Edit tour

Windows Analysis Report
https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi

Overview

General Information

Sample URL:	https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi
Analysis ID:	1648016
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Phishing site or detected (based on various text indicators)

Creates files inside the system directory

Deletes files inside the Windows folder

HTML page contains hidden javascript code

Yara signature match

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5708 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,1976209174990249533,4674015126003251835,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2060 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6736 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	evilnumpayload_fmtstr	Detect payload of EvilNum	Sekoia.io	0x1348e27:$fmtstr01: {"v":" 0xa9614b:$fmtstr02: ,"u":" 0x129ba9e:$fmtstr02: ,"u":" 0x1c88853:$fmtstr02: ,"u":" 0xa96242:$fmtstr03: ,"a":" 0xa9630d:$fmtstr03: ,"a":" 0xa9641d:$fmtstr03: ,"a":" 0xa9658b:$fmtstr03: ,"a":" 0xa9672c:$fmtstr03: ,"a":" 0xa969ba:$fmtstr03: ,"a":" 0xa96c56:$fmtstr03: ,"a":" 0xa96ce0:$fmtstr03: ,"a":" 0xa96d89:$fmtstr03: ,"a":" 0xa96185:$fmtstr04: ,"w":" 0x129bad1:$fmtstr04: ,"w":" 0x1c80dc7:$fmtstr04: ,"w":" 0x1c88886:$fmtstr04: ,"w":" 0xa95a9b:$fmtstr05: ,"d":" 0xa95d25:$fmtstr05: ,"d":" 0xa95f0e:$fmtstr05: ,"d":" 0xa96319:$fmtstr05: ,"d":"

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://login.microsoftonline-int.com

Avira URL Cloud: Label: phishing

Phishing

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 1.2	OCR Text: HERBSTREITH FOX GmbH co. KG Q File Home Insert Draw View Help Viewing v Tell me what you want to do 9 HERBSTREITH FOXGmbH Co. KG HERBSTREITH & FOX GmbH & Co. KG Add section + Add page Friday, March 21, 2025 12:31 AM Quick Notes HERBSTREITH & FOX PDF BITTE KLICKEN SIE HIER UM DAS DOKUMENT ANZUZEIGEN
Source: Chrome DOM: 1.9	OCR Text: HERBSTREITH FOX GmbH cov KG Q File Home Insert Draw View Help Viewing v Tell me what you want to do abc Styles v HERBSTREITH FOX GmbH co. KG HERBSTREITH & FOX GmbH & co. KG Add section + Add page Friday, March 21, 2025 12:31 AM Quick Notes HERBSTREITH & FOX G... PDF BITTE KLICKEN SIE HIER UM DAS DOKUMENT ANZUZEIGEN
Source: Chrome DOM: 1.5	OCR Text: HERBSTREITH FOX GmbH co. KG Q File Home Insert Draw View Help Viewing v Tell me what you want to do HERBSTREITH FOXGmbH Co. KG HERBSTREITH & FOX GmbH & Co. KG Add section + Add page Friday, March 21, 2025 12:31 AM Quick Notes HERBSTREITH & FOX PDF BITTE KLICKEN SIE HIER UM DAS DOKUMENT ANZUZEIGEN Suggested Avowed Premium Edition Upgrade your experience and forge your destiny. Buy Now Dismiss

Source: https://onedrive.live.com/personal/8fc032da5fada757/_layouts/15/Doc.aspx?sourcedoc=%7B6e530701-6b86-4081-97fd-52bb695fa645%7D&action=default&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84ZmMwMzJkYTVmYWRhNzU3L0VnRUhVMjZHYTRGQWxfMVN1MmxmcGtVQnFRSXRxcHAwbVA0XzVjaXBQRG1NY2c_ZT1QeUpWTWk&slrid=b3f78da1-80b4-c000-4620-e140ea6fff4d&originalPath=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84ZmMwMzJkYTVmYWRhNzU3L0VnRUhVMjZHYTRGQWxfMVN1MmxmcGtVQnFRSXRxcHAwbVA0XzVjaXBQRG1NY2c_cnRpbWU9enB3RnZwbHIzVWc&CID=583a7412-7b26-4875-89ab-da2ced3b5775&_SRM=0:G:44

HTTP Parser: Base64 decoded: {"siteid":"cbb03df8-52ec-485a-9b26-28a5becbf334","aud":"00000003-0000-0ff1-ce00-000000000000/onedrive.live.com@9188040d-6c67-4c5b-b112-36a304b66dad","exp":"1743334622"}

Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.12:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.12:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.57.90.69:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.57.90.69:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.57.90.69:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.219.36.103:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.111.229.20:443 -> 192.168.2.4:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.135.4.163:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.111.251.20:443 -> 192.168.2.4:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.72:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.235.226:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.152.20:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.109.16.3:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.40.179.51:443 -> 192.168.2.4:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.61.107:443 -> 192.168.2.4:49998 version: TLS 1.2

Source:	Binary string: this.vb[t.a.$4a]=B;u.rZb(this);this.ZIb()}MGa(){return r.b(this.Mb.CommandValueId)?this.Mb.MenuItemId:this.Mb.CommandValueId}YL(){return""}get id(){return this._id}get $ea(){return!1}get Hn(){return this.rXc}get A3(){return!!Ua.AFrameworkApplication.fa&&Ua.AFrameworkApplication.fa.Ea.qE}ZIb(){if(!this.behavior){var u=L.a.Pdb;u&&(this.behavior=u.ucf(this))}}get Mb(){return this.$a}get vb(){r.c(this.JTa)&&(this.JTa={});return this.JTa}get nFa(){r.c(this.gOa)&&(this.gOa={});return this.gOa}get iSb(){return m.a.Pf(this.Mb.IsDefinitive)}get Apb(){return m.a.Vy(this.Mb.ShouldSetTitle)}get fPc(){return this.Mb.TemplateAlias}get Iz(){return this.dK? source: chromecache_191.2.dr
Source:	Binary string: x=d(96012),z=d(60629),u=d(62280),B=d(73225),F=d(50625),D=d(13059),C=d(65097),I=d(72974),M=d(93168),K=d(48703),R=d(67590),T=d(79587),v=d(50952),N=d(44914);class Q{constructor(){this.MX=!1;this.EJe=this.PDb=0}ev(){return!0}iA(O){this.PDb=O.clientPoint.x;this.EJe=C.App.ha.oa.lg.container.clientWidth;return this.MX=!0}gt(O){this.MX&&C.App.ha.oa.lg.resize(this.EJe+r.a.V2f(O.clientPoint.x-this.PDb));return!0}gq(){this.cNb()}oB(){this.cNb()}cNb(){this.MX=!1;C.App.ha.cfa()}dispose(){}}(0,E.a)(Q,"NavigationPaneResizeAdapter", source: chromecache_195.2.dr
Source:	Binary string: null;this.pDb=this.AQa=!1;this.Opd=(x,z)=>{this.Kpa.insert(0,new L(z.commandId,z.controlId,z.time,z.commandSurface,z.inputMethod,z.contentType,z.w9));this.U5a(this.Kpa);this.AQa&&this.Xaa.MOd(z.controlId)&&this.Whd(z)}}init(){this.Xaa=new d;this.Kpa=new Ca.a;this.T$=new Ca.a;this.xBa=new Ca.a;this.jRa=k.AFrameworkApplication.J.tb("MaxCommandClickedEventQueueSize",20);l.a.ojd(this.Opd);r.a.instance.kjd((0,Ja.a)(this,this.T4d,"recordActionEvent"));this.AQa=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.UserMRUActionsCookieEnabled", source: chromecache_191.2.dr
Source:	Binary string: Jc._instance=null;(0,m.a)(Jc,"ControlBehaviorFactory",null,[784]);class Hd{get name(){return"CUI.Behavior"}configure(Sa){z.AFrameworkApplication.J&&z.AFrameworkApplication.J.Z("AccessibleMovingDialogsEnabled")&&Sa.tu($o,[pn.a]);Sa.tu(bu,[Fd.a])}async initializeAsync(){lc.a.Pdb=Jc.instance;const Sa=Qi.a.instance.AKc;for(let jb=0;jb<Sa.length;++jb){const zb=(0,C.a)(373,Sa[jb]);zb&&zb.MO()}Kh.a.get_instance().zr(6)}dispose(){}static main(){u.a.instance.hq(new Hd,5)}}(0,m.a)(Hd,"CuiBehaviorPackage",null, source: chromecache_191.2.dr
Source:	Binary string: this.Xaa.MOd(z.controlId)&&this.Whd(z)}}init(){this.Xaa=new d;this.Kpa=new Ca.a;this.T$=new Ca.a;this.xBa=new Ca.a;this.jRa=k.AFrameworkApplication.J.tb("MaxCommandClickedEventQueueSize",20);l.a.ojd(this.Opd);r.a.instance.kjd((0,Ja.a)(this,this.T4d,"recordActionEvent"));this.AQa=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.UserMRUActionsCookieEnabled",!1);this.pDb=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.ShouldPreferParentControls", source: chromecache_316.2.dr
Source:	Binary string: this.ga.resolve("Box4.Actors.StyleActor").ib()}dispose(){}static main(){u.a.instance.Rd(new QC)}}(0,m.a)(QC,"Box4ActorsPackage",null,[0,1]);class hl{constructor(Sa,jb,zb,Kb,Vb,pc){this.rpe=this.Epa=null;this.ia=Sa;this.UHg=jb;this.l7c=zb;this.Vm=Kb;this.mc=Vb;this.Ci=pc}get recentColors(){return hl.OBb\|\|(hl.OBb=ff.a.instance.va("Box4.UI.RecentColorsSectionHandler"))}get Aae(){this.Epa\|\|(this.Epa=new oF("Shading"),this.iRb(this.Epa));return this.Epa}iRb(Sa){Sa.CEa(2,jj.a.pdb);Sa.CEa(3,jj.a.gga);Sa.CEa(4, source: chromecache_191.2.dr
Source:	Binary string: null,[]);class h{constructor(x,z,u,B){this.CmdId=this.ParentTcid=this.Tcid=null;this.Time=0;this.Tcid=x;this.ParentTcid=z;this.CmdId=u;this.Time=B}}(0,Fa.a)(h,"MRUControl",null,[]);var k=J(51647),l=J(76327),r=J(50478),t=J(62733);class m{constructor(){this.Xaa=null;this.uzb=this.jRa=20;this.ora=this.yz=this.xBa=this.T$=this.Kpa=null;this.pDb=this.AQa=!1;this.Opd=(x,z)=>{this.Kpa.insert(0,new L(z.commandId,z.controlId,z.time,z.commandSurface,z.inputMethod,z.contentType,z.w9));this.U5a(this.Kpa);this.AQa&& source: chromecache_316.2.dr
Source:	Binary string: I.activeSection&&(I=I.activeSection.Yb(M))&&(C=I.label);m.a.xu(K,C)}static z1a(){m.a.eo(F.AppFrame.Yea)}}(0,E.a)(D,"ASectionListView",m.a,[])},56805:function(E,L,d){d.d(L,{a:function(){return M}});E=d(100);var h=d(77072),k=d(57531),l=d(96012),r=d(60629),t=d(73225),m=d(93651),x=d(65097),z=d(305),u=d(71987),B=d(79587),F=d(19655),D=d(50952),C=d(87478);class I{constructor(K){this.MX=!1;this.FJe=this.PDb=0;this.eF=K}ev(){return this.eF.eod()}iA(K){if(!this.ev(K))return this.MX=!1;this.PDb=K.clientPoint.x; source: chromecache_195.2.dr
Source:	Binary string: this.FJe=this.eF.container.clientWidth;return this.MX=!0}gt(K){this.MX&&this.eF.resize(this.FJe+C.a.V2f(K.clientPoint.x-this.PDb));return!0}gq(){this.cNb()}oB(){this.cNb()}cNb(){this.MX=!1;x.App.ha.cfa()}dispose(){}}(0,E.a)(I,"ListViewResizeAdapter",null,[431,44]);class M extends m.a{constructor(K){super(new F.a,m.a.Ywc,x.App.bX);this.Gba=this.aY=this.vaa=this.nU=this.FX=this.OBa=null;this.isa=4294967295;this.cCa=!1;this.JN=!0;this.zz=K}get resizeMinWidth(){return 0}get resizeMaxWidth(){return 350}get Wda(){return this.OBa}get QHa(){return this.vaa}get Sla(){return this.FX}get $Sb(){return!0}get isCollapsed(){return this.cCa}set isCollapsed(K){this.cCa= source: chromecache_195.2.dr
Source:	Binary string: 1028);this.ia.la(jj.a.pdb,Sl.a.view,rA.BNb);this.ia.la(jj.a.pdb,Sl.a.tableCell,(0,ye.a)(this,this.pdb,"clearCellShadingColor"));this.ia.Wb(jj.a.pdb,1028);this.ia.la(jj.a.a3a,Sl.a.view,(0,ye.a)(this,this.VSi,"queryCellShadingColorView"));this.ia.la(jj.a.a3a,Sl.a.tableCell,(0,ye.a)(this,this.a3a,"queryCellShadingColor"));this.ia.Wb(jj.a.a3a,1124);this.ia.la(jj.a.f0b,Sl.a.view,rA.BNb);this.ia.la(jj.a.f0b,Sl.a.tableCell,(0,ye.a)(this,this.S0g,"cellShadingCustomColor"));this.ia.Wb(jj.a.f0b,1028);this.ia.la(jj.a.hSf, source: chromecache_191.2.dr
Source:	Binary string: Ua.AFrameworkApplication.fa.Ea.qE}ZIb(){if(!this.behavior){var u=L.a.Pdb;u&&(this.behavior=u.ucf(this))}}get Mb(){return this.$a}get vb(){r.c(this.JTa)&&(this.JTa={});return this.JTa}get nFa(){r.c(this.gOa)&&(this.gOa={});return this.gOa}get iSb(){return m.a.Pf(this.Mb.IsDefinitive)}get Apb(){return m.a.Vy(this.Mb.ShouldSetTitle)}get fPc(){return this.Mb.TemplateAlias}get Iz(){return this.dK?E.a.bSe:E.a.BH}aYa(u){if(-1===this.daa.indexOf(","+u+","))throw Error.create("The display mode with name: "+ source: chromecache_316.2.dr
Source:	Binary string: 4034531111;h.Cta=319972657;h.VVa=1892407702;h.QHb=329522368;h.Hca=3386890908;h.WHb=70356481;h.bIb=1303135280;h.centerJustify=4284004393;h.eFa=3332601592;h.W0g=3523575366;h.fdb=1880533947;h.gdb=768894625;h.Y0g=3230325101;h.dIb=2981608035;h.Olc=3502060538;h.hdb=4291024442;h.Iod=1943062421;h.g1g=3246658478;h.EVe=3281315808;h.DVe=3968581736;h.cC=2858610352;h.pdb=3275596206;h.rdb=562361573;h.U1=3491966299;h.clearFormatting=2319895756;h.gpd=2449130731;h.iWa=1011300372;h.wXe=3589727007;h.uIb=3901727243; source: chromecache_195.2.dr
Source:	Binary string: !0);this.AQa&&(this.yz=new Ca.a,this.ora="UserRecentActions_"+this.bgb(),this.AQd())}bgb(){switch(k.AFrameworkApplication.fa.Ea.Ng){case 3:return"Word";case 1:return"Excel";case 2:return"PowerPoint";case 5:return"Visio";case 4:return"OneNote";default:return"Unknown"}}AQd(){var x=t.a.get(this.ora);if(!this.Xaa.isNullOrUndefined(x)&&0<x.length){let z=null;try{z=JSON.parse(decodeURIComponent(x))}catch(u){t.a.remove(this.ora);return}x=0;for(const u of z)this.yz.insert(x++,u)}}Whd(x){const z=this.pDb&& source: chromecache_316.2.dr
Source:	Binary string: return}x=0;for(const u of z)this.yz.insert(x++,u)}}Whd(x){const z=this.pDb&&!this.Xaa.isNullOrUndefined(x.w9)&&0<x.w9.length;if(0<this.yz.count){for(var u=0;u<this.yz.count&&3>u;u++){var B=this.yz.K(u);if(z&&B.ParentTcid===x.w9\|\|B.Tcid===x.controlId)return}for(u=3;u<this.yz.count;u++)if(B=this.yz.K(u),z&&B.ParentTcid===x.w9\|\|B.Tcid===x.controlId){this.yz.remove(B);break}}this.yz.insert(0,new h(x.controlId,x.w9,x.commandId,x.time));this.yz.count>this.uzb&&this.yz.removeAt(this.uzb);x=JSON.stringify(this.yz.toArray()); source: chromecache_191.2.dr
Source:	Binary string: !1);this.pDb=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.ShouldPreferParentControls",!0);this.AQa&&(this.yz=new Ca.a,this.ora="UserRecentActions_"+this.bgb(),this.AQd())}bgb(){switch(k.AFrameworkApplication.fa.Ea.Ng){case 3:return"Word";case 1:return"Excel";case 2:return"PowerPoint";case 5:return"Visio";case 4:return"OneNote";default:return"Unknown"}}AQd(){var x=t.a.get(this.ora);if(!this.Xaa.isNullOrUndefined(x)&&0<x.length){let z=null;try{z=JSON.parse(decodeURIComponent(x))}catch(u){t.a.remove(this.ora); source: chromecache_191.2.dr

