvc29mdC5zaGFyZXBvaW50IiwiaXN1c2VyIjoidHJ1ZSIsImNhY2hla2V5IjoiMGguZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsInNoYXJpbmdpZCI6IkNaR043cUdRVTAraWZqK2hWNFd5bHciLCJpc2xvb3BiYWNrIjoiVHJ1ZSIsImFwcGN0eCI6ImUyMjc4Mjc2OWE1MDRhNmY4NTI0NDg1OTEwZTU3ZDU1O2R5TW4zakFsUzdFU0E1ZUpGZ3FNNkFteDh0ST07RGVmYXVsdDtkODhhMjQzN2IyMWQ0OTNiYjZhMjExMzNkY2NkMWE0Njs7VHJ1ZTs7OzA7OTNmOGQ2YTAtODBkZC0yMDAwLThmZTgtMWVhYTEzN2NjOTNhIiwiZmlkIjoiMTk1NTU1In0%252EluSZ1grXrmE9y%255F48hR5MGPEE9d7%252DM4ccdxVZ5fi7bsCfGDhiBte9%252DkNk3Nm3VnJOTcra96qR2%252DXx%255F9frkXQ7oVtu8I%255F3Nu0vaNXukWjswWdBTw2NDrF0XX6twQMqVffHB9N4VOC55hR9hULhpxYDYsQzKaxCitXpD2wSHIR9qAnX%252DDsp%255FGRWzzIzmBe3l5yixyY5B%252Dr%252D6tY%252DyH%252DVTY2jXi1Qk07FfX922DhhL7G6MZsNTTqag6FubT4G1ilkGrZHT61NBj2pJvskSa5hffGgojL1crA1E4OIvxbLp9REwBHiVZ5cnCk4ZFZ0rjPT5NgmVOwYKSugVd6cFPPU%252DP2H8w%26access_token_ttl%3D1693819451127&sl=1&u=1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6; GAU1-ARRAffinity=2496a0fb080ddc1ba306d6d8a04d9a447ac9908c79b61c3d5b7e411eadcfa9cf
Source: global traffic	HTTP traffic detected: GET /we/AppSettingsHandler.ashx?app=Word&usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&build= HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-alivesec-ch-ua: "Not/A)Brand";v="99", "Google Chrome";v="115", "Chromium";v="115"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://ncibrokers-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ncibrokers-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /we/AddinServiceHandler.ashx?action=isStoreDisabled&app=word&corr=341bc5d5-a81a-525f-a561-cdc237c7caab&WOPIsrc=https%3A%2F%2Fncibrokers%2Dmy%2Esharepoint%2Ecom%2Fpersonal%2Fprudence%5Fchang%5Fnci%5Fcom%5Fau%2F%5Fvti%5Fbin%2Fwopi%2Eashx%2Ffiles%2Fe22782769a504a6f8524485910e57d55&access_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IkdBZHhXWDNxZy1wbFA0ZTlYQlAxeTE2aWZqVSJ9.eyJhdWQiOiJ3b3BpL25jaWJyb2tlcnMtbXkuc2hhcmVwb2ludC5jb21AYjQ3ZTQ3YTItNWM1Ni00M2M2LTg1YzQtMTNkMWU2NWExOWVjIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwQDkwMTQwMTIyLTg1MTYtMTFlMS04ZWZmLTQ5MzA0OTI0MDE5YiIsIm5iZiI6IjE2OTM3ODM0NTEiLCJleHAiOiIxNjkzODE5NDUxIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsIm5paSI6Im1pY3Jvc29mdC5zaGFyZXBvaW50IiwiaXN1c2VyIjoidHJ1ZSIsImNhY2hla2V5IjoiMGguZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTM1NmVhMGQ3NjczNDE2ODhhMzNlYzg5ZGQ3OTJjOWIwNTEzNTkxMTJhY2EwZDBkOTFiOGUyYTUwNDBkNDIxYiIsInNoYXJpbmdpZCI6IkNaR043cUdRVTAraWZqK2hWNFd5bHciLCJpc2xvb3BiYWNrIjoiVHJ1ZSIsImFwcGN0eCI6ImUyMjc4Mjc2OWE1MDRhNmY4NTI0NDg1OTEwZTU3ZDU1O2R5TW4zakFsUzdFU0E1ZUpGZ3FNNkFteDh0ST07RGVmYXVsdDtkODhhMjQzN2IyMWQ0OTNiYjZhMjExMzNkY2NkMWE0Njs7VHJ1ZTs7OzA7OTNmOGQ2YTAtODBkZC0yMDAwLThmZTgtMWVhYTEzN2NjOTNhIiwiZmlkIjoiMTk1NTU1In0.luSZ1grXrmE9y_48hR5MGPEE9d7-M4ccdxVZ5fi7bsCfGDhiBte9-kNk3Nm3VnJOTcra96qR2-Xx_9frkXQ7oVtu8I_3Nu0vaNXukWjswWdBTw2NDrF0XX6twQMqVffHB9N4VOC55hR9hULhpxYDYsQzKaxCitXpD2wSHIR9qAnX-Dsp_GRWzzIzmBe3l5yixyY5B-r-6tY-yH-VTY2jXi1Qk07FfX922DhhL7G6MZsNTTqag6FubT4G1ilkGrZHT61NBj2pJvskSa5hffGgojL1crA1E4OIvxbLp9REwBHiVZ5cnCk4ZFZ0rjPT5NgmVOwYKSugVd6cFPPU-P2H8w&access_token_ttl=1693819451751 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6; GAU1-ARRAffinity=2496a0fb080ddc1ba306d6d8a04d9a447ac9908c79b61c3d5b7e411eadcfa9cf
Source: global traffic	HTTP traffic detected: GET /we/AppSettingsHandler.ashx?app=Word&usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&build= HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6; GAU1-ARRAffinity=2496a0fb080ddc1ba306d6d8a04d9a447ac9908c79b61c3d5b7e411eadcfa9cf
Source: global traffic	HTTP traffic detected: GET /we/RemoteTelemetry.ashx?usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&build=16.0.16830.41006&waccluster=GAU1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6; GAU1-ARRAffinity=2496a0fb080ddc1ba306d6d8a04d9a447ac9908c79b61c3d5b7e411eadcfa9cf
Source: global traffic	HTTP traffic detected: GET /we/OneNote.ashx?perfTag=GetChanges_1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6; GAU1-ARRAffinity=2496a0fb080ddc1ba306d6d8a04d9a447ac9908c79b61c3d5b7e411eadcfa9cf
Source: global traffic	HTTP traffic detected: GET /we/RemoteTelemetry.ashx?usid=5b655ac8-0896-4c45-a8d6-6dd5a0fb68ed&build=16.0.16830.41006&waccluster=GAU1 HTTP/1.1Host: auc-word-edit.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: Word_PrefetchArtifactsForPerfImprovements=h536611F131EDBF76; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; PrivNote=-1; WacUPToggleState=%7B%22CCS%22%3A0%7D; GAU2-ARRAffinity=3d53556656beb8f00e3c186db91aed0369bb7f6c251da605e1e411926e33d1f6; GAU1-ARRAffinity=2496a0fb080ddc1ba306d6d8a04d9a447ac9908c79b61c3d5b7e411eadcfa9cf

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableCache-Control: privateTransfer-Encoding: chunkedContent-Type: text/htmlP3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"Set-Cookie: X-CorrelationId: 79e4abb7-ba55-4fe4-a185-a1ad763206aaX-UserSessionId: 79e4abb7-ba55-4fe4-a185-a1ad763206aaStrict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-OfficeFE: ML1PEPF00004579X-OfficeVersion: 16.0.16831.41005X-OfficeCluster: GAU3X-Content-Type-Options: nosniffX-Download-Options: noopenContent-Disposition: attachmentX-OFFICEFD: ML1PEPF00004579X-WacFrontEnd: ML1PEPF00004579X-Cache: CONFIG_NOCACHEX-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5,5e4w=afd_excelslicetest_controlX-MSEdge-Features: typeheadertest,afd_waccluster,afd_wordcapacity_2,afd_wacinfra4,afd_wacinfra5,afd_excelslicetest_controlX-MSEdge-Ref: Ref A: C3BBD7A744184348982B1010A97AB90D Ref B: FRA231050416017 Ref C: 2023-09-03T23:24:16ZDate: Sun, 03 Sep 2023 23:24:17 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableCache-Control: privateTransfer-Encoding: chunkedContent-Type: text/htmlP3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"Set-Cookie: X-CorrelationId: be6edd16-37ed-4ee6-a2e0-cf93bc787814X-UserSessionId: be6edd16-37ed-4ee6-a2e0-cf93bc787814Strict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-OfficeFE: SY3PEPF000093BCX-OfficeVersion: 16.0.16830.41006X-OfficeCluster: GAU2X-Content-Type-Options: nosniffX-Download-Options: noopenContent-Disposition: attachmentX-OFFICEFD: SY3PEPF000093BCX-WacFrontEnd: SY3PEPF000093BCX-Cache: CONFIG_NOCACHEX-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5,5e4w=afd_excelslicetestX-MSEdge-Features: typeheadertest,afd_waccluster,afd_wacinfra4,afd_wacinfra5,afd_excelslicetestX-MSEdge-Ref: Ref A: 03C06798C679458EA79DAD2C6D5D3E2A Ref B: FRA231050416031 Ref C: 2023-09-03T23:24:23ZDate: Sun, 03 Sep 2023 23:24:23 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: privateTransfer-Encoding: chunkedContent-Type: text/htmlP3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"Set-Cookie: X-CorrelationId: b185b91c-8b06-4ae2-a63c-1ea6c0f977ffX-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edStrict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-OfficeFE: SY3PEPF00001BF1X-OfficeVersion: 16.0.16830.41006X-OfficeCluster: GAU2X-OFFICEFD: SY3PEPF00001BF1X-Cache: CONFIG_NOCACHEX-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5,5e4w=afd_excelslicetestX-MSEdge-Features: typeheadertest,afd_waccluster,afd_wordcapacity_2,afd_wacinfra4,afd_wacinfra5,afd_excelslicetestX-MSEdge-Ref: Ref A: 96525F11DA6B4229BE8B718471D66A74 Ref B: FRA231050411037 Ref C: 2023-09-03T23:24:24ZDate: Sun, 03 Sep 2023 23:24:23 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableCache-Control: privateTransfer-Encoding: chunkedContent-Type: text/htmlP3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"Set-Cookie: X-CorrelationId: 792ef10f-554b-4697-b647-20522ab8441aX-UserSessionId: 792ef10f-554b-4697-b647-20522ab8441aStrict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-OfficeFE: SY3PEPF000030E1X-OfficeVersion: 16.0.16830.41006X-OfficeCluster: GAU2X-Content-Type-Options: nosniffX-Download-Options: noopenContent-Disposition: attachmentX-OFFICEFD: SY3PEPF000030E1X-WacFrontEnd: SY3PEPF000030E1X-Cache: CONFIG_NOCACHEX-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5,5e4w=afd_excelslicetest_controlX-MSEdge-Features: typeheadertest,afd_waccluster,afd_wacinfra4,afd_wacinfra5,afd_excelslicetest_controlX-MSEdge-Ref: Ref A: EEC4F2B6319E4E948874749033ED44F1 Ref B: FRA231050413025 Ref C: 2023-09-03T23:24:23ZDate: Sun, 03 Sep 2023 23:24:23 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: privateTransfer-Encoding: chunkedContent-Type: text/htmlP3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"Set-Cookie: X-CorrelationId: fd9e63c7-d25c-4ef2-b094-cd2099448a35X-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edStrict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-OfficeFE: SY3PEPF00001BD4X-OfficeVersion: 16.0.16830.41006X-OfficeCluster: GAU2X-OFFICEFD: SY3PEPF00001BD4X-Cache: CONFIG_NOCACHEX-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5,5e4w=afd_excelslicetestX-MSEdge-Features: typeheadertest,afd_waccluster,afd_wacinfra4,afd_wacinfra5,afd_excelslicetestX-MSEdge-Ref: Ref A: 5BF3A0845CB2476C9ED04888269737DF Ref B: FRA231050415049 Ref C: 2023-09-03T23:24:26ZDate: Sun, 03 Sep 2023 23:24:26 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableCache-Control: privateTransfer-Encoding: chunkedContent-Type: text/htmlP3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"Set-Cookie: X-CorrelationId: 423391c2-250a-4829-aec1-89bdd16f8400X-UserSessionId: 423391c2-250a-4829-aec1-89bdd16f8400Strict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-OfficeFE: SY3PEPF00005377X-OfficeVersion: 16.0.16830.41006X-OfficeCluster: GAU1X-Content-Type-Options: nosniffX-Download-Options: noopenContent-Disposition: attachmentX-OFFICEFD: SY3PEPF00005377X-WacFrontEnd: SY3PEPF00005377X-Cache: CONFIG_NOCACHEX-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5,5e4w=afd_excelslicetestX-MSEdge-Features: typeheadertest,afd_waccluster,afd_wordslice,afd_wordcapacity,afd_visioslice_control,afd_wacinfra4,afd_wacinfra5,afd_excelslicetestX-MSEdge-Ref: Ref A: A309774DFD794EF69D3EB7F7FAE3EC1C Ref B: FRA231050411017 Ref C: 2023-09-03T23:24:30ZDate: Sun, 03 Sep 2023 23:24:30 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: privateContent-Length: 1233Content-Type: text/htmlP3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"Set-Cookie: X-ROUTED-TO-TARGET-SERVER-PATH: WAC_WFE_AFFINITY_TARGET_URLX-CorrelationId: c0e8461a-286b-4735-974a-067ba78f08c6X-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edStrict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-CorrelationId: c0e8461a-286b-4735-974a-067ba78f08c6X-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edStrict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-OfficeFE: SY3PEPF00001BD6X-OfficeVersion: 16.0.16830.41006X-OfficeCluster: GAU2X-OFFICEFD: SY3PEPF000093BDX-WacFrontEnd: SY3PEPF00001BD6X-Powered-By: ARR/3.0X-Cache: CONFIG_NOCACHEX-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5,5e4w=afd_excelslicetest_controlX-MSEdge-Features: typeheadertest,afd_waccluster,afd_wordcapacity_2_control,afd_wacinfra4,afd_wacinfra5,afd_excelslicetest_controlX-MSEdge-Ref: Ref A: 6E6E19B9F3F54AE2ABA09D61C8C0E8E4 Ref B: FRA231050411031 Ref C: 2023-09-03T23:24:30ZDate: Sun, 03 Sep 2023 23:24:31 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: privateContent-Length: 1233Content-Type: text/htmlP3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"Set-Cookie: X-ROUTED-TO-TARGET-SERVER-PATH: WAC_WFE_AFFINITY_TARGET_URLX-CorrelationId: a1c8a9db-6f75-432a-ae4e-5253879ced1bX-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edStrict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-CorrelationId: a1c8a9db-6f75-432a-ae4e-5253879ced1bX-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edStrict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-OfficeFE: SY3PEPF00001BD6X-OfficeVersion: 16.0.16830.41006X-OfficeCluster: GAU2X-OFFICEFD: SY3PEPF00001BD9X-WacFrontEnd: SY3PEPF00001BD6X-Powered-By: ARR/3.0X-Cache: CONFIG_NOCACHEX-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5,5e4w=afd_excelslicetest_controlX-MSEdge-Features: typeheadertest,afd_waccluster,afd_wordslice_control,afd_wacinfra4,afd_wacinfra5,afd_excelslicetest_controlX-MSEdge-Ref: Ref A: E4F949A002954C0494BAFD5941AF1699 Ref B: FRA231050413009 Ref C: 2023-09-03T23:24:31ZDate: Sun, 03 Sep 2023 23:24:31 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: privateContent-Length: 1233Content-Type: text/htmlP3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"Set-Cookie: X-ROUTED-TO-TARGET-SERVER-PATH: WAC_WFE_AFFINITY_TARGET_URLX-CorrelationId: ab370e6d-313a-4d3b-94e7-b35a78e06a60X-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edStrict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-CorrelationId: ab370e6d-313a-4d3b-94e7-b35a78e06a60X-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edStrict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-OfficeFE: SY3PEPF00001BD6X-OfficeVersion: 16.0.16830.41006X-OfficeCluster: GAU2X-OFFICEFD: SY3PEPF00001BE2X-WacFrontEnd: SY3PEPF00001BD6X-Powered-By: ARR/3.0X-Cache: CONFIG_NOCACHEX-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5,5e4w=afd_excelslicetestX-MSEdge-Features: typeheadertest,afd_waccluster,afd_visioslice,afd_wacinfra4,afd_wacinfra5,afd_excelslicetestX-MSEdge-Ref: Ref A: 08853987E5284766B399DCD5694EA895 Ref B: FRA231050413045 Ref C: 2023-09-03T23:24:32ZDate: Sun, 03 Sep 2023 23:24:31 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: privateContent-Length: 1233Content-Type: text/htmlP3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"Set-Cookie: X-ROUTED-TO-TARGET-SERVER-PATH: WAC_WFE_AFFINITY_TARGET_URLX-CorrelationId: c321fe0a-c259-470c-8948-a4f80c29f389X-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edStrict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-CorrelationId: c321fe0a-c259-470c-8948-a4f80c29f389X-UserSessionId: 5b655ac8-0896-4c45-a8d6-6dd5a0fb68edStrict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-OfficeFE: SY3PEPF00001BD6X-OfficeVersion: 16.0.16830.41006X-OfficeCluster: GAU2X-OFFICEFD: SY3PEPF0000530BX-WacFrontEnd: SY3PEPF00001BD6X-Powered-By: ARR/3.0X-Cache: CONFIG_NOCACHEX-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5,5e4w=afd_excelslicetest_controlX-MSEdge-Features: typeheadertest,afd_waccluster,afd_wacinfra4,afd_wacinfra5,afd_excelslicetest_controlX-MSEdge-Ref: Ref A: 634F7A3655C34EAAAF9DA2E1B135DFAE Ref B: FRA231050411039 Ref C: 2023-09-03T23:24:31ZDate: Sun, 03 Sep 2023 23:24:32 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableCache-Control: privateTransfer-Encoding: chunkedContent-Type: text/htmlP3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"Set-Cookie: X-CorrelationId: ea2786ff-9b20-4d46-80c5-03304f12433eX-UserSessionId: ea2786ff-9b20-4d46-80c5-03304f12433eStrict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-OfficeFE: SY3PEPF00003953X-OfficeVersion: 16.0.16830.41006X-OfficeCluster: GAU2X-Content-Type-Options: nosniffX-Download-Options: noopenContent-Disposition: attachmentX-OFFICEFD: SY3PEPF00003953X-WacFrontEnd: SY3PEPF00003953X-Cache: CONFIG_NOCACHEX-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5,5e4w=afd_excelslicetest_controlX-MSEdge-Features: typeheadertest,afd_waccluster,afd_wordslice,afd_pptcapacity,afd_wacinfra4,afd_wacinfra5,afd_excelslicetest_controlX-MSEdge-Ref: Ref A: 416EC04F98B24B369A59FCC772B91101 Ref B: FRA231050416009 Ref C: 2023-09-03T23:24:34ZDate: Sun, 03 Sep 2023 23:24:34 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableCache-Control: privateTransfer-Encoding: chunkedContent-Type: text/htmlP3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"Set-Cookie: X-CorrelationId: 3a233007-82a8-4e26-a279-46dcfe7c1087X-UserSessionId: 3a233007-82a8-4e26-a279-46dcfe7c1087Strict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-OfficeFE: ML1PEPF000046F2X-OfficeVersion: 16.0.16831.41005X-OfficeCluster: GAU3X-Content-Type-Options: nosniffX-Download-Options: noopenContent-Disposition: attachmentX-OFFICEFD: ML1PEPF000046F2X-WacFrontEnd: ML1PEPF000046F2X-Cache: CONFIG_NOCACHEX-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5,5e4w=afd_excelslicetest_controlX-MSEdge-Features: typeheadertest,afd_waccluster,afd_wacinfra4,afd_wacinfra5,afd_excelslicetest_controlX-MSEdge-Ref: Ref A: 24F7D7E65BEA47DB9AB8202D5463565A Ref B: FRA231050416033 Ref C: 2023-09-03T23:24:42ZDate: Sun, 03 Sep 2023 23:24:43 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableCache-Control: privateTransfer-Encoding: chunkedContent-Type: text/htmlP3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"Set-Cookie: X-CorrelationId: 9e21c542-7e7c-4a0c-a800-d36f7c8c1306X-UserSessionId: 9e21c542-7e7c-4a0c-a800-d36f7c8c1306Strict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-OfficeFE: SY3PEPF00005322X-OfficeVersion: 16.0.16830.41006X-OfficeCluster: GAU1X-Content-Type-Options: nosniffX-Download-Options: noopenContent-Disposition: attachmentX-OFFICEFD: SY3PEPF00005322X-WacFrontEnd: SY3PEPF00005322X-Cache: CONFIG_NOCACHEX-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5,2pfz=afd_wordcapacity_4,5e4w=afd_excelslicetestX-MSEdge-Features: typeheadertest,afd_waccluster,afd_wordslice_control,afd_wordcapacity_2_control,afd_pptcapacity_control,afd_wacinfra4,afd_wacinfra5,afd_wordcapacity_4,afd_excelslicetestX-MSEdge-Ref: Ref A: 2EC903622E8A42CE9702F4DB93F06D1D Ref B: FRA231050412021 Ref C: 2023-09-03T23:25:29ZDate: Sun, 03 Sep 2023 23:25:28 GMTConnection: close