Source: chrome.exe

Memory has grown: Private usage: 7MB later: 54MB

Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.195
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.195
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.195
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi HTTP/1.1Host: 1drv.msConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /:o:/g/personal/8FC032DA5FADA757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?resid=8FC032DA5FADA757!s6e5307016b86408197fd52bb695fa645&ithint=onenote&e=PyJVMi&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84ZmMwMzJkYTVmYWRhNzU3L0VnRUhVMjZHYTRGQWxfMVN1MmxmcGtVQnFRSXRxcHAwbVA0XzVjaXBQRG1NY2c_ZT1QeUpWTWk HTTP/1.1Host: onedrive.live.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/8fc032da5fada757/_layouts/15/Doc.aspx?sourcedoc=%7B6e530701-6b86-4081-97fd-52bb695fa645%7D&action=default&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84ZmMwMzJkYTVmYWRhNzU3L0VnRUhVMjZHYTRGQWxfMVN1MmxmcGtVQnFRSXRxcHAwbVA0XzVjaXBQRG1NY2c_ZT1QeUpWTWk&slrid=b3f78da1-80b4-c000-4620-e140ea6fff4d&originalPath=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84ZmMwMzJkYTVmYWRhNzU3L0VnRUhVMjZHYTRGQWxfMVN1MmxmcGtVQnFRSXRxcHAwbVA0XzVjaXBQRG1NY2c_cnRpbWU9enB3RnZwbHIzVWc&CID=583a7412-7b26-4875-89ab-da2ced3b5775&_SRM=0:G:44 HTTP/1.1Host: onedrive.live.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2VlZDJhMWU3OTAyN2Q4Yjc0MzQwMjNjZTNmYTI0YjRlY2Q2NWNkOWQxNmIyNmJjNmI4Y2VmZTc4ZDRmODIyZjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZWVkMmExZTc5MDI3ZDhiNzQzNDAyM2NlM2ZhMjRiNGVjZDY1Y2Q5ZDE2YjI2YmM2YjhjZWZlNzhkNGY4MjJmMiwxMzM4NzM4MDEyMTAwMDAwMDAsMCwxMzM4NzQ2NjIyMTgzNzMzNjgsMC4wLjAuMCwyNTgsOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkLCwsZmFhYTVhZTYtMmE1Mi00OGMyLTgwMmItZmUxODY5NmFiNzllLGZhYWE1YWU2LTJhNTItNDhjMi04MDJiLWZlMTg2OTZhYjc5ZSxFSkVYYnBwNC9rbXlGc3RHa1JmcUtRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODkwNDksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLG1kdFlhcTVZdEdKT25sMjNHNVBzTXhIamU1NEhMR3ROcUJCVXVIZ1AxendidjhTeTAvQmJSUXZzbFJLYVo0Mlhob2VtR3hmMENyVkxHYWJmeVJITlJaRTFpZ21JUmh5TDRrUm5ieS9jai9jOTlRVmJNVXFqZFBVU2pSRnJkWi9tUHlXeExJU2M0bHdkWlNTUm5UZnVxWGJnRjZNUkNQQlRvN3hPUmFPNXRoSy9ndUVBM3BncU1haDBpTzFpaVAwek9OVHNPUk43WDhmaW5vNUxYZEM4YVpZTHZiUGlrQmZOMHFxM2pCcFdGb3hLVC9PUjA4ZkJqckNVeXhKZWxWQmc1eDdWNUZDS2twWmJndTlxTnc5L2hMdGJLS0l0eCsrd3ZKQVVUOFVUY25yQUEzMFI2QmhqeW9jNVgybllIUVNvblY5Ukp5eGd3c0cwaTdiSitHZnBEdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /files/odsp-web-prod_2025-03-14.006/wacowlhostwebpack/wacowlhostwebpack.js HTTP/1.1Host: res-1.public.onecdn.static.microsoftConnection: keep-aliveOrigin: https://onedrive.live.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/sp-client/odsp.react/odsp.react.lib-9ea4d016.js HTTP/1.1Host: res-1.public.onecdn.static.microsoftConnection: keep-aliveOrigin: https://onedrive.live.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/odsp-web-prod_2025-03-14.006/require-f6228139.js HTTP/1.1Host: res-1.public.onecdn.static.microsoftConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/sp-client/odsp.1ds/odsp.1ds.lib-6996f8ab.js HTTP/1.1Host: res-1.public.onecdn.static.microsoftConnection: keep-aliveOrigin: https://onedrive.live.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/sp-client/odsp.knockout/odsp.knockout.lib-447adea9.js HTTP/1.1Host: res-1.public.onecdn.static.microsoftConnection: keep-aliveOrigin: https://onedrive.live.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/odsp-web-prod_2025-03-14.006/wacowlhostwebpack/en-us/ondemand.resx.js HTTP/1.1Host: res-1.public.onecdn.static.microsoftConnection: keep-aliveOrigin: https://onedrive.live.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/odsp-web-prod_2025-03-14.006/wacowlhostwebpack/2.js HTTP/1.1Host: res-1.public.onecdn.static.microsoftConnection: keep-aliveOrigin: https://onedrive.live.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/odsp-web-prod_2025-03-14.006/wacowlhostwebpack/10.js HTTP/1.1Host: res-1.public.onecdn.static.microsoftConnection: keep-aliveOrigin: https://onedrive.live.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/odsp-web-prod_2025-03-14.006/wacowlhostwebpack/17.js HTTP/1.1Host: res-1.public.onecdn.static.microsoftConnection: keep-aliveOrigin: https://onedrive.live.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/odsp-web-prod_2025-03-14.006/wacowlhostwebpack/14.js HTTP/1.1Host: res-1.public.onecdn.static.microsoftConnection: keep-aliveOrigin: https://onedrive.live.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/fabric/assets/icons/fabricmdl2icons.woff HTTP/1.1Host: spoprod-a.akamaihd.netConnection: keep-aliveOrigin: https://onenote.officeapps.live.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /campaignmetadataaggregator?country=US&locale=en-US&app=2158&platform=Web&version=16.0.18718.41003&campaignParams=pageWidth%3D1280%26pageHeight%3D897%26screenWidth%3D1280%26screenHeight%3D1024%26colorDepth%3D24%26more%3Dtrue%26OFC_Audience%3DProduction%26Datacenter%3DPUS3%26TenantId%3D9188040d-6c67-4c5b-b112-36a304b66dad%26SelfTriggerActivity%3D%26&contentType=CampaignContent%3BDynamicSettings&puid=&OFC_FLIGHTS=&ageGroup=0&sessionUserType=2 HTTP/1.1Host: messaging.engagement.office.comConnection: keep-alivex-clientsessionid: fd55f5ea-9dc4-43fb-4d97-a280150d6bb5sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0x-correlationid: 27515f35-6be9-4ca7-9e4d-21d8cce8e2a9Accept: /Origin: https://onenote.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mydata/myprofile/expressionprofile/profilephoto:UserTileStatic,UserTileSmall/MeControlMediumUserTile?ck=1&ex=24&fofoff=1&sc=1742906233697 HTTP/1.1Host: storage.live.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: augloop.office.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://onenote.officeapps.live.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: nMX8DO5oSkkOlK0GqFu7UQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /me?partner=OneNoteOnline&version=latest&market=EN-US&wrapperId=suiteshell HTTP/1.1Host: amcdn.msftauth.netConnection: keep-aliveOrigin: https://onenote.officeapps.live.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /officeaddins/learningtools/?et= HTTP/1.1Host: www.onenote.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.0.5/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000111.resources.office.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://onenote.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2404.23003/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000096.resources.office.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://onenote.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.0.5/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000110.resources.office.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://onenote.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2409.12011/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000138.resources.office.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://onenote.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2502.18015/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000128.resources.office.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://onenote.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2503.17004/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000012.resources.office.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://onenote.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveOrigin: https://onenote.officeapps.live.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/jQuery/jquery-3.5.0.min.js HTTP/1.1Host: ajax.aspnetcdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.onenote.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /campaignmetadataaggregator?country=US&locale=en-US&app=2158&platform=Web&version=16.0.18718.41003&campaignParams=pageWidth%3D1280%26pageHeight%3D897%26screenWidth%3D1280%26screenHeight%3D1024%26colorDepth%3D24%26more%3Dtrue%26OFC_Audience%3DProduction%26Datacenter%3DPUS3%26TenantId%3D9188040d-6c67-4c5b-b112-36a304b66dad%26SelfTriggerActivity%3D%26&contentType=CampaignContent%3BDynamicSettings&puid=&OFC_FLIGHTS=&ageGroup=0&sessionUserType=2 HTTP/1.1Host: messaging.engagement.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2409.12011/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000138.resources.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2404.23003/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000096.resources.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2503.17004/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000012.resources.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.0.5/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000111.resources.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.0.5/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000110.resources.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2502.18015/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000128.resources.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /officeaddins/RemoteUls.ashx HTTP/1.1Host: www.onenote.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 1drv.ms
Source: global traffic	DNS traffic detected: DNS query: onedrive.live.com
Source: global traffic	DNS traffic detected: DNS query: res-1.public.onecdn.static.microsoft
Source: global traffic	DNS traffic detected: DNS query: common.online.office.com
Source: global traffic	DNS traffic detected: DNS query: spoprod-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: messaging.engagement.office.com
Source: global traffic	DNS traffic detected: DNS query: storage.live.com
Source: global traffic	DNS traffic detected: DNS query: augloop.office.com
Source: global traffic	DNS traffic detected: DNS query: amcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: www.onenote.com
Source: global traffic	DNS traffic detected: DNS query: fa000000012.resources.office.net
Source: global traffic	DNS traffic detected: DNS query: fa000000096.resources.office.net
Source: global traffic	DNS traffic detected: DNS query: fa000000110.resources.office.net
Source: global traffic	DNS traffic detected: DNS query: fa000000111.resources.office.net
Source: global traffic	DNS traffic detected: DNS query: fa000000128.resources.office.net
Source: global traffic	DNS traffic detected: DNS query: fa000000138.resources.office.net
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: onenoteonline.nel.measure.office.net