URLs found in memory or binary data

Source: chromecache_367.1.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_503.1.dr	String found in binary or memory: http://feross.org
Source: chromecache_461.1.dr	String found in binary or memory: http://hammerjs.github.io/
Source: chromecache_367.1.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_415.1.dr	String found in binary or memory: http://localhost:8080/main_ssr_wac.html?isAgave
Source: chromecache_367.1.dr	String found in binary or memory: http://pajhome.org.uk/crypt/md5
Source: chromecache_405.1.dr, chromecache_367.1.dr	String found in binary or memory: http://underscorejs.org/LICENSE
Source: chromecache_421.1.dr, chromecache_405.1.dr, chromecache_367.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_402.1.dr	String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml
Source: chromecache_345.1.dr	String found in binary or memory: https://1drv.ms
Source: chromecache_345.1.dr	String found in binary or memory: https://aka.ms/WLFeedbackAttendees
Source: chromecache_345.1.dr	String found in binary or memory: https://aka.ms/WLFeedbackPresenters
Source: chromecache_367.1.dr	String found in binary or memory: https://aka.ms/fluentui-assets-license
Source: chromecache_497.1.dr	String found in binary or memory: https://cdn.forms.office.net/forms/images/addin/outlook-createpoll-new-32.png
Source: chromecache_497.1.dr	String found in binary or memory: https://cdn.forms.office.net/forms/images/addin/outlook-createpoll-new-80.png
Source: chromecache_444.1.dr	String found in binary or memory: https://cdn.hubblecontent.msit.osi.office.net
Source: chromecache_444.1.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net
Source: chromecache_453.1.dr	String found in binary or memory: https://contentplatform.office.net
Source: chromecache_500.1.dr	String found in binary or memory: https://designerappservice.officeapps.live.com
Source: chromecache_415.1.dr	String found in binary or memory: https://eus-000.shredder.osi.office.net/
Source: chromecache_345.1.dr	String found in binary or memory: https://fa000000096.resources.office.net
Source: chromecache_345.1.dr	String found in binary or memory: https://fa000000096.resources.office.net/f7024bdc-7caf-4ca8-807d-2908f09640d6/1.0.2210.23001/en-us_w
Source: chromecache_414.1.dr	String found in binary or memory: https://fa000000116.resources.office.net/033f92d3-bc6d-439a-858a-a17acf70360a/2.0.2308.24010/en-us_w
Source: chromecache_453.1.dr	String found in binary or memory: https://fa000000121.resources.office.net/f7024bdc-7caf-4ca8-807d-2908f09640d6/1.1.2303.9002/en-us_we
Source: chromecache_453.1.dr	String found in binary or memory: https://fa000000125.resources.office.net
Source: chromecache_500.1.dr	String found in binary or memory: https://fa000000125.resources.office.net/
Source: chromecache_500.1.dr	String found in binary or memory: https://fa000000125.resources.office.net:3000/dialog.html
Source: chromecache_500.1.dr	String found in binary or memory: https://fa000000125.resources.office.net:3000/taskpane.html
Source: chromecache_367.1.dr	String found in binary or memory: https://feross.org
Source: chromecache_367.1.dr, chromecache_503.1.dr	String found in binary or memory: https://feross.org/opensource
Source: chromecache_497.1.dr	String found in binary or memory: https://forms.office.com
Source: chromecache_497.1.dr	String found in binary or memory: https://forms.office.com/Pages/WordPollDesignPage.aspx
Source: chromecache_446.1.dr	String found in binary or memory: https://forms.officeppe.com
Source: chromecache_380.1.dr	String found in binary or memory: https://github.com/OfficeDev/office-js/blob/release/LICENSE.md
Source: chromecache_367.1.dr	String found in binary or memory: https://github.com/gajus/sister
Source: chromecache_367.1.dr	String found in binary or memory: https://github.com/gajus/sister/blob/master/LICENSE
Source: chromecache_367.1.dr	String found in binary or memory: https://github.com/jonschlinkert/is-extendable
Source: chromecache_367.1.dr	String found in binary or memory: https://github.com/jonschlinkert/is-number
Source: chromecache_367.1.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_367.1.dr	String found in binary or memory: https://github.com/jonschlinkert/isobject
Source: chromecache_367.1.dr	String found in binary or memory: https://github.com/jonschlinkert/object.omit
Source: chromecache_367.1.dr	String found in binary or memory: https://github.com/jonschlinkert/randomatic
Source: chromecache_367.1.dr	String found in binary or memory: https://github.com/niklasvh/base64-arraybuffer
Source: chromecache_444.1.dr	String found in binary or memory: https://hedwigtestserver.blob.core.windows.net/builds/
Source: chromecache_444.1.dr	String found in binary or memory: https://hubblecontent.df.osi.office.net
Source: chromecache_444.1.dr	String found in binary or memory: https://hubblecontent.msit.osi.office.net
Source: chromecache_444.1.dr	String found in binary or memory: https://hubblecontent.osi.office-int.net
Source: chromecache_444.1.dr	String found in binary or memory: https://hubblecontent.osi.office.net
Source: chromecache_444.1.dr	String found in binary or memory: https://hubblecontent.osi.officeppe.net
Source: chromecache_453.1.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore/flyoutdetails/
Source: chromecache_340.1.dr	String found in binary or memory: https://localhost:3000/index_react.html
Source: chromecache_405.1.dr, chromecache_367.1.dr	String found in binary or memory: https://lodash.com/
Source: chromecache_405.1.dr, chromecache_367.1.dr	String found in binary or memory: https://lodash.com/license
Source: chromecache_497.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_345.1.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: chromecache_415.1.dr	String found in binary or memory: https://neu-000.shredder.osi.office.net/
Source: chromecache_429.1.dr	String found in binary or memory: https://nleditor.osi.office.net
Source: chromecache_364.1.dr	String found in binary or memory: https://nleditor.osi.office.net/NlApps/Ideas
Source: chromecache_364.1.dr	String found in binary or memory: https://nleditor.osi.office.net/NlEditor
Source: chromecache_453.1.dr	String found in binary or memory: https://nleditor.osi.officeppe.net
Source: chromecache_364.1.dr	String found in binary or memory: https://nleditor.osi.officeppe.net/NlApps/Content/Images/taskpane_32x.png
Source: chromecache_364.1.dr	String found in binary or memory: https://nleditor.osi.officeppe.net/NlApps/Ideas
Source: chromecache_444.1.dr	String found in binary or memory: https://office.com
Source: chromecache_444.1.dr	String found in binary or memory: https://office.com/webapps
Source: chromecache_488.1.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/UI/index.html
Source: chromecache_488.1.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/UI/index.html?action=translateDocument
Source: chromecache_488.1.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/UI/index.html?tab=Document
Source: chromecache_488.1.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/UI/index.html?tab=Lookup
Source: chromecache_488.1.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/UI/index.html?tab=Settings
Source: chromecache_488.1.dr	String found in binary or memory: https://ogma.osi.office.net/outlooktranslatorapp/Images/TranslateIcon32x32.png
Source: chromecache_488.1.dr	String found in binary or memory: https://ogma.osi.office.net/outlooktranslatorapp/Images/TranslateIcon64x64.png
Source: chromecache_453.1.dr	String found in binary or memory: https://onedrive.live.com/
Source: chromecache_405.1.dr, chromecache_367.1.dr	String found in binary or memory: https://openjsf.org/
Source: chromecache_444.1.dr	String found in binary or memory: https://osizewuspersimmon001.blob.core.windows.net
Source: chromecache_444.1.dr	String found in binary or memory: https://osiziwuspersimmon002.blob.core.windows.net
Source: chromecache_444.1.dr	String found in binary or memory: https://osizpscuspersimmon000.blob.core.windows.net
Source: chromecache_402.1.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.microsoft.office.excel&utm_source=wac&utm_medium=w
Source: chromecache_380.1.dr	String found in binary or memory: https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE
Source: chromecache_444.1.dr	String found in binary or memory: https://res-dev.cdn.officeppe.net/1js/build/22469829/wdjs/WordEditorDSReduceInitialBundle.box4.dll1.
Source: chromecache_453.1.dr	String found in binary or memory: https://res-dev.cdn.officeppe.net/1js/build/22469829/wdjs/WordEditorDSReduceInitialBundle.box4.dll3.
Source: chromecache_419.1.dr	String found in binary or memory: https://res-dev.cdn.officeppe.net/1js/build/22469829/wdjs/WordEditorDSReduceInitialBundle.collab.js.
Source: chromecache_503.1.dr	String found in binary or memory: https://res-dev.cdn.officeppe.net/1js/build/22469829/wdjs/WordEditorDSReduceInitialBundle.common.js.
Source: chromecache_345.1.dr	String found in binary or memory: https://res-dev.cdn.officeppe.net/1js/build/22469829/wdjs/WordEditorDSReduceInitialBundle.js.map
Source: chromecache_429.1.dr	String found in binary or memory: https://res.cdn.office.net/editor/1.0.2308.92510/js/
Source: chromecache_429.1.dr	String found in binary or memory: https://res.cdn.office.net/editor/1.0.2308.92510/js/bundle-prod.js
Source: chromecache_415.1.dr	String found in binary or memory: https://sea-000.shredder.osi.office.net/
Source: chromecache_415.1.dr	String found in binary or memory: https://shredder-eu.osi.office.net/
Source: chromecache_444.1.dr	String found in binary or memory: https://shredder-eu.osi.office.net/shredderservice/api/refreshmemory
Source: chromecache_444.1.dr	String found in binary or memory: https://shredder-test.osi.office.net/shredderservice/api/refreshmemory
Source: chromecache_415.1.dr	String found in binary or memory: https://shredder-us.osi.office.net/
Source: chromecache_415.1.dr	String found in binary or memory: https://shredder.osi.office-int.net/
Source: chromecache_415.1.dr	String found in binary or memory: https://shredder.osi.office.net/
Source: chromecache_444.1.dr	String found in binary or memory: https://shredder.osi.office.net/shredderservice/api/refreshmemory
Source: chromecache_415.1.dr	String found in binary or memory: https://shredder.osi.officeppe.net/
Source: chromecache_390.1.dr	String found in binary or memory: https://stackoverflow.com/a/32927607
Source: chromecache_444.1.dr	String found in binary or memory: https://support.office.com/
Source: chromecache_364.1.dr	String found in binary or memory: https://support.office.com/en-us
Source: chromecache_444.1.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/
Source: chromecache_415.1.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/images/smartLookupIcon.png
Source: chromecache_415.1.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/main_ssr_wac.html?isAgave
Source: chromecache_444.1.dr	String found in binary or memory: https://uci.edog.cdn.office.net/mirrored/smartlookup/
Source: chromecache_415.1.dr	String found in binary or memory: https://uci.edog.cdn.office.net/mirrored/smartlookup/current/main_ssr_wac.html?isAgave
Source: chromecache_444.1.dr	String found in binary or memory: https://uciserviceintcdnwus.blob.core.windows.net/mirrored/smartlookup/
Source: chromecache_415.1.dr	String found in binary or memory: https://uciserviceintcdnwus.blob.core.windows.net/mirrored/smartlookup/current/main_ssr_wac.html?isA
Source: chromecache_415.1.dr	String found in binary or memory: https://uciserviceintcdnwus.blob.core.windows.net/mirrored/smartlookup/next/main_ssr_wac.html?isAgav
Source: chromecache_444.1.dr	String found in binary or memory: https://wedge.wedge:9090/
Source: chromecache_444.1.dr	String found in binary or memory: https://wedgecomponents.azurewebsites.net/
Source: chromecache_415.1.dr	String found in binary or memory: https://weu-000.shredder.osi.office.net/
Source: chromecache_415.1.dr	String found in binary or memory: https://wus-000.shredder.osi.office.net/
Source: chromecache_415.1.dr	String found in binary or memory: https://wus-000.shredder.osi.officeppe.net/
Source: chromecache_444.1.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2F
Source: chromecache_444.1.dr	String found in binary or memory: https://www.onenote.com/Images/oembed_powerbi_defaultthumbnail.png