Source: unknown

HTTP traffic detected: POST /suite/RemoteUls.ashx?usid=c7fcd40e-f3d7-df9e-33b8-2b7b036eb358&officeserverversion= HTTP/1.1Host: common.online.office.comConnection: keep-aliveContent-Length: 699sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0Accept: */*Origin: https://onedrive.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chromecache_329.2.dr, chromecache_259.2.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_300.2.dr	String found in binary or memory: http://hammerjs.github.io/
Source: chromecache_284.2.dr, chromecache_287.2.dr, chromecache_219.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_195.2.dr	String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml
Source: chromecache_329.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_195.2.dr	String found in binary or memory: https://1drv.ms
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://Office.net
Source: chromecache_231.2.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.5.0.min.js
Source: chromecache_316.2.dr	String found in binary or memory: https://aka.ms/MathAssistantSupport?client_id=onenote_wac&platform_id=web&correlation_id=
Source: chromecache_316.2.dr	String found in binary or memory: https://api.addins.omex.office.net/
Source: chromecache_191.2.dr	String found in binary or memory: https://apps.apple.com/in/app/microsoft-onenote/id410395246
Source: chromecache_195.2.dr	String found in binary or memory: https://attributes.engagement.office-int.com
Source: chromecache_195.2.dr	String found in binary or memory: https://attributes.engagement.office.com
Source: chromecache_195.2.dr	String found in binary or memory: https://attributes.engagement.officeppe.com
Source: chromecache_178.2.dr	String found in binary or memory: https://augloop.office.com/v2;394866fc-eedb-4f01-8536-3ff84b16be2a;liveprofilecard.access;https://sh
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://c3web.trafficmanager.net
Source: chromecache_195.2.dr	String found in binary or memory: https://cdn.dev.fluidpreview.office.net
Source: chromecache_195.2.dr	String found in binary or memory: https://cdn.dev.fluidpreview.office.net/fluid/dev
Source: chromecache_195.2.dr	String found in binary or memory: https://cdn.dev.fluidpreview.office.net/fluid/stg
Source: chromecache_195.2.dr	String found in binary or memory: https://cdn.fluidpreview.office.net
Source: chromecache_195.2.dr	String found in binary or memory: https://cdn.fluidpreview.office.net/fluid/df
Source: chromecache_195.2.dr	String found in binary or memory: https://cdn.fluidpreview.office.net/fluid/gcc
Source: chromecache_195.2.dr	String found in binary or memory: https://cdn.fluidpreview.office.net/fluid/prod
Source: chromecache_191.2.dr	String found in binary or memory: https://cdn.hubblecontent.msit.osi.office.net
Source: chromecache_191.2.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net
Source: chromecache_231.2.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161872440461_Scripts/BrowserUls.js
Source: chromecache_231.2.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161872440461_Scripts/CommonDiagnostics.js
Source: chromecache_231.2.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161872440461_Scripts/ExternalResources/js-cookie.js
Source: chromecache_231.2.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161872440461_Scripts/Instrumentation.js
Source: chromecache_231.2.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161872440461_Scripts/LearningTools/LearningTools.js
Source: chromecache_231.2.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161872440461_Scripts/aria-web-telemetry-2.9.0.min.js
Source: chromecache_231.2.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161872440461_Scripts/pickadate.min.js
Source: chromecache_291.2.dr, chromecache_320.2.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/images/meetings/insert_outlook_meeting_details16x16.png
Source: chromecache_291.2.dr, chromecache_320.2.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/images/meetings/insert_outlook_meeting_details32x32.png
Source: chromecache_291.2.dr, chromecache_320.2.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/images/meetings/insert_outlook_meeting_details48x48.png
Source: chromecache_291.2.dr, chromecache_320.2.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/images/meetings/insert_outlook_meeting_details80x80.png
Source: chromecache_316.2.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: chromecache_195.2.dr	String found in binary or memory: https://content.lifecycle.officeppe.net/
Source: chromecache_195.2.dr	String found in binary or memory: https://contentstorage.osi.office.net/images/2f4febe2cca96f7f.gif
Source: chromecache_195.2.dr	String found in binary or memory: https://contentstorage.osi.office.net/images/eb14b3fe6a1e1671.png
Source: chromecache_195.2.dr	String found in binary or memory: https://ecs.office.com
Source: chromecache_191.2.dr	String found in binary or memory: https://edog.onenote.com
Source: chromecache_195.2.dr	String found in binary or memory: https://eurppc-word-edit.officeapps.live.com
Source: chromecache_195.2.dr	String found in binary or memory: https://fa000000096.resources.office.net
Source: chromecache_195.2.dr	String found in binary or memory: https://fa000000096.resources.office.net/f7024bdc-7caf-4ca8-807d-2908f09640d6/1.0.2210.23001/en-us_w
Source: chromecache_195.2.dr	String found in binary or memory: https://fa000000096.resources.office.net/f7024bdc-7caf-4ca8-807d-2908f09640d6/1.0.2401.26003/en-us_w
Source: chromecache_223.2.dr, chromecache_338.2.dr	String found in binary or memory: https://fa000000128.resources.office.net
Source: chromecache_223.2.dr, chromecache_338.2.dr	String found in binary or memory: https://fa000000128.resources.office.net:3000/index_onenotejs.html
Source: chromecache_210.2.dr, chromecache_195.2.dr	String found in binary or memory: https://feross.org
Source: chromecache_210.2.dr, chromecache_195.2.dr	String found in binary or memory: https://feross.org/opensource
Source: chromecache_195.2.dr	String found in binary or memory: https://ffc-word-edit.officeapps.live.com
Source: chromecache_195.2.dr	String found in binary or memory: https://ffc-word-view.officeapps.live.com
Source: chromecache_195.2.dr	String found in binary or memory: https://fil1-word-edit.officeapps.live.com
Source: chromecache_195.2.dr	String found in binary or memory: https://fin1-word-edit.officeapps.live.com
Source: chromecache_316.2.dr	String found in binary or memory: https://forms.office.com
Source: chromecache_316.2.dr	String found in binary or memory: https://forms.office.com/Pages/OneNoteMathAddinFunctionPage.aspx
Source: chromecache_257.2.dr, chromecache_316.2.dr, chromecache_250.2.dr	String found in binary or memory: https://forms.officeppe.com
Source: chromecache_195.2.dr	String found in binary or memory: https://fus1-word-edit.officeapps.live.com
Source: chromecache_213.2.dr, chromecache_253.2.dr	String found in binary or memory: https://github.com/OfficeDev/office-js/blob/release/LICENSE.md
Source: chromecache_260.2.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_195.2.dr	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: chromecache_329.2.dr	String found in binary or memory: https://github.com/webpack-contrib/style-loader#insertat)
Source: chromecache_191.2.dr	String found in binary or memory: https://hedwigtestserver.blob.core.windows.net/builds/
Source: chromecache_191.2.dr	String found in binary or memory: https://hubblecontent.azureedge.eaglex.ic.gov
Source: chromecache_191.2.dr	String found in binary or memory: https://hubblecontent.azureedge.microsoft.scloud
Source: chromecache_316.2.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore/flyoutdetails/
Source: chromecache_210.2.dr	String found in binary or memory: https://localcdn.centro-dev.com:5555/floodgate.bundle.js.map
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://login.live-int.com
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://login.live.com
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://login.microsoftonline-int.com
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://login.windows.net
Source: chromecache_198.2.dr, chromecache_195.2.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: chromecache_316.2.dr	String found in binary or memory: https://office.visualstudio.com/DefaultCollection/OC/_wiki/wikis/OC.wiki/22688/Using-Dictation-on-yo
Source: chromecache_223.2.dr, chromecache_338.2.dr	String found in binary or memory: https://officeapps.live.com
Source: chromecache_316.2.dr	String found in binary or memory: https://onedrive.live.com
Source: chromecache_178.2.dr	String found in binary or memory: https://onenote.officeapps.live.com
Source: chromecache_191.2.dr	String found in binary or memory: https://osizewuspersimmon001.blob.core.windows.net
Source: chromecache_191.2.dr	String found in binary or memory: https://osiziwuspersimmon002.blob.core.windows.net
Source: chromecache_191.2.dr	String found in binary or memory: https://osizpscuspersimmon000.blob.core.windows.net
Source: chromecache_195.2.dr	String found in binary or memory: https://outlook-1-cdn.azureedge.eaglex.ic.gov
Source: chromecache_195.2.dr	String found in binary or memory: https://outlook-1-cdn.azureedge.microsoft.scloud
Source: chromecache_290.2.dr	String found in binary or memory: https://pf.events.data.cloudapp.onecollector.akadns.net/OneCollector/1.0/
Source: chromecache_198.2.dr	String found in binary or memory: https://portal.office.com/
Source: chromecache_195.2.dr	String found in binary or memory: https://ppc-word-edit.officeapps.live.com
Source: chromecache_195.2.dr	String found in binary or memory: https://ppc-word-view.officeapps.live.com
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://prod.support.office.com
Source: chromecache_213.2.dr, chromecache_253.2.dr, chromecache_204.2.dr	String found in binary or memory: https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE
Source: chromecache_259.2.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_195.2.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_195.2.dr	String found in binary or memory: https://res-1.cdn.partner.office365.cn
Source: chromecache_195.2.dr	String found in binary or memory: https://res-2-dev.cdn.officeppe.net
Source: chromecache_195.2.dr	String found in binary or memory: https://res-2-sdf.cdn.office.net
Source: chromecache_195.2.dr	String found in binary or memory: https://res-2.cdn.office.net
Source: chromecache_191.2.dr	String found in binary or memory: https://res-dev.cdn.officeppe.net
Source: chromecache_191.2.dr	String found in binary or memory: https://res-dev.cdn.officeppe.net/mirrored/smartlookup/
Source: chromecache_195.2.dr	String found in binary or memory: https://res-dod.cdn.office.net
Source: chromecache_195.2.dr	String found in binary or memory: https://res-dod.cdn.office.net/fluid/dod
Source: chromecache_195.2.dr	String found in binary or memory: https://res-gcch.cdn.office.net
Source: chromecache_195.2.dr	String found in binary or memory: https://res-gcch.cdn.office.net/fluid/gcch
Source: chromecache_195.2.dr	String found in binary or memory: https://res-h1.cdn.office.net
Source: chromecache_223.2.dr, chromecache_338.2.dr	String found in binary or memory: https://res-h3.public.cdn.office.net
Source: chromecache_223.2.dr, chromecache_338.2.dr	String found in binary or memory: https://res-h3.sdf.cdn.office.net
Source: chromecache_195.2.dr	String found in binary or memory: https://res-sdf.cdn.office.net
Source: chromecache_195.2.dr	String found in binary or memory: https://res-v-sdf.cdn.office.net
Source: chromecache_195.2.dr	String found in binary or memory: https://res.cdn.office.net
Source: chromecache_190.2.dr	String found in binary or memory: https://res.cdn.office.net/admincenter/admin-main/2025.3.17.0/
Source: chromecache_190.2.dr	String found in binary or memory: https://res.cdn.office.net/admincenter/admin-main/2025.3.17.0/floodgate.en.bundle.js
Source: chromecache_223.2.dr, chromecache_338.2.dr	String found in binary or memory: https://res.sdf.cdn.office.net
Source: chromecache_195.2.dr	String found in binary or memory: https://roaming.edog.officeapps.live.com/rs/v1/settings
Source: chromecache_195.2.dr	String found in binary or memory: https://roaming.officeapps.live.com/rs/v1/settings
Source: chromecache_195.2.dr	String found in binary or memory: https://roaming.officeapps.partner.office365.cn/rs/v1/settings
Source: chromecache_195.2.dr	String found in binary or memory: https://roaming.osi.apps.mil/rs/v1/settings
Source: chromecache_195.2.dr	String found in binary or memory: https://roaming.osi.office.de/rs/v1/settings
Source: chromecache_195.2.dr	String found in binary or memory: https://roaming.osi.office365.us/rs/v1/settings
Source: chromecache_316.2.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/suggestions
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://support.office.com
Source: chromecache_195.2.dr	String found in binary or memory: https://support.office.com/article/7afcb4f3-4aa2-443a-9b08-125a5d692576
Source: chromecache_191.2.dr	String found in binary or memory: https://support.office.com/article/ec43ed03-eb3c-4a10-8d9d-e9e5433c9ed2
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://support.office.com/f1/SDX/drawing
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://support.office.com/f1/SDX/excel
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://support.office.com/f1/SDX/onenote
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://support.office.com/f1/SDX/outlook
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://support.office.com/f1/SDX/powerpoint
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://support.office.com/f1/SDX/project
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://support.office.com/f1/SDX/word
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://support.office.com/f1/home/isAgave=true&helpid=126385
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://support.office.com/f1/home?isAgave=true
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://support.office.com/f1/home?isAgave=true&helpid=161255
Source: chromecache_314.2.dr	String found in binary or memory: https://support.office.com/icon32.png
Source: chromecache_264.2.dr, chromecache_314.2.dr	String found in binary or memory: https://support.office.com/icon80.png
Source: chromecache_290.2.dr	String found in binary or memory: https://tb.events.data.cloudapp.onecollector.akadns.net/OneCollector/1.0/
Source: chromecache_191.2.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/
Source: chromecache_191.2.dr	String found in binary or memory: https://uci.edog.cdn.office.net/mirrored/smartlookup/
Source: chromecache_195.2.dr	String found in binary or memory: https://whiteboard.apps.mil
Source: chromecache_195.2.dr	String found in binary or memory: https://whiteboard.eaglex.ic.gov
Source: chromecache_195.2.dr	String found in binary or memory: https://whiteboard.microsoft.scloud
Source: chromecache_195.2.dr	String found in binary or memory: https://whiteboard.office.com/root/index.fluid.js
Source: chromecache_195.2.dr	String found in binary or memory: https://whiteboard.office365.us
Source: chromecache_178.2.dr	String found in binary or memory: https://wise-m-backup.public.onecdn.static.microsoft/wise/owl/sharedauthclientmsal.cba681cd5e09f5e92
Source: chromecache_178.2.dr	String found in binary or memory: https://wise.public.cdn.office.net/wise/owl/sharedauthclientmsal.cba681cd5e09f5e9220a.js
Source: chromecache_195.2.dr	String found in binary or memory: https://word-edit.officeapps.live.com
Source: chromecache_195.2.dr	String found in binary or memory: https://wordwebclientbuilds.blob.core.windows.net
Source: chromecache_290.2.dr	String found in binary or memory: https://www.office.com/launch
Source: chromecache_191.2.dr	String found in binary or memory: https://www.onenote.com
Source: chromecache_316.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/mathassistant
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=af-ZA&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=am-ET&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ar-SA&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=as-IN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=az-Latn-AZ&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=be-BY&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=bg-BG&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=bn-BD&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=bn-IN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=bs-Latn-BA&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ca-ES&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ca-ES-valencia&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=cs-CZ&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=cy-GB&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=da-DK&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=de-DE&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=el-GR&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=en-US&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=es-ES&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=et-EE&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=eu-ES&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=fa-IR&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=fi-FI&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=fil-PH&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=fr-FR&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ga-IE&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=gd-GB&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=gl-ES&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=gu-IN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ha-Latn-NG&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=he-IL&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=hi-IN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=hr-HR&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=hu-HU&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=hy-AM&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=id-ID&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ig-NG&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=is-IS&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=it-IT&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ja-JP&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ka-GE&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=kk-KZ&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=km-KH&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=kn-IN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ko-KR&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=kok-IN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ku-Arab-IQ&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ky-KG&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=lb-LU&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=lt-LT&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=lv-LV&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mi-NZ&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mk-MK&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ml-IN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mn-MN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mr-IN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ms-MY&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mt-MT&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=nb-NO&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ne-NP&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=nl-NL&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=nn-NO&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=nso-ZA&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=or-IN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pa-Arab-PK&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pa-IN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pl-PL&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=prs-AF&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pt-BR&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pt-PT&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=quz-PE&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ro-RO&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ru-RU&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=rw-RW&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sd-Arab-PK&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=si-LK&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sk-SK&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sl-SI&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sq-AL&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sr-Cyrl-BA&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sr-Cyrl-RS&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sr-Latn-RS&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sv-SE&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sw-KE&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ta-IN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=te-IN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tg-Cyrl-TJ&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=th-TH&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ti-ET&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tk-TM&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tn-ZA&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tr-TR&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tt-RU&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ug-CN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=uk-UA&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ur-PK&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=uz-Latn-UZ&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=vi-VN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=wo-SN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=xh-ZA&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=yo-NG&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=zh-CN&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=zh-TW&temporaryLocalization=true
Source: chromecache_320.2.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=zu-ZA&temporaryLocalization=true

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989

Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.12:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.12:443 -> 192.168.2.4:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.57.90.69:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.57.90.69:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.57.90.69:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.219.36.103:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.111.229.20:443 -> 192.168.2.4:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.135.4.163:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.111.251.20:443 -> 192.168.2.4:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.72:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.235.226:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.152.20:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.109.16.3:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.40.179.51:443 -> 192.168.2.4:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.202.61.107:443 -> 192.168.2.4:49998 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: sslproxydump.pcap, type: PCAP

Matched rule: Detect payload of EvilNum Author: Sekoia.io

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir5708_623295119

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir5708_623295119

Jump to behavior

Source: sslproxydump.pcap, type: PCAP

Matched rule: evilnumpayload_fmtstr author = Sekoia.io, description = Detect payload of EvilNum, creation_date = 2022-07-25, classification = TLP:CLEAR, version = 1.1, id = 980c58e4-e04d-4076-a92e-2c04ced19ece

Source: chromecache_195.2.dr

Binary or memory string: new r.a(t.a.Ad());const C=".3gp .aa .aac .aax .act .aiff .amr .ape .au .awb .dct .dss .dvf .flac .gsm .iklax .ivs .m4a .m4b .m4p .mmf .mp3 .mpc .msv .ogg .oga .mogg .opus .ra .rm .raw .sln .tta .vox .wav .webm .wma .wv".split(" ");for(const I of C)D.pbc.add(I)}return D.pbc}static C9h(C){return D.JRh().contains(C)}static zdi(C){C=x.uCh(C);return""!==document.createElement("audio").canPlayType(C)}}D.pbc=null;(0,E.a)(D,"EmbeddedFileReaderUtils",null,[])},61068:function(E,L,d){d.d(L,{a:function(){return k}});

Source: classification engine

Classification label: mal60.phis.win@26/288@68/18

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,1976209174990249533,4674015126003251835,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2060 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,1976209174990249533,4674015126003251835,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2060 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: this.vb[t.a.$4a]=B;u.rZb(this);this.ZIb()}MGa(){return r.b(this.Mb.CommandValueId)?this.Mb.MenuItemId:this.Mb.CommandValueId}YL(){return""}get id(){return this._id}get $ea(){return!1}get Hn(){return this.rXc}get A3(){return!!Ua.AFrameworkApplication.fa&&Ua.AFrameworkApplication.fa.Ea.qE}ZIb(){if(!this.behavior){var u=L.a.Pdb;u&&(this.behavior=u.ucf(this))}}get Mb(){return this.$a}get vb(){r.c(this.JTa)&&(this.JTa={});return this.JTa}get nFa(){r.c(this.gOa)&&(this.gOa={});return this.gOa}get iSb(){return m.a.Pf(this.Mb.IsDefinitive)}get Apb(){return m.a.Vy(this.Mb.ShouldSetTitle)}get fPc(){return this.Mb.TemplateAlias}get Iz(){return this.dK? source: chromecache_191.2.dr
Source:	Binary string: x=d(96012),z=d(60629),u=d(62280),B=d(73225),F=d(50625),D=d(13059),C=d(65097),I=d(72974),M=d(93168),K=d(48703),R=d(67590),T=d(79587),v=d(50952),N=d(44914);class Q{constructor(){this.MX=!1;this.EJe=this.PDb=0}ev(){return!0}iA(O){this.PDb=O.clientPoint.x;this.EJe=C.App.ha.oa.lg.container.clientWidth;return this.MX=!0}gt(O){this.MX&&C.App.ha.oa.lg.resize(this.EJe+r.a.V2f(O.clientPoint.x-this.PDb));return!0}gq(){this.cNb()}oB(){this.cNb()}cNb(){this.MX=!1;C.App.ha.cfa()}dispose(){}}(0,E.a)(Q,"NavigationPaneResizeAdapter", source: chromecache_195.2.dr
Source:	Binary string: null;this.pDb=this.AQa=!1;this.Opd=(x,z)=>{this.Kpa.insert(0,new L(z.commandId,z.controlId,z.time,z.commandSurface,z.inputMethod,z.contentType,z.w9));this.U5a(this.Kpa);this.AQa&&this.Xaa.MOd(z.controlId)&&this.Whd(z)}}init(){this.Xaa=new d;this.Kpa=new Ca.a;this.T$=new Ca.a;this.xBa=new Ca.a;this.jRa=k.AFrameworkApplication.J.tb("MaxCommandClickedEventQueueSize",20);l.a.ojd(this.Opd);r.a.instance.kjd((0,Ja.a)(this,this.T4d,"recordActionEvent"));this.AQa=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.UserMRUActionsCookieEnabled", source: chromecache_191.2.dr
Source:	Binary string: Jc._instance=null;(0,m.a)(Jc,"ControlBehaviorFactory",null,[784]);class Hd{get name(){return"CUI.Behavior"}configure(Sa){z.AFrameworkApplication.J&&z.AFrameworkApplication.J.Z("AccessibleMovingDialogsEnabled")&&Sa.tu($o,[pn.a]);Sa.tu(bu,[Fd.a])}async initializeAsync(){lc.a.Pdb=Jc.instance;const Sa=Qi.a.instance.AKc;for(let jb=0;jb<Sa.length;++jb){const zb=(0,C.a)(373,Sa[jb]);zb&&zb.MO()}Kh.a.get_instance().zr(6)}dispose(){}static main(){u.a.instance.hq(new Hd,5)}}(0,m.a)(Hd,"CuiBehaviorPackage",null, source: chromecache_191.2.dr
Source:	Binary string: this.Xaa.MOd(z.controlId)&&this.Whd(z)}}init(){this.Xaa=new d;this.Kpa=new Ca.a;this.T$=new Ca.a;this.xBa=new Ca.a;this.jRa=k.AFrameworkApplication.J.tb("MaxCommandClickedEventQueueSize",20);l.a.ojd(this.Opd);r.a.instance.kjd((0,Ja.a)(this,this.T4d,"recordActionEvent"));this.AQa=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.UserMRUActionsCookieEnabled",!1);this.pDb=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.ShouldPreferParentControls", source: chromecache_316.2.dr
Source:	Binary string: this.ga.resolve("Box4.Actors.StyleActor").ib()}dispose(){}static main(){u.a.instance.Rd(new QC)}}(0,m.a)(QC,"Box4ActorsPackage",null,[0,1]);class hl{constructor(Sa,jb,zb,Kb,Vb,pc){this.rpe=this.Epa=null;this.ia=Sa;this.UHg=jb;this.l7c=zb;this.Vm=Kb;this.mc=Vb;this.Ci=pc}get recentColors(){return hl.OBb\|\|(hl.OBb=ff.a.instance.va("Box4.UI.RecentColorsSectionHandler"))}get Aae(){this.Epa\|\|(this.Epa=new oF("Shading"),this.iRb(this.Epa));return this.Epa}iRb(Sa){Sa.CEa(2,jj.a.pdb);Sa.CEa(3,jj.a.gga);Sa.CEa(4, source: chromecache_191.2.dr
Source:	Binary string: null,[]);class h{constructor(x,z,u,B){this.CmdId=this.ParentTcid=this.Tcid=null;this.Time=0;this.Tcid=x;this.ParentTcid=z;this.CmdId=u;this.Time=B}}(0,Fa.a)(h,"MRUControl",null,[]);var k=J(51647),l=J(76327),r=J(50478),t=J(62733);class m{constructor(){this.Xaa=null;this.uzb=this.jRa=20;this.ora=this.yz=this.xBa=this.T$=this.Kpa=null;this.pDb=this.AQa=!1;this.Opd=(x,z)=>{this.Kpa.insert(0,new L(z.commandId,z.controlId,z.time,z.commandSurface,z.inputMethod,z.contentType,z.w9));this.U5a(this.Kpa);this.AQa&& source: chromecache_316.2.dr
Source:	Binary string: I.activeSection&&(I=I.activeSection.Yb(M))&&(C=I.label);m.a.xu(K,C)}static z1a(){m.a.eo(F.AppFrame.Yea)}}(0,E.a)(D,"ASectionListView",m.a,[])},56805:function(E,L,d){d.d(L,{a:function(){return M}});E=d(100);var h=d(77072),k=d(57531),l=d(96012),r=d(60629),t=d(73225),m=d(93651),x=d(65097),z=d(305),u=d(71987),B=d(79587),F=d(19655),D=d(50952),C=d(87478);class I{constructor(K){this.MX=!1;this.FJe=this.PDb=0;this.eF=K}ev(){return this.eF.eod()}iA(K){if(!this.ev(K))return this.MX=!1;this.PDb=K.clientPoint.x; source: chromecache_195.2.dr
Source:	Binary string: this.FJe=this.eF.container.clientWidth;return this.MX=!0}gt(K){this.MX&&this.eF.resize(this.FJe+C.a.V2f(K.clientPoint.x-this.PDb));return!0}gq(){this.cNb()}oB(){this.cNb()}cNb(){this.MX=!1;x.App.ha.cfa()}dispose(){}}(0,E.a)(I,"ListViewResizeAdapter",null,[431,44]);class M extends m.a{constructor(K){super(new F.a,m.a.Ywc,x.App.bX);this.Gba=this.aY=this.vaa=this.nU=this.FX=this.OBa=null;this.isa=4294967295;this.cCa=!1;this.JN=!0;this.zz=K}get resizeMinWidth(){return 0}get resizeMaxWidth(){return 350}get Wda(){return this.OBa}get QHa(){return this.vaa}get Sla(){return this.FX}get $Sb(){return!0}get isCollapsed(){return this.cCa}set isCollapsed(K){this.cCa= source: chromecache_195.2.dr
Source:	Binary string: 1028);this.ia.la(jj.a.pdb,Sl.a.view,rA.BNb);this.ia.la(jj.a.pdb,Sl.a.tableCell,(0,ye.a)(this,this.pdb,"clearCellShadingColor"));this.ia.Wb(jj.a.pdb,1028);this.ia.la(jj.a.a3a,Sl.a.view,(0,ye.a)(this,this.VSi,"queryCellShadingColorView"));this.ia.la(jj.a.a3a,Sl.a.tableCell,(0,ye.a)(this,this.a3a,"queryCellShadingColor"));this.ia.Wb(jj.a.a3a,1124);this.ia.la(jj.a.f0b,Sl.a.view,rA.BNb);this.ia.la(jj.a.f0b,Sl.a.tableCell,(0,ye.a)(this,this.S0g,"cellShadingCustomColor"));this.ia.Wb(jj.a.f0b,1028);this.ia.la(jj.a.hSf, source: chromecache_191.2.dr
Source:	Binary string: Ua.AFrameworkApplication.fa.Ea.qE}ZIb(){if(!this.behavior){var u=L.a.Pdb;u&&(this.behavior=u.ucf(this))}}get Mb(){return this.$a}get vb(){r.c(this.JTa)&&(this.JTa={});return this.JTa}get nFa(){r.c(this.gOa)&&(this.gOa={});return this.gOa}get iSb(){return m.a.Pf(this.Mb.IsDefinitive)}get Apb(){return m.a.Vy(this.Mb.ShouldSetTitle)}get fPc(){return this.Mb.TemplateAlias}get Iz(){return this.dK?E.a.bSe:E.a.BH}aYa(u){if(-1===this.daa.indexOf(","+u+","))throw Error.create("The display mode with name: "+ source: chromecache_316.2.dr
Source:	Binary string: 4034531111;h.Cta=319972657;h.VVa=1892407702;h.QHb=329522368;h.Hca=3386890908;h.WHb=70356481;h.bIb=1303135280;h.centerJustify=4284004393;h.eFa=3332601592;h.W0g=3523575366;h.fdb=1880533947;h.gdb=768894625;h.Y0g=3230325101;h.dIb=2981608035;h.Olc=3502060538;h.hdb=4291024442;h.Iod=1943062421;h.g1g=3246658478;h.EVe=3281315808;h.DVe=3968581736;h.cC=2858610352;h.pdb=3275596206;h.rdb=562361573;h.U1=3491966299;h.clearFormatting=2319895756;h.gpd=2449130731;h.iWa=1011300372;h.wXe=3589727007;h.uIb=3901727243; source: chromecache_195.2.dr
Source:	Binary string: !0);this.AQa&&(this.yz=new Ca.a,this.ora="UserRecentActions_"+this.bgb(),this.AQd())}bgb(){switch(k.AFrameworkApplication.fa.Ea.Ng){case 3:return"Word";case 1:return"Excel";case 2:return"PowerPoint";case 5:return"Visio";case 4:return"OneNote";default:return"Unknown"}}AQd(){var x=t.a.get(this.ora);if(!this.Xaa.isNullOrUndefined(x)&&0<x.length){let z=null;try{z=JSON.parse(decodeURIComponent(x))}catch(u){t.a.remove(this.ora);return}x=0;for(const u of z)this.yz.insert(x++,u)}}Whd(x){const z=this.pDb&& source: chromecache_316.2.dr
Source:	Binary string: return}x=0;for(const u of z)this.yz.insert(x++,u)}}Whd(x){const z=this.pDb&&!this.Xaa.isNullOrUndefined(x.w9)&&0<x.w9.length;if(0<this.yz.count){for(var u=0;u<this.yz.count&&3>u;u++){var B=this.yz.K(u);if(z&&B.ParentTcid===x.w9\|\|B.Tcid===x.controlId)return}for(u=3;u<this.yz.count;u++)if(B=this.yz.K(u),z&&B.ParentTcid===x.w9\|\|B.Tcid===x.controlId){this.yz.remove(B);break}}this.yz.insert(0,new h(x.controlId,x.w9,x.commandId,x.time));this.yz.count>this.uzb&&this.yz.removeAt(this.uzb);x=JSON.stringify(this.yz.toArray()); source: chromecache_191.2.dr
Source:	Binary string: !1);this.pDb=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.ShouldPreferParentControls",!0);this.AQa&&(this.yz=new Ca.a,this.ora="UserRecentActions_"+this.bgb(),this.AQd())}bgb(){switch(k.AFrameworkApplication.fa.Ea.Ng){case 3:return"Word";case 1:return"Excel";case 2:return"PowerPoint";case 5:return"Visio";case 4:return"OneNote";default:return"Unknown"}}AQd(){var x=t.a.get(this.ora);if(!this.Xaa.isNullOrUndefined(x)&&0<x.length){let z=null;try{z=JSON.parse(decodeURIComponent(x))}catch(u){t.a.remove(this.ora); source: chromecache_191.2.dr

Source: chromecache_210.2.dr, chromecache_198.2.dr, chromecache_187.2.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_210.2.dr, chromecache_198.2.dr, chromecache_187.2.dr	Binary or memory string: ",DisconnectVirtualMachine:"