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg; AEC=Ad49MVGiijyX5dxPFAKxKYso-rIS24Ht-Pxs5fU9hHrAzfASnm-jqdQE1g; NID=511=WyMJovC2uA2AEbHQkGfP-KDdYCeg5Q7Mv6gxYT-qeugtrnXImrhmp1SixwS4ydh_E8Z0hdfCLAXvg2WUqsBSfqpx5SFvCCoeGeevqlEfkoxYi9FTISb8Cu7rr5rf9PyyNbLqf2QbxG7ja7jAB6UJQd5CPvMGcYUasORCRKRL1-arNYzfADAWHJvBLXml-Km_uewDreOyJ-MjxAI-i38Tl6LXI3zB; 1P_JAR=2023-08-10-10

System Summary

Classification label

Source: classification engine

Classification label: clean0.win@28/188@76/8

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1796,i,3552111546958092729,11232460640977524522,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ncibrokers-my.sharepoint.com/:w:/g/personal/prudence_chang_nci_com_au/EXaCJ-JQmm9KhSRIWRDlfVUBQD8VWGMakiitwEFCoHGPrg?e=4%3aHW5r1V&fromShare=true&at=31
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1796,i,3552111546958092729,11232460640977524522,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\chrome_BITS_4816_102570404

Jump to behavior

Binary contains paths to development resources

Source: chromecache_345.1.dr	Binary or memory string: f[f.e9p=3038]="msoulscat_Wac_WordDataLossMonitor";f[f.A7p=3039]="msoulscat_Wac_OWL";f[f.B7p=3040]="msoulscat_Wac_OWLNest";f[f.SLn=3041]="msoulscat_Wac_AiMaker";f[f.C7p=3042]="msoulscat_Wac_OfficeTemplatesMetadataService";f[f.TLn=3043]="msoulscat_Wac_AiRewrite";f[f.RLn=3044]="msoulscat_Wac_AiInsert";f[f.j7p=3045]="msoulscat_Wac_FastCards";f[f.A8p=3046]="msoulscat_Wac_SendToKindle";f[f.ULn=3047]="msoulscat_Wac_AiSummarize";f[f.VLn=3048]="msoulscat_Wac_CopilotCompose";f[f.$Ln=3049]="msoulscat_Wac_Skittles";
Source: chromecache_345.1.dr	Binary or memory string: c.cpBegin;Pa<c.cpEnd;Pa++){const kb=B.charAt(Pa);if(this.oQj(da,kb))if(O<k.length)sa=this.Omd(t,sa,k[O++],Pa);else{this.Omd(t,sa,null,Pa);break}da=kb}}Pmi(c,k,t){let B=!1,O=!1,da=!1,sa=!1;for(;k<t;){const Pa=c.charAt(k);if(rn.sln(Pa)||B)if(B=!1,O||!da){we.a.Wde(Pa)&&(sa=!0);O=!0;k++;continue}else break;switch(Pa){default:if(sa&&(Pa===rn.Ikl||Pa===rn.Tkl||Pa===rn.Hkl)){B=!0;continue}return da||O?k:k+1;case "+":B=!0;continue;case rn.Skl:case rn.Rkl:case rn.Ukl:case rn.$Zh:if(da||!O)da=!0,k++;else return k}}return k}D5l(c,
Source: chromecache_444.1.dr	Binary or memory string: 393,15,"List node received is null : skipping join list action.")}PMj(b,h,r,A=null){const M=Db.OutlineElementReader.nN(b);return this.vgc(M,()=>{const aa=this.m_b(b,h.qv,r);if(!Ei.a.Us)return this.wfi(aa,h,r,A),aa})}wfi(b,h,r,A=null){if(!Ei.a.Us&&this.Ns.f9a(b,h.qv).Tz){const M=new ud.a;M.set(b);M.Kd();M.rc();const aa=this.T8l(M,h,A);b=this.L8l(M,b,h,r,A,aa);this.Q8l(h,r,A,aa,b)}}T8l(b,h,r){if(!Ei.a.Us){if(h.XXi)h=h.bS;else{let A,M;r?(A=this.fXj,M=this.hAe):h.Hmc?(A=this.eXj,M=this.hAe):(A=this.vbp,
Source: chromecache_444.1.dr	Binary or memory string: (Gb,Sb,pc,Bc,Yc)=>{if(1===pc)return 32;Gb=this.XIf(Gb,Yc);this.control.Oea&&this.control.PDa(Gb);return 32};this.Ove=(Gb,Sb,pc,Bc,Yc)=>{if(1===pc)return 32;Gb=this.SEi(Gb,Yc);Bc.At=Gb;Sb=this.DOf(Sb);if(!Sb)return 8;Bc=this.Zc.Rl();Bc.set(Sb);Bc.vb(8);Bc.ht(8);if(!this.pl.sLn(Bc,Gb))return 8;this.Wm.pVb(Bc);this.control.Dka(Bc.currentNode);return 32};this.Xjg=(Gb,Sb,pc,Bc,Yc)=>{if(1===pc)return 32;Gb=this.qOk.qHl(this.DOf(Sb));Yc.PopulationXML=Gb;return 32};this.tre=(Gb,Sb,pc,Bc,Yc)=>{Gb=this.Hxi(Gb,
Source: chromecache_444.1.dr	Binary or memory string: A.push(h.fc),h.Zh))for(let oa=0;oa<h.Zh.length;oa++){const Ja=h.Zh.K(oa).Jo.toString();r.lb(Ja)?r.Z(Ja,r.K(Ja)+1):r.Z(Ja,1)}++M}}}Object(u.a)(zA,"DeleteParagraphContentStrategy",$n,[]);class IL{static get bJ(){return gO.a.instance}static DOl(b,h,r){if(1===r)return 32;b=h.node;return IL.bJ.GTd(b)?ds.cOl(b,r):32}}Object(u.a)(IL,"DeleteUnsupportedObjectStrategy",null,[]);var wK=d(839),xO=d(518);class dN{constructor(b,h,r,A,M){this.vBp=b;this.dca=r;this.rd=A;this.actionId=h;this.Wsd=M}}Object(u.a)(dN,
Source: chromecache_345.1.dr	Binary or memory string: null,[]);var om=d(1241),yq=d(1265);class qj{constructor(c,k,t,B,O,da,sa,Pa,kb,Ib,bc,Cc,cd,vd,Ud,le,Te,cf,md,Xd,xh,yh,Mi,lg,Nk,rk,Zf,ji,Bj){this.YXl=Bj;this.Vbp=[bd.a.q6,bd.a.bIa,bd.a.j6a,bd.a.STc];this.J2e=this.Mxh=this.ol=null;this.k0m=(Zj,Ij,ml)=>this.Lxh&&(Zj=this.Qk.zti(Zj.rawEvent))&&this.Qk.yEe(this.Je.xx())&&(Ij=null,({KSf:Ij}=this.Qk.X1j(Zj,this.qok,this.T3a.gbj)).returnValue)?(this.pT?ml.Ulc=Ij:(ml.type=1,ml.payload=Ij),!1):!0;this.p9n=(Zj,Ij,ml)=>this.iGk&&(this.Qk.Bln(Ij)||this.pT)&&(Zj=
Source: chromecache_444.1.dr	Binary or memory string: this.Md.o0(Bc),this.$9m(je.currentNode,Bc.currentNode))};this.xbp=(Bc,Yc,Id,je)=>{Id.listID=Yc.listID;this.Iwj(Bc,Yc,Id,je);this.hAe(Bc,Yc,Id,je)};this.eXj=(Bc,Yc)=>Yc.listID===Bc.listID;this.vbp=(Bc,Yc)=>Yc.level<=Bc.level;this.fXj=(Bc,Yc,Id)=>Yc.listID===Id.sfd;this.Pp=M;this.Wwa=b;this.PCd=h;this.Qc=A;this.Hig={};this.sBk=aa;this.Yd=oa;this.Oq=Ja;this.zd=Cb;this.Ux=Gb;this.$v=Sb}get tba(){return this.Wwa.Pla}get Fyb(){return this.ZDh}set Fyb(b){this.ZDh=b}get Ns(){return this.Wwa}get uha(){return this.$v}get Wb(){return this.Ux}get Ws(){return this.Ns.Ws}get Sq(){return this.Ns.Sq}get Bya(){return this.Ns.Bya}get qba(){return this.Ns.qba}set qba(b){this.Ns.qba=
Source: chromecache_444.1.dr	Binary or memory string: r=M.g1j+" ";const aa=wc.a.Tc(b,0);this.Fg.Ve(aa,r);b=sc.SelectionFactory.ue(b,r.length);fg.a.instance.Kc(b);v.ULS.sendTraceTag(540386467,393,50,"Unlisted list with trigger string: {0}",M.g1j)}return y.AFrameworkApplication.va.Nf(h.vBp,A.Tz?ub.a.NN:ub.a.ME,2,!1,h.dca,h.rd)}MSm(b,h,r,A,M){let aa=!1;0<this.Npj.K2(b).Nu&&(M=y.AFrameworkApplication.va.Nf(h,ub.a.zuc,2,!1,r,A),aa=!0);return{eX:aa,response:M}}TSm(b,h,r,A,M){let aa=!1;0<this.Npj.jI(b).Nu&&(M=y.AFrameworkApplication.va.Nf(h,ub.a.Ljd,2,!1,r,
Source: chromecache_345.1.dr	Binary or memory string: else if(yq.a.Fig=window.performance.now(),!this.Gb.Xy){var B=t.btl;if(this.$Z||this.MDh)if(Qj.any(Qj.where(Qj.asEnumerable(this.Vbp),O=>B===O))){t&&t.kVm();this.q9.I3&&(this.q9.I3=null);this.J2e=this.Qc.Nc(3);this.uua.Bb(k);k=new Xm;k.pza=this.jja.zpd();k.pza.Mcc("pasteHandler");k.Ege=!1;k.Ulc=null;k.hXb=null;k.IKa=null;k.N8a="";k.w0=B;k.correlationId=qg.a.create();k.bhg=this.Rsj(this.T3a.KQj,k.bhg);if(t=this.Qk.xGf(c)){!this.Qk.Ull(t)&&k?(k.N8a+="Empty clipboardData types;",k.Zyf=0):k.Zyf=1;this.dLk&&