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://roaming.osi.office.de/rs/v1/settings	0%	Avira URL Cloud	safe
https://edog.onenote.com	0%	Avira URL Cloud	safe
https://forms.officeppe.com	0%	Avira URL Cloud	safe
https://login.microsoftonline-int.com	100%	Avira URL Cloud	phishing
https://whiteboard.microsoft.scloud	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
b-0004.b-dc-msedge.net	13.107.9.156	true	false	unknown
s-part-0044.t-0009.t-msedge.net	13.107.246.72	true	false	high
augloop-prod-pa01.canadacentral.cloudapp.azure.com	52.111.251.20	true	false	unknown
a1894.dscb.akamai.net	23.40.179.51	true	false	high
www.tm.a.prd.aadg.trafficmanager.net	20.190.152.20	true	false	high
1drv.ms	13.107.42.12	true	false	high
a46.dscr.akamai.net	23.55.235.226	true	false	high
s-part-0010.t-0009.t-msedge.net	13.107.246.38	true	false	high
dual-spov-0006.spov-msedge.net	13.107.137.11	true	false	high
a434.dscd.akamai.net	23.57.90.69	true	false	high
wac-0003.wac-msedge.net	52.108.8.12	true	false	high
prod-campaignaggregator.omexexternallfb.office.net.akadns.net	52.111.229.20	true	false	high
a726.dscd.akamai.net	23.44.136.155	true	false	high
www.google.com	142.251.40.132	true	false	high
a1531.g2.akamai.net	23.219.36.103	true	false	high
s-0005.dual-s-msedge.net	52.123.129.14	true	false	high
e11271.dscg.akamaiedge.net	23.51.57.212	true	false	high
i-blz04p-cor002.api.p001.1drv.com	20.135.4.163	true	false	high
mira-ofc.tm-4.office.com	52.110.7.46	true	false	high
fa000000012.resources.office.net	unknown	unknown	false	high
js.monitor.azure.com	unknown	unknown	false	high
fa000000111.resources.office.net	unknown	unknown	false	high
fa000000128.resources.office.net	unknown	unknown	false	high
res-1.public.onecdn.static.microsoft	unknown	unknown	false	high
augloop.office.com	unknown	unknown	false	high
storage.live.com	unknown	unknown	false	high
ajax.aspnetcdn.com	unknown	unknown	false	high
fa000000110.resources.office.net	unknown	unknown	false	high
onenoteonline.nel.measure.office.net	unknown	unknown	false	high
common.online.office.com	unknown	unknown	false	high
fa000000138.resources.office.net	unknown	unknown	false	high
onedrive.live.com	unknown	unknown	false	high
amcdn.msftauth.net	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
spoprod-a.akamaihd.net	unknown	unknown	false	high
www.onenote.com	unknown	unknown	false	high
messaging.engagement.office.com	unknown	unknown	false	high
fa000000096.resources.office.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://fa000000128.resources.office.net/033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2502.18015/en-us_web/manifest_web.xml	false	high
https://onedrive.live.com/personal/8fc032da5fada757/_layouts/15/Doc.aspx?sourcedoc=%7B6e530701-6b86-4081-97fd-52bb695fa645%7D&action=default&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84ZmMwMzJkYTVmYWRhNzU3L0VnRUhVMjZHYTRGQWxfMVN1MmxmcGtVQnFRSXRxcHAwbVA0XzVjaXBQRG1NY2c_ZT1QeUpWTWk&slrid=b3f78da1-80b4-c000-4620-e140ea6fff4d&originalPath=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84ZmMwMzJkYTVmYWRhNzU3L0VnRUhVMjZHYTRGQWxfMVN1MmxmcGtVQnFRSXRxcHAwbVA0XzVjaXBQRG1NY2c_cnRpbWU9enB3RnZwbHIzVWc&CID=583a7412-7b26-4875-89ab-da2ced3b5775&_SRM=0:G:44	false	high
https://fa000000110.resources.office.net/033f92d3-bc6d-439a-858a-a17acf70360a/1.0.0.5/en-us_web/manifest_web.xml	false	high
https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js	false	high
https://onenoteonline.nel.measure.office.net/api/report?FrontEnd=AFD&DestinationEndpoint=Edge-Prod-EWR31r5b&DC=PUS3&FileSource=	false	high
https://spoprod-a.akamaihd.net/files/fabric/assets/icons/fabricmdl2icons.woff	false	high
https://common.online.office.com/suite/RemoteUls.ashx?usid=c7fcd40e-f3d7-df9e-33b8-2b7b036eb358&officeserverversion=	false	high
https://res-1.public.onecdn.static.microsoft/files/sp-client/odsp.1ds/odsp.1ds.lib-6996f8ab.js	false	high
https://res-1.public.onecdn.static.microsoft/files/odsp-web-prod_2025-03-14.006/wacowlhostwebpack/17.js	false	high
https://res-1.public.onecdn.static.microsoft/files/odsp-web-prod_2025-03-14.006/wacowlhostwebpack/14.js	false	high
https://res-1.public.onecdn.static.microsoft/files/odsp-web-prod_2025-03-14.006/wacowlhostwebpack/en-us/ondemand.resx.js	false	high
https://www.onenote.com/officeaddins/learningtools/?et=	false	high
https://res-1.public.onecdn.static.microsoft/files/odsp-web-prod_2025-03-14.006/wacowlhostwebpack/wacowlhostwebpack.js	false	high
https://augloop.office.com/	false	high
https://fa000000111.resources.office.net/033f92d3-bc6d-439a-858a-a17acf70360a/1.0.0.5/en-us_web/manifest_web.xml	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://roaming.officeapps.partner.office365.cn/rs/v1/settings	chromecache_195.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=fil-PH&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=az-Latn-AZ&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=hy-AM&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=is-IS&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://support.office.com/f1/home?isAgave=true&helpid=161255	chromecache_264.2.dr, chromecache_314.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=mi-NZ&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://login.microsoftonline-int.com	chromecache_264.2.dr, chromecache_314.2.dr	false	Avira URL Cloud: phishing	unknown
https://www.onenote.com/officeaddins/meetings?ui=kok-IN&temporaryLocalization=true	chromecache_320.2.dr	false		high
http://www.opensource.org/licenses/mit-license.php	chromecache_329.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=ky-KG&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://content.lifecycle.officeppe.net/	chromecache_195.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=sk-SK&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=ca-ES-valencia&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=ka-GE&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=tk-TM&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://augloop.office.com/v2;394866fc-eedb-4f01-8536-3ff84b16be2a;liveprofilecard.access;https://sh	chromecache_178.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=et-EE&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://cdn.fluidpreview.office.net/fluid/prod	chromecache_195.2.dr	false		high
https://my.microsoftpersonalcontent.com	chromecache_198.2.dr, chromecache_195.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=mt-MT&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=sr-Latn-RS&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=ne-NP&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=ru-RU&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=sl-SI&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://forms.office.com	chromecache_316.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=bn-BD&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=vi-VN&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=af-ZA&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://whiteboard.microsoft.scloud	chromecache_195.2.dr	false	Avira URL Cloud: safe	unknown
https://www.onenote.com/officeaddins/meetings?ui=mn-MN&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://github.com/webpack-contrib/style-loader#insertat)	chromecache_329.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=ro-RO&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://consent.config.office.com/consentcheckin/v1.0/consents	chromecache_316.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=cs-CZ&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://fa000000096.resources.office.net	chromecache_195.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=pl-PL&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=prs-AF&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://whiteboard.office.com/root/index.fluid.js	chromecache_195.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=sv-SE&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_260.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=uk-UA&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://support.office.com/article/7afcb4f3-4aa2-443a-9b08-125a5d692576	chromecache_195.2.dr	false		high
https://res-dev.cdn.officeppe.net/mirrored/smartlookup/	chromecache_191.2.dr	false		high
https://support.office.com/article/ec43ed03-eb3c-4a10-8d9d-e9e5433c9ed2	chromecache_191.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=ar-SA&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://prod.support.office.com	chromecache_264.2.dr, chromecache_314.2.dr	false		high
https://roaming.osi.office.de/rs/v1/settings	chromecache_195.2.dr	false	Avira URL Cloud: safe	unknown
https://www.onenote.com/officeaddins/meetings?ui=he-IL&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=nso-ZA&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=mk-MK&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://login.windows-ppe.net	chromecache_264.2.dr, chromecache_314.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=zu-ZA&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=lt-LT&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://reactjs.org/link/react-polyfills	chromecache_259.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=sq-AL&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=pt-PT&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://login.microsoftonline.com	chromecache_264.2.dr, chromecache_314.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=tg-Cyrl-TJ&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://cdn.fluidpreview.office.net/fluid/gcc	chromecache_195.2.dr	false		high
https://support.office.com/f1/SDX/word	chromecache_264.2.dr, chromecache_314.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=nb-NO&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=zh-TW&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=tr-TR&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=fr-FR&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=wo-SN&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=de-DE&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=kn-IN&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://fa000000096.resources.office.net/f7024bdc-7caf-4ca8-807d-2908f09640d6/1.0.2210.23001/en-us_w	chromecache_195.2.dr	false		high
https://www.onenote.com/officeaddins/mathassistant	chromecache_316.2.dr	false		high
https://portal.office.com/	chromecache_198.2.dr	false		high
https://forms.officeppe.com	chromecache_257.2.dr, chromecache_316.2.dr, chromecache_250.2.dr	false	Avira URL Cloud: safe	unknown
https://www.onenote.com/officeaddins/meetings?ui=bn-IN&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=fi-FI&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://localcdn.centro-dev.com:5555/floodgate.bundle.js.map	chromecache_210.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=ms-MY&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=te-IN&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=ml-IN&temporaryLocalization=true	chromecache_320.2.dr	false		high
http://hammerjs.github.io/	chromecache_300.2.dr	false		high
https://whiteboard.office365.us	chromecache_195.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=id-ID&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://res-2-dev.cdn.officeppe.net	chromecache_195.2.dr	false		high
https://www.onenote.com/officeaddins/meetings?ui=ca-ES&temporaryLocalization=true	chromecache_320.2.dr	false		high
https://edog.onenote.com	chromecache_191.2.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/f1/home?isAgave=true	chromecache_264.2.dr, chromecache_314.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.51.57.212	e11271.dscg.akamaiedge.net	United States	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
23.202.61.107	unknown	United States	20940	AKAMAI-ASN1EU	false
142.251.40.132	www.google.com	United States	15169	GOOGLEUS	false
52.111.251.20	augloop-prod-pa01.canadacentral.cloudapp.azure.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.219.36.103	a1531.g2.akamai.net	United States	20940	AKAMAI-ASN1EU	false
13.107.246.38	s-part-0010.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.69	a434.dscd.akamai.net	United States	35994	AKAMAI-ASUS	false
13.107.137.11	dual-spov-0006.spov-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.109.16.3	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.72	s-part-0044.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.40.179.51	a1894.dscb.akamai.net	United States	16625	AKAMAI-ASUS	false
13.107.42.12	1drv.ms	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.55.235.226	a46.dscr.akamai.net	United States	20940	AKAMAI-ASN1EU	false
20.190.152.20	www.tm.a.prd.aadg.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.111.229.20	prod-campaignaggregator.omexexternallfb.office.net.akadns.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.135.4.163	i-blz04p-cor002.api.p001.1drv.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.4
192.168.2.15

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1648016
Start date and time:	2025-03-25 13:35:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@26/288@68/18
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, sppsvc.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.35.163, 142.251.40.238, 142.251.32.110, 142.250.31.84, 142.250.65.227, 142.250.72.110, 142.250.176.206, 142.250.81.238, 23.203.176.221, 199.232.214.172, 20.189.173.6, 142.250.80.42, 142.250.80.106, 142.250.72.106, 142.251.40.170, 142.251.40.202, 142.251.35.170, 142.250.64.74, 142.250.80.10, 172.217.165.138, 142.250.65.170, 142.251.40.106, 142.251.40.138, 142.251.41.10, 142.250.80.74, 142.250.176.202, 142.251.40.234, 51.116.246.106, 142.251.40.206, 40.126.24.147, 23.51.56.248, 172.217.165.142, 142.251.35.174, 142.251.40.174, 142.250.81.227, 34.104.35.123, 142.250.72.99, 20.42.65.85, 23.204.23.20, 23.44.136.155, 52.108.8.12, 204.79.197.222, 52.108.9.12, 20.12.23.50, 52.123.129.14, 23.57.90.74, 23.57.90.71, 13.107.9.156, 52.110.7.46, 23.44.136.145, 20.190.152.22, 13.107.246.40, 23.44.136.149, 23.44.136.150
Excluded domains from analysis (whitelisted): fp.msedge.net, usc-onenote.officeapps.live.com, slscr.update.microsoft.com, mrodevicemgr.officeapps.live.com, clientservices.googleapis.com, res-1.cdn.office.net, browser.events.data.trafficmanager.net, cdn.onenote.net.edgekey.net, clients2.google.com, dual-s-0005-office.config.skype.com, ocsp.digicert.com, login.live.com, update.googleapis.com, csp.microsoft.com, mrodevicemgr-prod-defaultgeo.trafficmanager.net, ecs.office.com, fs.microsoft.com, content-autofill.googleapis.com, wise.public.cdn.office.net, onedscolprdeus05.eastus.cloudapp.azure.com, res-stls-prod.edgesuite.net, res-prod.trafficmanager.net, edgedl.me.gvt1.com, euc-onenote-geo.wac.trafficmanager.net, e1553.dspg.akamaiedge.net, clients.l.google.com, ecs.office.trafficmanager.net, onedscolprdwus05.westus.cloudapp.azure.com, euc-onenote.officeapps.live.com, www.tm.lg.prod.aadmsa.trafficmanager.net, appsforoffice.microsoft.com, onedscolprdgwc06.germanywestcentral.cloudapp.azure.com, redirector.gvt1.com,
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1922), with no line terminators
Category:	downloaded
Size (bytes):	1922
Entropy (8bit):	5.006174566262526
Encrypted:	false
SSDEEP:	48:yThd/YIWeETNQuFNJMgBVAGzeFWOUutFRVoZjskBWs:U0IWYuPuG3yov
MD5:	3E3CD75B07B521BC61C01450E2C7873A
SHA1:	57D7881E0E878CABE74B1021CF86126148928DE7
SHA-256:	2882BF4B22D0AD63E6F8877EB5C22353921E8C87B197911462933B7D1A7A44B8
SHA-512:	3B1D53CB1F49B2CF8648CEF8EDEB526B924430F2FC622421DF6AB3F61E49449CD5EB8BCCC7E6A019575A4843B0D3C50A69C4B0BF1D1133F960E92969CAC37BE7
Malicious:	false
Reputation:	low
URL:	https://cdn.onenote.net/officeaddins/161872440461_Scripts/BrowserUls.js
Preview:	function InitializeUls(){TheUlsHost=new Diag.ConsoleUlsHost;Diag.ULS.setUlsHost(TheUlsHost)}function FlushBrowserUls(){TheUlsHost&&TheUlsHost.dispose();InitializeUls()}var __extends=this.__extends\|\|function(n,t){function r(){this.constructor=n}for(var i in t)t.hasOwnProperty(i)&&(n[i]=t[i]);r.prototype=t.prototype;n.prototype=new r},Diag,TheUlsHost;(function(n){var t=function(){function n(){}return n.prototype.isEnabled=function(){var n=!1;try{typeof Storage!="undefined"&&(n=localStorage.getItem("EnableConsoleLogging")==="true")}catch(t){}return n&&window.console&&window.console.log},n.prototype.error=function(n){window.console.error(n)},n.prototype.warning=function(n){window.console.warn(n)},n.prototype.info=function(n){window.console.info(n)},n.prototype.log=function(n){window.console.log(n)},n}(),i=function(i){function r(r,u){r===void 0&&(r=new t);i.call(this,SessionId,BrowserUlsUploadPath,new n.UlsUploadConfiguration(null,null,null,null,null,null,!0));this._console=r;this._suppress

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2025 13:36:55.401923895 CET	53	63805	1.1.1.1	192.168.2.4
Mar 25, 2025 13:36:55.694329977 CET	53	64760	1.1.1.1	192.168.2.4
Mar 25, 2025 13:36:56.145694971 CET	53	55911	1.1.1.1	192.168.2.4
Mar 25, 2025 13:36:56.391798973 CET	53	63352	1.1.1.1	192.168.2.4
Mar 25, 2025 13:36:58.531855106 CET	50154	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:36:58.532272100 CET	49760	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:36:58.633630991 CET	53	50154	1.1.1.1	192.168.2.4
Mar 25, 2025 13:36:58.633733988 CET	53	49760	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:00.003052950 CET	62851	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:00.003052950 CET	64410	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:00.101500034 CET	53	64410	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:00.102001905 CET	53	62851	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:00.593844891 CET	64294	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:00.593997955 CET	56080	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:00.691524029 CET	53	64294	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:00.701940060 CET	53	56080	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:03.209980011 CET	55143	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:03.210371971 CET	62502	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:03.310041904 CET	53	55143	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:03.315536976 CET	53	62502	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:03.871725082 CET	52880	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:03.871989965 CET	54337	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:03.970065117 CET	53	54337	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:03.970078945 CET	53	52880	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:10.691730022 CET	53	52675	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:12.521648884 CET	65394	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:12.521835089 CET	61905	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:12.576668024 CET	58860	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:12.576844931 CET	62209	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:12.623847008 CET	53	65394	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:12.656008005 CET	53	61905	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:12.674201965 CET	53	58860	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:12.715378046 CET	53	62209	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:13.769449949 CET	53	57573	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:14.252266884 CET	62121	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:14.253458023 CET	56376	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:14.348481894 CET	53	62121	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:14.351594925 CET	53	56376	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:14.504940033 CET	49869	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:14.504940987 CET	65292	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:14.605437994 CET	53	65292	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:14.608144999 CET	53	49869	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:14.685194969 CET	61572	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:14.685353994 CET	49953	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:14.728903055 CET	53238	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:14.729250908 CET	64344	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:14.782305956 CET	53	61572	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:14.827893019 CET	53	49953	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:14.828978062 CET	53	53238	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:14.845325947 CET	53	64344	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:15.386889935 CET	52487	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:15.387252092 CET	64482	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:15.387687922 CET	56772	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:15.387923956 CET	64825	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:15.390079975 CET	62463	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:15.390471935 CET	59370	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:15.391460896 CET	54460	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:15.391809940 CET	53178	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:15.392276049 CET	52893	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:15.392528057 CET	49659	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:15.393290043 CET	58160	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:15.393503904 CET	53533	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:15.485677004 CET	53	64482	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:15.486618996 CET	53	56772	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:15.487682104 CET	53	59370	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:15.488125086 CET	53	52487	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:15.489001036 CET	53	62463	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:15.489495993 CET	53	53178	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:15.490886927 CET	53	49659	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:15.493073940 CET	53	54460	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:15.493633032 CET	53	52893	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:15.495877028 CET	53	58160	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:15.521574020 CET	53	64825	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:15.534380913 CET	53	53533	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:15.550141096 CET	51998	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:15.550142050 CET	56463	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:15.653044939 CET	53	51998	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:15.695112944 CET	53	56463	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:16.027017117 CET	62007	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:16.027017117 CET	57812	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:16.074419975 CET	49531	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:16.074815989 CET	65026	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:16.111727953 CET	63563	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:16.111862898 CET	51668	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:16.125055075 CET	53	57812	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:16.126075029 CET	53	62007	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:16.172223091 CET	53	49531	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:16.172472000 CET	53	65026	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:16.210760117 CET	53	63563	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:16.212095976 CET	53	51668	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:17.232075930 CET	60048	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:17.234002113 CET	65179	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:17.329526901 CET	53	60048	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:17.335505009 CET	53	65179	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:18.522074938 CET	54811	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:18.522075891 CET	59630	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:18.523420095 CET	53763	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:18.523633003 CET	55424	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:18.524954081 CET	61651	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:18.525182962 CET	61964	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:18.526729107 CET	62629	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:18.526844978 CET	62403	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:18.528012037 CET	59064	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:18.528265953 CET	57608	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:18.529169083 CET	58048	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:18.529438019 CET	52248	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:18.625466108 CET	53	53763	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:18.626502991 CET	53	61964	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:18.626523018 CET	53	61651	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:18.628122091 CET	53	54811	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:18.628135920 CET	53	62629	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:18.628148079 CET	53	62403	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:18.629894018 CET	53	57608	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:18.630434990 CET	53	52248	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:18.630448103 CET	53	59064	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:18.631577969 CET	53	58048	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:18.666313887 CET	53	55424	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:18.700460911 CET	53	59630	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:19.517163992 CET	61602	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:19.518620014 CET	65268	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:19.621835947 CET	53	61602	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:19.623008966 CET	53	65268	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:32.717216969 CET	53	55956	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:34.357230902 CET	59315	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:34.357500076 CET	61701	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:37:34.458806038 CET	53	59315	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:34.459239006 CET	53	61701	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:53.363496065 CET	53	49466	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:54.234498024 CET	53	62027	1.1.1.1	192.168.2.4
Mar 25, 2025 13:37:56.960304022 CET	53	61042	1.1.1.1	192.168.2.4
Mar 25, 2025 13:38:01.398298979 CET	138	138	192.168.2.4	192.168.2.255
Mar 25, 2025 13:38:03.944633961 CET	59859	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:38:03.945059061 CET	56063	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:38:03.946760893 CET	52044	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:38:03.946888924 CET	49807	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:38:04.045870066 CET	53	49807	1.1.1.1	192.168.2.4
Mar 25, 2025 13:38:04.046905041 CET	53	52044	1.1.1.1	192.168.2.4
Mar 25, 2025 13:38:04.047204971 CET	53	59859	1.1.1.1	192.168.2.4
Mar 25, 2025 13:38:04.064834118 CET	53	56063	1.1.1.1	192.168.2.4
Mar 25, 2025 13:38:19.313539982 CET	59705	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:38:19.313926935 CET	55015	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:38:19.414891005 CET	53	59705	1.1.1.1	192.168.2.4
Mar 25, 2025 13:38:19.435162067 CET	53	55015	1.1.1.1	192.168.2.4
Mar 25, 2025 13:38:19.933952093 CET	58306	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:38:19.934474945 CET	53216	53	192.168.2.4	1.1.1.1
Mar 25, 2025 13:38:20.073296070 CET	53	53216	1.1.1.1	192.168.2.4
Mar 25, 2025 13:38:20.076347113 CET	53	58306	1.1.1.1	192.168.2.4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 25, 2025 13:37:12.715439081 CET	192.168.2.4	1.1.1.1	c27f	(Port unreachable)	Destination Unreachable
Mar 25, 2025 13:37:14.391681910 CET	192.168.2.4	1.1.1.1	c2ee	(Port unreachable)	Destination Unreachable
Mar 25, 2025 13:37:15.699004889 CET	192.168.2.4	1.1.1.1	c2c1	(Port unreachable)	Destination Unreachable
Mar 25, 2025 13:37:16.896554947 CET	192.168.2.4	1.1.1.1	c2a0	(Port unreachable)	Destination Unreachable
Mar 25, 2025 13:37:18.666410923 CET	192.168.2.4	1.1.1.1	c286	(Port unreachable)	Destination Unreachable
Mar 25, 2025 13:37:54.234582901 CET	192.168.2.4	1.1.1.1	c224	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Mar 25, 2025 13:37:04.476452112 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 25, 2025 13:37:04.567404985 CET	223	IN	HTTP/1.1 304 Not Modified Date: Tue, 25 Mar 2025 12:09:48 GMT Expires: Tue, 25 Mar 2025 12:59:48 GMT Age: 1636 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 25, 2025 13:37:05.083306074 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 25, 2025 13:37:05.180949926 CET	223	IN	HTTP/1.1 304 Not Modified Date: Tue, 25 Mar 2025 12:00:24 GMT Expires: Tue, 25 Mar 2025 12:50:24 GMT Age: 2201 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:00 UTC	733	OUT	GET /o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi HTTP/1.1 Host: 1drv.ms Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:00 UTC	753	IN	HTTP/1.1 301 Moved Permanently Location: https://onedrive.live.com/:o:/g/personal/8FC032DA5FADA757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?resid=8FC032DA5FADA757!s6e5307016b86408197fd52bb695fa645&ithint=onenote&e=PyJVMi&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84ZmMwMzJkYTVmYWRhNzU3L0VnRUhVMjZHYTRGQWxfMVN1MmxmcGtVQnFRSXRxcHAwbVA0XzVjaXBQRG1NY2c_ZT1QeUpWTWk X-MSNSERVER: BL4PPF7E3ABE51E Strict-Transport-Security: max-age=31536000; includeSubDomains MS-CV: fEWGsCmDLkGTadn1WdzVcw.0 X-AsmVersion: UNKNOWN; 19.1628.228.2009 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 1A6CD9686036416895706473F4E4DD75 Ref B: EWR30EDGE0809 Ref C: 2025-03-25T12:37:00Z Date: Tue, 25 Mar 2025 12:37:00 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:01 UTC	976	OUT	GET /:o:/g/personal/8FC032DA5FADA757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?resid=8FC032DA5FADA757!s6e5307016b86408197fd52bb695fa645&ithint=onenote&e=PyJVMi&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84ZmMwMzJkYTVmYWRhNzU3L0VnRUhVMjZHYTRGQWxfMVN1MmxmcGtVQnFRSXRxcHAwbVA0XzVjaXBQRG1NY2c_ZT1QeUpWTWk HTTP/1.1 Host: onedrive.live.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:01 UTC	4147	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 657 Content-Type: text/html; charset=utf-8 Location: https://onedrive.live.com/personal/8fc032da5fada757/_layouts/15/Doc.aspx?sourcedoc=%7B6e530701-6b86-4081-97fd-52bb695fa645%7D&action=default&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84ZmMwMzJkYTVmYWRhNzU3L0VnRUhVMjZHYTRGQWxfMVN1MmxmcGtVQnFRSXRxcHAwbVA0XzVjaXBQRG1NY2c_ZT1QeUpWTWk&slrid=b3f78da1-80b4-c000-4620-e140ea6fff4d&originalPath=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84ZmMwMzJkYTVmYWRhNzU3L0VnRUhVMjZHYTRGQWxfMVN1MmxmcGtVQnFRSXRxcHAwbVA0XzVjaXBQRG1NY2c_cnRpbWU9enB3RnZwbHIzVWc&CID=583a7412-7b26-4875-89ab-da2ced3b5775&_SRM=0:G:44 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2VlZDJhMWU3OTAyN2Q4Yjc0MzQwMjNjZTNmYTI0YjRlY2Q2NWNkOWQxNmIyNmJjNmI4Y2VmZTc4ZDRmODIyZjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZWVkMmExZTc5MDI3ZDhiNzQzNDAyM2NlM2ZhMjRiNGVjZDY1Y2Q5ZDE2YjI2YmM2YjhjZWZlNzhkNGY4MjJmMiwxMzM4NzM4MDEyMTAwMDAwMDAsMCwxMzM4NzQ2NjIyMTgzNzMzNjgsMC4wLjAuMCwyNTgsOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkLCwsZmFhYTVhZTYtMmE1Mi00OGMyLTgwMmItZmUxODY5NmFiNzllLGZhYWE1YWU2LTJhNTItNDhjMi04MDJiLWZlMTg2OTZhYjc5ZSxFSkVYYnBwNC9rbXlGc3RHa1JmcUtRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODkwNDksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLG1kdFlhcTVZdEdKT25sMjNHNVBzTXhIamU1NEhMR3ROcUJCVXVIZ1AxendidjhTeTAvQmJSUXZzbFJLYVo0Mlhob2VtR3hmMENyVkxHYWJmeVJITlJaRTFpZ21JUmh5TDRrUm5ieS9jai9jOTlRVmJNVXFqZFBVU2pSRnJkWi9tUHlXeExJU2M0bHdkWlNTUm5UZnVxWGJnRjZNUkNQQlRvN3hPUmFPNXRoSy9ndUVBM3BncU1haDBpTzFpaVAwek9OVHNPUk43WDhmaW5vNUxYZEM4YVpZTHZiUGlrQmZOMHFxM2pCcFdGb3hLVC9PUjA4ZkJq [TRUNCATED] IsOCDI: 0 X-NetworkStatistics: 0,0,0,0,0,0,0,0 X-SharePointHealthScore: 0 X-MS-SPO-CookieValidator: mdtYaq5YtGJOnl23G5PsMxHje54HLGtNqBBUuHgP1zwbv8Sy0/BbRQvslRKaZ42XhoemGxf0CrVLGabfyRHNRZE1igmIRhyL4kRnby/cj/c99QVbMUqjdPUSjRFrdZ/mPyWxLISc4lwdZSSRnTfuqXbgF6MRCPBTo7xORaO5thK/guEA3pgqMah0iO1iiP0zONTsORN7X8fino5LXdC8aZYLvbPikBfN0qq3jBpWFoxKT/OR08fBjrCUyxJelVBg5x7V5FCKkpZbgu9qNw9/hLtbKKItx++wvJAUT8UTcnrAA30R6Bhjyoc5X2nYHQSonV9RJyxgwsG0i7bJ+GfpDw== X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: b3f78da1-00c8-c000-4620-ee0fa3044027 request-id: b3f78da1-00c8-c000-4620-ee0fa3044027 MS-CV: oY33s8gAAMBGIO4PowRAJw.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=9188040d-6c67-4c5b-b112-36a304b66dad&destinationEndpoint=Edge-Prod-BL2r5b&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 181 SPIisLatency: 6 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 687A5FC84EBE4015915B16F6EF17C0FC Ref B: BL2EDGE1516 Ref C: 2025-03-25T12:37:01Z Date: Tue, 25 Mar 2025 12:37:01 GMT Connection: close
2025-03-25 12:37:01 UTC	19	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e Data Ascii: <html><head><title>
2025-03-25 12:37:01 UTC	638	IN	Data Raw: 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6f 6e 65 64 72 69 76 65 2e 6c 69 76 65 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 38 66 63 30 33 32 64 61 35 66 61 64 61 37 35 37 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 44 6f 63 2e 61 73 70 78 3f 73 6f 75 72 63 65 64 6f 63 3d 25 37 42 36 65 35 33 30 37 30 31 2d 36 62 38 36 2d 34 30 38 31 2d 39 37 66 64 2d 35 32 62 62 36 39 35 66 61 36 34 35 25 37 44 26 61 6d 70 3b 61 63 74 69 6f 6e 3d 64 65 66 61 75 6c 74 26 61 6d 70 3b 72 65 64 65 65 6d 3d 61 48 52 30 63 48 4d 36 4c 79 38 78 5a 48 4a 32 4c 6d 31 7a 4c 32 38 76 59 79 38 34 5a 6d 4d 77 4d 7a 4a Data Ascii: Object moved</title></head><body><h2>Object moved to <a href="https://onedrive.live.com/personal/8fc032da5fada757/_layouts/15/Doc.aspx?sourcedoc=%7B6e530701-6b86-4081-97fd-52bb695fa645%7D&action=default&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84ZmMwMzJ