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_4816_102570404			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4816_703368849			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4816_703368849\ssl_error_assistant.pb			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4816_703368849\manifest.json			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4816_703368849\_metadata\			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4816_703368849\_metadata\verified_contents.json			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping4816_703368849\manifest.fingerprint			Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: this.pdb().qSn(T.KQ,T.zBl)),this.G0c=k.ActionManager.Yla)}Tyj(T,X){this.ahf(4);this.Imd=!1;this.Ujc=[];this.Ase=null;T&&!X&&(this.Vtf=!0);this.u4e()}wXm(T){t.a.mark(7147);var X=null;this.P4m&&(X=w.a.instance.tu(U.a.M4m));var V=new u.a(T.lMh,(ea,ha)=>this.xXm(ea,ha),new M(T.hK,T.WJd,X,T.lMh));V.Bq("UpdateAllViews");this.rnh&&(this.aMc=V);V.hl=!this.lJd;X=null;this.lJd||(this.Nig=n.a.qf(),X=this.tIg,this.oTc=!0);V.run();this.oTc&&X&&(V=n.a.qf()-this.Nig,this.oTc&&2E3<=V&&G.ULS.sendTraceTag(579700875, source: chromecache_402.1.dr
Source:	Binary string: void 0===X?void 0:X.suspend(),ea.Yqm());this.odc=this.eHa+1;this.Mtc(V)||(this.j1c=this.Tna+1);this.Xtc(V)&&(this.FCg&&G.ULS.sendTraceTag(17043994,329,50,"CompletingOutermostViewTransaction is not finished."),this.Q7a||(this.GWc=new A.a,this.t4e()),T.pNh&&this.GWc.add(T.pNh),this.r4d=this.Q7a+1);this.Muc(V)&&(this.Vtf&&(this.Vtf=!1,this.pdb()&&this.pdb().EVn()),this.Oae=this.U$a+1,1===this.U$a&&this.pdb()&&(this.Fii=this.pdb().e3a()));this.olc(this.Mtc(V))}}vz(T){var X,V,ea=T.V_b;const ha=this.Xtc(ea)&& source: chromecache_402.1.dr
Source:	Binary string: this.yI=this.zX=null;this.Olm=Ja;this.fr=0}}Object(D.a)(J,"AddSelectionToCollectionArguments",null,[]);var K=c(91);class T{constructor(){this.pVc=this.Rhb=null;this.mpa=this.pDb=!1;this.run=Ja=>{this.mpa=!0;this.Rhb&&this.Rhb(Ja);this.Rhb=null;this.pVc&&this.pVc(Ja);this.pVc=null;this.mpa=this.pDb=!1};this.lQ=new K.a(0,1,16,this.run,42)}$vm(Ja){this.mpa?this.Rhb?this.Rhb=Ja:Ja(this.lQ):(this.Rhb=Ja,this.Vub())}uUg(){this.pDb&&(e.AFrameworkApplication.wc.mf(this.lQ),this.run(this.lQ))}Npj(){this.pDb&& source: chromecache_402.1.dr
Source:	Binary string: 0;this.lJd=!1;this.ta=new e.a;this.QTj=null===(Fa=a.AFrameworkApplication.J)||void 0===Fa?void 0:Fa.getBooleanFeatureGate("Microsoft.Office.WordOnline.DoNotSuppressError",!1);null===(Ea=a.AFrameworkApplication.J)||void 0===Ea||Ea.getBooleanFeatureGate("Microsoft.Office.WordOnline.StopFloatingElementCleanup",!1);this.lFa=!1;this.pdb=T;this.bVd=X;this.v6b=V;this.AKi=ea;this.rYf=ha;this.Iia=oa;this.xOf=qa;this.bJ=ka;this.rtd=this.rtd.bind(this);this.std=this.std.bind(this);this.Yud=this.Yud.bind(this); source: chromecache_402.1.dr
Source:	Binary string: this.hJc||1!==uf.gFe||this.qfb(),this.Wff(Ue),this.BW.ofg()):this.hJc=this.gJb=!1)};this.rbf=this.Ih.Sha;this.Ima=Eg.a.Une;this.nu=this.Ih.nu;this.Ih.w4h()}get Zce(){return this.BW.x_f()}get Ima(){return this.Ih.Ima}set Ima(ja){this.Ih.Ima=ja}get rSh(){return"1"===this.nu.hH.style.opacity}vPj(ja){this.Xod||(this.Xod=!0,this.Ih.nsj(),this.pDb=ja(this.nu.yla,this.Ih.rBj,()=>{this.updatePosition()}),this.Ih.S8i(this.pDb),this.BW.initialize(this.pDb,this),this.Ih.initialize(this.pDb,this.BW.gvb),this.Ih.Pyj(), source: chromecache_444.1.dr
Source:	Binary string: Md;this.lS=Od;this.pDb=null;this.p$e=0;this.CEd=!1;this.bJd=0;this.Y1b=this.Xod=this.y$g=this.hJc=this.gJb=!1;this.qAc=()=>{this.BW.ABg()&&this.Ih.qAc(this.CEd,this.sgg)};this.evb=()=>{this.Ih.vqa.ota()&&(this.ljd(this.Ih.vqa.Jc),this.Ih.vqa.Guc(this.evb))};this.sgg=()=>{this.qfb();this.BW.rgg()};this.vEg=()=>{!this.gJb&&this.BW.OAg()&&(this.bJd=this.rbf.scrollTop,this.gJb=!0,this.W0a.eNa(2))};this.lpg=(Ue,uf)=>{this.gJb&&(Ue=this.rbf.scrollTop,Ue-this.bJd?(this.hJc||uf.gFe||this.updatePosition(), source: chromecache_444.1.dr
Source:	Binary string: (e.AFrameworkApplication.wc.mf(this.lQ),this.pVc=this.Rhb=null,this.pDb=!1)}Vub(){this.pDb?e.AFrameworkApplication.wc.a1(this.lQ,16):(e.AFrameworkApplication.wc.Yb(this.lQ),this.pDb=!0)}}Object(D.a)(T,"DelayedSelectionTask",null,[]);var X=c(369),V=c(306);class ea{constructor(){this.adh=this.Ild=this.ich=this.hasBookmark=this.akh=this.isEmpty=this.Nt=this.Nph=this.$ch=this.h4=this.Q3a=this.ki=!1;this.annotationTypes=[]}}Object(D.a)(ea,"ParagraphTraits",null,[]);class ha{constructor(){}}Object(D.a)(ha, source: chromecache_402.1.dr
Source:	Binary string: !0;this.hJc=this.gJb;this.W0a.eNa(10)}rLf(ja){return this.Ih.kUa({contentAnchorPositions:ja.contentAnchorPositions})}qxf(){this.CEd=!1;if(this.nu.yla&&this.pDb&&this.xi.kBa()){this.Ih.D0d();var ja=0;this.kj.$d(()=>{ja=this.Ih.b5d()},"FCM:UP:GET");var Ta=null,zb=null;this.kj.$d(()=>{const Wb=this.BW.Wti(ja,this.Ih.Ri);Ta=Wb.pul;zb=this.rLf(Wb)},"FCM:UP:GP");this.kj.$d(()=>{this.gJb?(this.Ih.Ehi(zb),this.gJb=!1):this.pDb.emitEvent(3,zb);this.f1.Vre()},"FCM:UP:RC");this.pDb.setFirstCommentRenderDone(); source: chromecache_444.1.dr
Source:	Binary string: this.VDd,this.PDb);ua.removeChild(Ca);Ca=ua.ownerDocument.createElement("div");Ca.id="screenReaderDetectionDiv";Ca.setAttribute(Y.a.Ph,Y.a.vA);Ca.setAttribute(Y.a.uA,Y.a.fq);ua.appendChild(Ca)}get aXa(){return this.VDd}get mWa(){return this.PDb}get QRf(){!this.yTe&&this.VDd&&this.PDb&&this.BJe&&(this.yTe=String.format("{0}_{1}_{2}",this.PDb.A0c,this.PDb.backgroundColor,this.PDb.linkColor));return this.yTe}ozm(ua,Ca,va){let Sa,Ra,ob;const Ya=({Zag:Sa}=this.dJg(ua)).returnValue,vb=({Zag:Ra}=this.dJg(Ca)).returnValue, source: chromecache_345.1.dr
Source:	Binary string: this.eHa-1);this.Iff||(null===(V=this.bVd())||void 0===V?void 0:V.resume(),T.hK.qAg())}else 1<this.eHa&&(this.odc=this.eHa-1)}Yyj(T){this.tjf(!0);this.ahf(3);this.v6b()&&!this.AKi()?K.nq.Je(()=>{this.wXm(T)},"GT:UAV"):(this.zDd(),this.tjf(!1))}zDd(){this.Tna!==this.eHa&&G.ULS.sendTraceTag(38293641,329,15,"Misaligned transaction count view: {0}, total: {1}. Callstack: {3}",this.Tna,this.eHa,h.Debug.Mmb());this.odc=this.j1c=0}Wyj(T){T&&(this.ahf(8),this.pdb()&&(this.pdb().bzh(this.G0c,this.Fii),T.ptc&& source: chromecache_402.1.dr
Source:	Binary string: K,d){d.d(K,"a",function(){return f});J=d(0);K=d(443);var m=d(20);d=d(286);class f extends K.a{constructor(a,l){super(a,l)}get bab(){return!!f.Yg&&f.Yg.bab}Acb(){if(this.$ya.aL())return super.Acb();this.$ya.Xt(this.kob);return!!this.$ya.aL()}shd(a,l){this.yod(a)&&this.$ya.Pdb(a,l)}vhd(a){this.yod(a)&&this.$ya.removeProperty(a)}thd(a,l,w){this.yod(a)&&this.$ya.Pdb(a,w)}yod(a){return!this.Yin(a.flags)||this.bab}Yin(a){return!!(a&2048)}static get Yg(){return null!=f.a5g?f.a5g:f.a5g=m.a.instance.Oa(44)}} source: chromecache_345.1.dr
Source:	Binary string: ba=d(218),X=d(196),Y=d(70),ca=d(170);class ia{constructor(){this.linkColor=this.backgroundColor=this.A0c=null}toString(){return String.format("ForegroundTextColor: {0}, BackgroundColor: {1}, LinkColor: {2}",this.A0c,this.backgroundColor,this.linkColor)}}Object(J.a)(ia,"HighContrastColors",null,[]);var la=d(18);class ta{constructor(ua){this.BJe=!0;this.RPk=RegExp("#[0-9A-Fa-f]{6}");this.yTe=this.PDb=null;this.reh="rgb(50, 50, 50)";this.coh=l.AFrameworkApplication.J.$("HighContrastDetectionMechanism"); source: chromecache_345.1.dr
Source:	Binary string: this.VDd=Ra||ob;Sa&&va||m.ULS.sendTraceTag(25523335,334,50,"HighContrastDetector foregroundBackgroundCurrentStyle is null:[{0}] and linkCurrentStyle is null:[{1}]",!Sa,!va);this.VDd&&(this.PDb=Sa?this.ozm(Sa.color.toLowerCase(),Sa.backgroundColor.toLowerCase(),va.color.toLowerCase()):null,this.BJe||m.ULS.sendTraceTag(19223450,334,15,"We believe the user is in high contrast mode, but encountered an invalid color value (transparent or window)"));m.ULS.sendTraceTag(18458837,334,50,"HighContrastDetector.ctor: IsInHighContrastMode=[{0}], HighContrastColors=[{1}]", source: chromecache_345.1.dr