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:02 UTC	2319	OUT	GET /personal/8fc032da5fada757/_layouts/15/Doc.aspx?sourcedoc=%7B6e530701-6b86-4081-97fd-52bb695fa645%7D&action=default&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84ZmMwMzJkYTVmYWRhNzU3L0VnRUhVMjZHYTRGQWxfMVN1MmxmcGtVQnFRSXRxcHAwbVA0XzVjaXBQRG1NY2c_ZT1QeUpWTWk&slrid=b3f78da1-80b4-c000-4620-e140ea6fff4d&originalPath=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84ZmMwMzJkYTVmYWRhNzU3L0VnRUhVMjZHYTRGQWxfMVN1MmxmcGtVQnFRSXRxcHAwbVA0XzVjaXBQRG1NY2c_cnRpbWU9enB3RnZwbHIzVWc&CID=583a7412-7b26-4875-89ab-da2ced3b5775&_SRM=0:G:44 HTTP/1.1 Host: onedrive.live.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2VlZDJhMWU3OTAyN2Q4Yjc0MzQwMjNjZTNmYTI0YjRlY2Q2NWNkOWQxNmIyNmJjNmI4Y2VmZTc4ZDRmODIyZjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZWVkMmExZTc5MDI3ZDhiNzQzNDAyM2NlM2ZhMjRiNGVjZDY1Y2Q5ZDE2YjI2YmM2YjhjZWZlNzhkNGY4MjJmMiwxMzM4NzM4MDEyMTAwMDAwMDAsMCwxMzM4NzQ2NjIyMTgzNzMzNjgsMC4wLjAuMCwyNTgsOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkLCwsZmFhYTVhZTYtMmE1Mi00OGMyLTgwMmItZmUxODY5NmFiNzllLGZhYWE1YWU2LTJhNTItNDhjMi04MDJiLWZlMTg2OTZhYjc5ZSxFSkVYYnBwNC9rbXlGc3RHa1JmcUtRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODkwNDksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLG1kdFlhcTVZdEdKT25sMjNHNVBzTXhIamU1NEhMR3ROcUJCVXVIZ1AxendidjhTeTAvQmJSUXZzbFJLYVo0Mlhob2VtR3hmMENyVkxHYWJmeVJITlJaRTFpZ21JUmh5TDRrUm5ieS9jai9jOTlRVmJNVXFqZFBVU2pSRnJkWi9tUHlXeExJU2M0bHdkWlNTUm5UZnVxWGJnRjZNUkNQQlRvN3hPUmFPNXRoSy9ndUVBM3BncU1haDBpTzFpaVAwek9OVHNPUk43WDhmaW5vNUxYZEM4YVpZTHZiUGlrQmZOMHFxM2pCcFdGb3hLVC9PUjA4ZkJqckNV [TRUNCATED]
2025-03-25 12:37:02 UTC	3386	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Expires: -1 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2VlZDJhMWU3OTAyN2Q4Yjc0MzQwMjNjZTNmYTI0YjRlY2Q2NWNkOWQxNmIyNmJjNmI4Y2VmZTc4ZDRmODIyZjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZWVkMmExZTc5MDI3ZDhiNzQzNDAyM2NlM2ZhMjRiNGVjZDY1Y2Q5ZDE2YjI2YmM2YjhjZWZlNzhkNGY4MjJmMiwxMzM4NzM4MDEyMTAwMDAwMDAsMCwxMzM4NzQ2NjIyMTgzNzMzNjgsMC4wLjAuMCwyNTgsOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkLCwsZmFhYTVhZTYtMmE1Mi00OGMyLTgwMmItZmUxODY5NmFiNzllLGZhYWE1YWU2LTJhNTItNDhjMi04MDJiLWZlMTg2OTZhYjc5ZSxFSkVYYnBwNC9rbXlGc3RHa1JmcUtRLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODkwNDksTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLG1kdFlhcTVZdEdKT25sMjNHNVBzTXhIamU1NEhMR3ROcUJCVXVIZ1AxendidjhTeTAvQmJSUXZzbFJLYVo0Mlhob2VtR3hmMENyVkxHYWJmeVJITlJaRTFpZ21JUmh5TDRrUm5ieS9jai9jOTlRVmJNVXFqZFBVU2pSRnJkWi9tUHlXeExJU2M0bHdkWlNTUm5UZnVxWGJnRjZNUkNQQlRvN3hPUmFPNXRoSy9ndUVBM3BncU1haDBpTzFpaVAwek9OVHNPUk43WDhmaW5vNUxYZEM4YVpZTHZiUGlrQmZOMHFxM2pCcFdGb3hLVC9PUjA4ZkJq [TRUNCATED] IsOCDI: 0 X-NetworkStatistics: 0,4194720,0,0,166,26343,26343,78843 X-SharePointHealthScore: 3 Referrer-Policy: no-referrer, strict-origin-when-cross-origin Server-Timing: LT; desc=0, RS; desc=G, RD; dur=44 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: b4f78da1-d004-c000-4620-ed23afa8b8cd request-id: b4f78da1-d004-c000-4620-ed23afa8b8cd MS-CV: oY33tATQAMBGIO0jr6i4zQ.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=9188040d-6c67-4c5b-b112-36a304b66dad&destinationEndpoint=Edge-Prod-BL2r5f&frontEnd=AFD&RemoteIP=161.77.13.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25905 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: CB01FF48437E4D3D88915EBC458277BE Ref B: BL2EDGE2711 Ref C: 2025-03-25T12:37:02Z Date: Tue, 25 Mar 2025 12:37:02 GMT Connection: close
2025-03-25 12:37:02 UTC	780	IN	Data Raw: 33 30 35 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 09 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0d 0a 09 3c 6d 65 74 61 0d 0a 09 09 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0d 0a 09 09 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f Data Ascii: 305<!DOCTYPE html><html lang="en-us" dir="ltr"><head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><metaname="viewport"content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no
2025-03-25 12:37:02 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 09 09 63 72 6f 73 73 6f 72 69 67 69 6e 3d 27 61 6e 6f 6e 79 6d 6f 75 73 27 0d 0a 09 09 09 09 09 61 73 3d 27 73 63 72 69 70 74 27 0d 0a 09 09 09 09 09 0d 0a 09 09 09 09 3e 0d 0a 0d 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 76 61 72 20 77 6f 70 69 44 69 61 67 43 6c 69 65 6e 74 20 3d 20 7b 20 64 6f 63 46 69 72 73 74 46 6c 75 73 68 54 69 6d 65 20 3a 20 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 20 7d 20 3b 0d 0a 09 09 76 61 72 20 77 61 63 55 69 48 6f 73 74 53 65 73 73 69 6f 6e 20 3d 20 6e 75 6c 6c 3b 0d 0a 09 09 76 61 72 20 77 6f 70 69 43 6f 6e 74 65 78 74 46 6c 75 73 68 54 69 6d 65 20 3d 20 6e 75 6c 6c 3b 0d 0a 09 09 76 61 72 20 69 73 45 61 72 6c 79 46 6c Data Ascii: 2000crossorigin='anonymous'as='script'><script type="text/javascript">var wopiDiagClient = { docFirstFlushTime : new Date().getTime() } ;var wacUiHostSession = null;var wopiContextFlushTime = null;var isEarlyFl
2025-03-25 12:37:02 UTC	4152	IN	Data Raw: 31 30 33 30 0d 0a 38 39 35 32 2c 38 35 31 39 39 33 36 2c 32 38 31 34 36 32 38 2c 31 38 37 39 38 33 34 36 39 32 2c 33 36 39 31 31 35 35 30 36 2c 38 30 39 31 31 31 37 34 34 2c 2d 35 31 38 37 37 38 33 36 31 2c 2d 31 30 37 33 37 34 30 37 39 39 2c 31 30 37 30 38 30 34 31 2c 38 37 31 38 33 33 39 2c 39 35 37 31 35 38 34 34 2c 36 36 37 31 36 30 33 38 2c 32 37 32 36 34 33 35 38 34 2c 31 30 37 37 33 37 39 35 38 34 2c 31 38 38 30 36 32 31 30 38 32 2c 31 30 37 36 38 39 31 39 30 34 2c 31 30 37 33 37 34 31 39 30 34 2c 33 37 31 32 32 38 36 37 33 2c 31 33 35 35 32 38 37 32 30 2c 31 33 35 31 38 30 38 2c 34 31 31 31 30 37 33 32 38 2c 33 33 33 33 38 30 30 31 33 2c 31 38 34 34 37 32 32 37 34 37 2c 31 36 30 35 31 39 30 32 39 35 2c 37 30 39 38 38 39 31 38 35 2c 32 31 33 36 33 Data Ascii: 10308952,8519936,2814628,1879834692,369115506,809111744,-518778361,-1073740799,10708041,8718339,95715844,66716038,272643584,1077379584,1880621082,1076891904,1073741904,371228673,135528720,1351808,411107328,333380013,1844722747,1605190295,709889185,21363
2025-03-25 12:37:02 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 32 44 32 32 37 2d 46 32 44 30 2d 34 46 44 46 2d 39 45 46 45 2d 44 46 34 36 36 36 32 31 44 38 45 36 22 3a 31 2c 22 41 35 33 46 32 44 36 36 2d 46 33 44 39 2d 34 36 35 32 2d 38 36 46 45 2d 36 31 42 46 32 36 39 35 35 46 46 31 22 3a 31 2c 22 36 32 31 39 37 46 39 45 2d 35 32 35 34 2d 34 34 43 43 2d 38 44 31 37 2d 45 37 36 37 31 45 43 39 36 33 36 34 22 3a 31 2c 22 31 46 32 35 32 32 35 31 2d 46 35 34 36 2d 35 38 32 30 2d 41 43 33 36 2d 45 39 37 46 41 30 38 44 42 37 37 34 22 3a 31 2c 22 37 31 46 43 43 36 36 39 2d 30 42 30 30 2d 34 44 43 36 2d 41 34 37 44 2d 43 38 46 37 32 30 46 44 41 32 31 37 22 3a 31 2c 22 32 42 37 42 31 35 34 42 2d 32 42 33 39 2d 34 46 39 33 2d 38 43 38 30 2d 38 36 31 32 30 37 31 41 46 38 35 35 22 3a 31 2c 22 33 36 37 45 35 43 Data Ascii: 20002D227-F2D0-4FDF-9EFE-DF466621D8E6":1,"A53F2D66-F3D9-4652-86FE-61BF26955FF1":1,"62197F9E-5254-44CC-8D17-E7671EC96364":1,"1F252251-F546-5820-AC36-E97FA08DB774":1,"71FCC669-0B00-4DC6-A47D-C8F720FDA217":1,"2B7B154B-2B39-4F93-8C80-8612071AF855":1,"367E5C
2025-03-25 12:37:02 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 22 3a 31 2c 22 34 34 32 33 30 30 38 45 2d 31 44 37 42 2d 34 31 39 33 2d 38 46 43 43 2d 45 42 32 35 46 31 45 35 44 43 34 34 22 3a 31 2c 22 38 41 33 36 46 35 41 43 2d 44 39 45 43 2d 34 30 32 30 2d 38 34 44 42 2d 43 36 32 37 33 41 41 45 45 32 37 32 22 3a 31 2c 22 41 45 30 37 44 39 46 33 2d 31 46 31 39 2d 34 41 43 41 2d 38 41 38 32 2d 43 39 42 38 43 44 41 45 45 45 38 37 22 3a 31 2c 22 32 44 46 37 46 41 38 35 2d 34 32 42 42 2d 34 34 33 36 2d 41 46 34 41 2d 38 45 30 37 30 32 33 36 43 35 39 34 22 3a 31 2c 22 36 34 41 37 35 31 30 33 2d 37 42 30 30 2d 34 35 35 44 2d 39 43 30 34 2d 38 30 31 44 45 42 39 39 35 44 44 41 22 3a 31 2c 22 30 35 32 37 39 39 39 46 2d 33 39 41 41 2d 34 44 45 43 2d 39 46 31 33 2d 44 41 45 45 37 45 43 38 43 45 46 32 22 3a 31 Data Ascii: 2000":1,"4423008E-1D7B-4193-8FCC-EB25F1E5DC44":1,"8A36F5AC-D9EC-4020-84DB-C6273AAEE272":1,"AE07D9F3-1F19-4ACA-8A82-C9B8CDAEEE87":1,"2DF7FA85-42BB-4436-AF4A-8E070236C594":1,"64A75103-7B00-455D-9C04-801DEB995DDA":1,"0527999F-39AA-4DEC-9F13-DAEE7EC8CEF2":1
2025-03-25 12:37:02 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 35 41 37 30 37 43 38 32 22 3a 31 2c 22 30 36 38 33 39 31 35 38 2d 44 45 45 34 2d 34 45 36 31 2d 38 38 43 41 2d 39 43 34 45 38 35 31 42 36 33 37 33 22 3a 31 2c 22 36 37 45 32 30 45 46 44 2d 31 34 30 46 2d 34 34 43 35 2d 39 38 46 42 2d 44 39 37 43 41 39 44 39 30 39 44 32 22 3a 31 2c 22 46 46 46 34 30 32 37 46 2d 46 46 39 43 2d 34 44 37 33 2d 42 45 34 36 2d 35 32 45 34 36 42 46 37 38 31 42 41 22 3a 31 2c 22 35 36 45 45 33 35 30 37 2d 45 44 35 32 2d 34 46 30 38 2d 41 44 43 35 2d 38 30 34 46 41 45 35 35 31 39 38 46 22 3a 31 2c 22 35 37 44 33 36 42 38 38 2d 31 37 33 33 2d 34 43 39 38 2d 38 32 43 35 2d 34 42 45 33 44 35 31 35 33 42 44 35 22 3a 31 2c 22 43 43 45 41 35 35 36 31 2d 35 36 42 33 2d 34 46 32 36 2d 39 32 38 33 2d 43 34 37 36 33 43 35 Data Ascii: 20005A707C82":1,"06839158-DEE4-4E61-88CA-9C4E851B6373":1,"67E20EFD-140F-44C5-98FB-D97CA9D909D2":1,"FFF4027F-FF9C-4D73-BE46-52E46BF781BA":1,"56EE3507-ED52-4F08-ADC5-804FAE55198F":1,"57D36B88-1733-4C98-82C5-4BE3D5153BD5":1,"CCEA5561-56B3-4F26-9283-C4763C5
2025-03-25 12:37:02 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 44 44 30 2d 43 45 38 46 39 46 30 38 33 46 41 35 22 3a 31 2c 22 34 46 46 41 30 44 30 30 2d 45 45 32 41 2d 34 43 31 44 2d 42 38 44 31 2d 34 38 44 39 31 37 43 32 37 45 38 30 22 3a 31 2c 22 43 31 42 35 37 41 41 32 2d 41 42 44 44 2d 34 45 34 45 2d 38 44 38 31 2d 41 34 35 31 44 44 35 42 31 43 42 37 22 3a 31 2c 22 41 45 43 37 43 46 35 32 2d 30 42 34 31 2d 34 39 45 36 2d 42 35 44 38 2d 34 36 37 42 44 32 36 44 32 32 31 31 22 3a 31 2c 22 35 36 32 35 35 31 42 38 2d 32 33 37 46 2d 34 36 41 30 2d 39 46 38 41 2d 42 38 41 45 41 42 43 41 39 41 45 31 22 3a 31 2c 22 37 34 32 38 45 33 43 41 2d 42 33 36 43 2d 34 31 32 38 2d 38 35 42 38 2d 42 41 36 32 33 34 30 32 33 36 44 30 22 3a 31 2c 22 44 37 39 42 44 32 36 38 2d 31 42 41 33 2d 34 45 33 36 2d 39 42 44 38 Data Ascii: 2000DD0-CE8F9F083FA5":1,"4FFA0D00-EE2A-4C1D-B8D1-48D917C27E80":1,"C1B57AA2-ABDD-4E4E-8D81-A451DD5B1CB7":1,"AEC7CF52-0B41-49E6-B5D8-467BD26D2211":1,"562551B8-237F-46A0-9F8A-B8AEABCA9AE1":1,"7428E3CA-B36C-4128-85B8-BA62340236D0":1,"D79BD268-1BA3-4E36-9BD8
2025-03-25 12:37:02 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 32 2d 34 39 37 32 2d 39 43 36 31 2d 34 44 45 42 42 38 39 36 30 46 31 39 22 3a 31 2c 22 42 42 39 43 41 38 41 41 2d 39 39 34 38 2d 34 33 30 46 2d 39 30 36 39 2d 35 34 34 36 43 30 34 34 36 43 33 36 22 3a 31 2c 22 44 39 39 41 39 39 34 41 2d 35 33 35 30 2d 34 44 36 42 2d 39 39 35 43 2d 36 42 35 32 46 31 43 38 45 34 35 35 22 3a 31 2c 22 42 45 42 44 31 38 37 39 2d 38 31 31 37 2d 34 45 38 45 2d 39 37 46 33 2d 44 34 37 32 42 36 43 32 39 45 44 30 22 3a 31 2c 22 45 35 32 43 30 31 32 30 2d 36 30 32 44 2d 34 36 37 46 2d 38 39 33 34 2d 35 37 45 34 41 38 30 46 30 33 39 46 22 3a 31 2c 22 33 43 32 41 42 30 33 34 2d 34 44 42 44 2d 34 39 31 34 2d 42 32 37 46 2d 38 41 45 43 37 38 38 31 35 39 34 38 22 3a 31 2c 22 43 34 42 30 36 45 30 34 2d 31 38 43 36 2d 34 Data Ascii: 20002-4972-9C61-4DEBB8960F19":1,"BB9CA8AA-9948-430F-9069-5446C0446C36":1,"D99A994A-5350-4D6B-995C-6B52F1C8E455":1,"BEBD1879-8117-4E8E-97F3-D472B6C29ED0":1,"E52C0120-602D-467F-8934-57E4A80F039F":1,"3C2AB034-4DBD-4914-B27F-8AEC78815948":1,"C4B06E04-18C6-4
2025-03-25 12:37:03 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 45 30 44 42 2d 30 30 36 34 2d 34 37 36 31 2d 39 44 35 33 2d 44 30 43 35 32 33 43 30 45 41 31 32 22 3a 31 2c 22 46 30 38 34 37 45 45 34 2d 44 45 37 36 2d 34 36 46 34 2d 41 42 32 30 2d 45 39 39 39 30 37 43 38 36 41 38 32 22 3a 31 2c 22 30 35 42 37 35 32 41 36 2d 30 34 44 39 2d 34 45 44 36 2d 42 45 31 36 2d 43 34 38 44 35 34 36 38 43 30 34 31 22 3a 31 2c 22 46 46 31 41 35 32 30 42 2d 45 35 37 37 2d 34 32 32 35 2d 42 39 38 30 2d 33 32 36 44 34 38 32 41 45 43 35 36 22 3a 31 2c 22 41 41 45 43 42 32 43 39 2d 39 43 42 30 2d 34 41 38 39 2d 42 30 30 36 2d 37 41 39 36 42 38 43 32 34 46 36 33 22 3a 31 2c 22 32 44 42 33 35 31 36 44 2d 36 46 44 36 2d 34 38 37 31 2d 39 42 37 46 2d 42 33 46 36 36 31 41 30 39 31 44 32 22 3a 31 2c 22 38 31 32 44 33 46 33 Data Ascii: 2000E0DB-0064-4761-9D53-D0C523C0EA12":1,"F0847EE4-DE76-46F4-AB20-E99907C86A82":1,"05B752A6-04D9-4ED6-BE16-C48D5468C041":1,"FF1A520B-E577-4225-B980-326D482AEC56":1,"AAECB2C9-9CB0-4A89-B006-7A96B8C24F63":1,"2DB3516D-6FD6-4871-9B7F-B3F661A091D2":1,"812D3F3
2025-03-25 12:37:03 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 3a 31 2c 22 41 37 30 36 46 41 36 32 2d 43 45 31 38 2d 34 44 35 42 2d 38 42 43 36 2d 32 38 45 36 30 33 44 41 39 37 39 32 22 3a 31 2c 22 39 45 44 45 32 35 34 39 2d 41 44 41 42 2d 34 39 36 42 2d 39 46 38 46 2d 46 38 43 38 34 46 38 41 38 44 36 41 22 3a 31 2c 22 31 44 41 35 46 44 36 39 2d 46 41 35 44 2d 34 41 34 44 2d 42 46 36 39 2d 32 37 31 46 45 30 34 41 37 33 37 39 22 3a 31 2c 22 34 42 37 44 44 42 42 36 2d 44 35 46 44 2d 34 39 33 44 2d 39 43 44 31 2d 41 32 32 39 42 34 43 36 44 41 45 37 22 3a 31 2c 22 44 31 38 46 37 42 39 36 2d 33 46 31 41 2d 34 34 34 31 2d 38 43 37 35 2d 35 45 43 38 34 45 45 30 36 32 45 30 22 3a 31 2c 22 34 34 30 32 42 33 36 46 2d 30 36 37 46 2d 34 32 43 43 2d 42 46 39 43 2d 37 39 39 43 36 32 37 35 31 37 32 35 22 3a 31 2c Data Ascii: 2000:1,"A706FA62-CE18-4D5B-8BC6-28E603DA9792":1,"9EDE2549-ADAB-496B-9F8F-F8C84F8A8D6A":1,"1DA5FD69-FA5D-4A4D-BF69-271FE04A7379":1,"4B7DDBB6-D5FD-493D-9CD1-A229B4C6DAE7":1,"D18F7B96-3F1A-4441-8C75-5EC84EE062E0":1,"4402B36F-067F-42CC-BF9C-799C62751725":1,