Malware Analysis System Evasion

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: chromecache_367.1.dr	Binary or memory string: function p(e,t){void 0===e&&(e="");var n={style:{MozOsxFontSmoothing:"grayscale",WebkitFontSmoothing:"antialiased",fontStyle:"normal",fontWeight:"normal",speak:"none"},fontFace:{fontFamily:'"FabricMDL2Icons-7"',src:"url('"+e+"fabric-icons-7-2b97bb99.woff') format('woff')"},icons:{SingleBookmark:"\uedff",SingleBookmarkSolid:"\uee00",DoubleChevronDown:"\uee04",FollowUser:"\uee05",ReplyAll:"\uee0a",WorkforceManagement:"\uee0f",RecruitmentManagement:"\uee12",Questionnaire:"\uee19",ManagerSelfService:"\uee23",ProductionFloorManagement:"\uee29",ProductRelease:"\uee2e",ProductVariant:"\uee30",ReplyMirrored:"\uee35",ReplyAllMirrored:"\uee36",Medal:"\uee38",AddGroup:"\uee3d",QuestionnaireMirrored:"\uee4b",CloudImportExport:"\uee55",TemporaryUser:"\uee58",CaretSolid16:"\uee62",GroupedDescending:"\uee66",GroupedAscending:"\uee67",AwayStatus:"\uee6a",MyMoviesTV:"\uee6c",GenericScan:"\uee6f",AustralianRules:"\uee70",WifiEthernet:"\uee77",TrackersMirrored:"\uee92",DateTimeMirrored:"\uee93",StopSolid:"\uee95",DoubleChevronUp12:"\uee96",DoubleChevronDown12:"\uee97",DoubleChevronLeft12:"\uee98",DoubleChevronRight12:"\uee99",CalendarAgenda:"\uee9a",ConnectVirtualMachine:"\uee9d",AddEvent:"\ueeb5",AssetLibrary:"\ueeb6",DataConnectionLibrary:"\ueeb7",DocLibrary:"\ueeb8",FormLibrary:"\ueeb9",FormLibraryMirrored:"\ueeba",ReportLibrary:"\ueebb",ReportLibraryMirrored:"\ueebc",ContactCard:"\ueebd",CustomList:"\ueebe",CustomListMirrored:"\ueebf",IssueTracking:"\ueec0",IssueTrackingMirrored:"\ueec1",PictureLibrary:"\ueec2",OfficeAddinsLogo:"\ueec7",OfflineOneDriveParachute:"\ueec8",OfflineOneDriveParachuteDisabled:"\ueec9",TriangleSolidUp12:"\ueecc",TriangleSolidDown12:"\ueecd",TriangleSolidLeft12:"\ueece",TriangleSolidRight12:"\ueecf",TriangleUp12:"\ueed0",TriangleDown12:"\ueed1",TriangleLeft12:"\ueed2",TriangleRight12:"\ueed3",ArrowUpRight8:"\ueed4",ArrowDownRight8:"\ueed5",DocumentSet:"\ueed6",GoToDashboard:"\ueeed",DelveAnalytics:"\ueeee",ArrowUpRightMirrored8:"\ueeef",ArrowDownRightMirrored8:"\ueef0",CompanyDirectory:"\uef0d",OpenEnrollment:"\uef1c",CompanyDirectoryMirrored:"\uef2b",OneDriveAdd:"\uef32",ProfileSearch:"\uef35",Header2:"\uef36",Header3:"\uef37",Header4:"\uef38",RingerSolid:"\uef3a",Eyedropper:"\uef3c",MarketDown:"\uef42",CalendarWorkWeek:"\uef51",SidePanel:"\uef52",GlobeFavorite:"\uef53",CaretTopLeftSolid8:"\uef54",CaretTopRightSolid8:"\uef55",ViewAll2:"\uef56",DocumentReply:"\uef57",PlayerSettings:"\uef58",ReceiptForward:"\uef59",ReceiptReply:"\uef5a",ReceiptCheck:"\uef5b",Fax:"\uef5c",RecurringEvent:"\uef5d",ReplyAlt:"\uef5e",ReplyAllAlt:"\uef5f",EditStyle:"\uef60",EditMail:"\uef61",Lifesaver:"\uef62",LifesaverLock:"\uef63",InboxCheck:"\uef64",FolderSearch:"\uef65"}};(0,r.fm)(n,t)}
Source: chromecache_405.1.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_405.1.dr	Binary or memory string: ",DisconnectVirtualMachine:"