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:03 UTC	649	OUT	GET /files/odsp-web-prod_2025-03-14.006/wacowlhostwebpack/wacowlhostwebpack.js HTTP/1.1 Host: res-1.public.onecdn.static.microsoft Connection: keep-alive Origin: https://onedrive.live.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://onedrive.live.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:03 UTC	1497	IN	HTTP/1.1 200 OK Last-Modified: Thu, 20 Mar 2025 20:24:21 GMT x-ms-request-id: 61bf6619-e01e-000a-4e01-9a66b5000000 x-ms-meta-Sourcebuild: odsp-web-prod_2025-03-14.006 x-ms-meta-Sourceid: 83289B6762F7AF5DC56B5825768D2E22CDE730CD3C08A6FB3087AA0F45119AF600 Cache-Control: public, max-age=630720000 Date: Tue, 25 Mar 2025 12:37:03 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,quic=":443"; ma=93600; v="43" Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.57.70.77,b=688086923,c=g,n=US_NJ_SECAUCUS,o=20940] AK-Network: FF Report-To: {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=SECAUCUS&ASN=20940&Country=US&Region=NJ&RequestIdentifier=0.4d463917.1742906223.29035f8b&TotalRTCDNTime=92&CompressionType=gzip&FileSize=154470"}],"include_subdomains ":true} NEL: {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Server-Timing: clientrtt; dur=92, clienttt; dur=, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child X-Content-Type-Options: nosniff Timing-Allow-Origin: * Access-Control-Expose-Headers: date,Akamai-Request-BC,X-Cdn-Provider,X-Ms-Request-Id Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Type: application/javascript X-CDN-Provider: Akamai
2025-03-25 12:37:03 UTC	14887	IN	Data Raw: 30 30 30 30 43 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 77 61 63 6f 77 6c 68 6f 73 74 77 65 62 70 61 63 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 28 29 3d 3e 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 3b 64 65 66 69 6e 65 28 22 6f 64 73 70 2d 6e 65 78 74 2f 72 6f 6f 74 73 2f 57 61 63 4f 77 6c 48 6f 73 74 22 2c 5b 22 6f 64 73 70 2e 72 65 61 63 74 2e 6c 69 62 22 5d 2c 28 29 3d 3e 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 5b 28 65 2c 74 2c 6e 29 3d 3e 7b 6e 2e 72 28 74 29 2c 6e 2e 64 28 74 2c 7b 5f 5f 61 73 73 69 67 6e 3a 28 29 3d 3e Data Ascii: 0000C000/! For license information please see wacowlhostwebpack.js.LICENSE.txt /(()=>{var e=document.currentScript;define("odsp-next/roots/WacOwlHost",["odsp.react.lib"],()=>{var t;return(()=>{"use strict";var n=[(e,t,n)=>{n.r(t),n.d(t,{__assign:()=>
2025-03-25 12:37:03 UTC	16223	IN	Data Raw: 75 73 45 6e 61 62 6c 65 64 3a 7b 69 73 50 72 65 66 69 78 69 6e 67 44 69 73 61 62 6c 65 64 3a 21 30 2c 74 79 70 65 3a 6f 2e 61 2e 42 6f 6f 6c 65 61 6e 7d 7d 29 2e 77 69 74 68 44 61 74 61 28 7b 70 72 69 76 61 63 79 43 6c 61 73 73 69 66 69 63 61 74 69 6f 6e 3a 6f 2e 62 2e 72 65 71 75 69 72 65 64 53 65 72 76 69 63 65 2c 70 72 69 76 61 63 79 44 61 74 61 54 79 70 65 73 3a 5b 22 70 72 6f 64 75 63 74 41 6e 64 53 65 72 76 69 63 65 50 65 72 66 6f 72 6d 61 6e 63 65 22 5d 7d 29 29 7d 0a 2c 28 65 2c 74 2c 6e 29 3d 3e 7b 6e 2e 64 28 74 2c 7b 62 3a 28 29 3d 3e 63 2c 61 3a 28 29 3d 3e 61 7d 29 3b 76 61 72 20 61 2c 69 3d 6e 28 31 37 29 3b 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 5b 65 2e 73 63 68 65 6d 65 3d 30 5d 3d 22 73 63 68 65 6d 65 22 2c 65 5b 65 2e 61 75 74 68 6f Data Ascii: usEnabled:{isPrefixingDisabled:!0,type:o.a.Boolean}}).withData({privacyClassification:o.b.requiredService,privacyDataTypes:["productAndServicePerformance"]}))},(e,t,n)=>{n.d(t,{b:()=>c,a:()=>a});var a,i=n(17);!function(e){e[e.scheme=0]="scheme",e[e.autho
2025-03-25 12:37:03 UTC	16384	IN	Data Raw: 6e 2e 64 61 74 61 2c 5b 6e 2c 6e 2e 64 61 74 61 5d 2c 74 3f 76 6f 69 64 20 30 3a 6f 29 2c 63 6f 6e 74 65 78 74 3a 63 28 6e 2e 63 6f 6e 74 65 78 74 2c 5b 6e 2c 6e 2e 63 6f 6e 74 65 78 74 5d 2c 74 3f 76 6f 69 64 20 30 3a 73 29 2c 65 76 65 6e 74 54 79 70 65 3a 69 2c 69 64 3a 6e 2e 69 64 2c 76 65 63 74 6f 72 3a 6e 2e 76 65 63 74 6f 72 2c 65 6e 64 54 69 6d 65 3a 6e 2e 65 6e 64 54 69 6d 65 2c 70 61 72 65 6e 74 49 64 3a 6e 2e 70 61 72 65 6e 74 49 64 2c 6d 65 74 61 64 61 74 61 3a 6e 2e 6d 65 74 61 64 61 74 61 2c 63 72 69 74 69 63 61 6c 3a 6e 2e 63 72 69 74 69 63 61 6c 2c 65 76 65 6e 74 4e 61 6d 65 3a 6e 2e 65 76 65 6e 74 4e 61 6d 65 2c 73 74 61 72 74 54 69 6d 65 3a 6e 2e 73 74 61 72 74 54 69 6d 65 2c 73 68 6f 72 74 45 76 65 6e 74 4e 61 6d 65 3a 6e 2e 73 68 6f 72 Data Ascii: n.data,[n,n.data],t?void 0:o),context:c(n.context,[n,n.context],t?void 0:s),eventType:i,id:n.id,vector:n.vector,endTime:n.endTime,parentId:n.parentId,metadata:n.metadata,critical:n.critical,eventName:n.eventName,startTime:n.startTime,shortEventName:n.shor
2025-03-25 12:37:03 UTC	1670	IN	Data Raw: 75 28 72 2c 64 29 2c 68 28 65 2c 72 2c 64 29 2c 63 28 72 2c 64 29 3b 66 6f 72 28 64 3d 31 3b 64 3c 72 2e 6c 65 6e 67 74 68 3b 64 2b 3d 34 29 72 2e 73 70 6c 69 63 65 28 64 2c 31 2c 22 3a 22 2c 72 5b 64 5d 2c 22 3b 22 29 3b 72 65 74 75 72 6e 20 72 2e 6a 6f 69 6e 28 22 22 29 7d 66 75 6e 63 74 69 6f 6e 20 4f 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 5b 5d 2c 61 3d 31 3b 61 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 6e 5b 61 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 61 5d 3b 76 61 72 20 69 3d 6e 75 6c 6c 21 3d 3d 28 74 3d 65 2e 73 74 79 6c 65 73 68 65 65 74 29 26 26 76 6f 69 64 20 30 21 3d 3d 74 3f 74 3a 72 2e 61 2e 67 65 74 49 6e 73 74 61 6e 63 65 28 65 2e 73 68 61 64 6f 77 43 6f 6e 66 69 67 29 2c 6f 3d 53 28 6e 2c 76 6f 69 64 20 Data Ascii: u(r,d),h(e,r,d),c(r,d);for(d=1;d<r.length;d+=4)r.splice(d,1,":",r[d],";");return r.join("")}function O(e){for(var t,n=[],a=1;a<arguments.length;a++)n[a-1]=arguments[a];var i=null!==(t=e.stylesheet)&&void 0!==t?t:r.a.getInstance(e.shadowConfig),o=S(n,void
2025-03-25 12:37:03 UTC	3985	IN	Data Raw: 30 30 30 30 30 46 38 35 0d 0a 2b 67 3b 72 65 74 75 72 6e 20 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 56 26 26 4d 28 65 2c 6e 29 2c 53 28 6e 75 6c 6c 2c 74 2c 65 2c 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 43 28 65 2c 74 29 7b 76 61 72 20 6e 3d 2b 2b 67 3b 72 65 74 75 72 6e 20 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 56 26 26 4d 28 65 2c 6e 2c 21 30 29 2c 53 28 74 2c 6e 75 6c 6c 2c 65 2c 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 4f 28 65 2c 74 2c 6e 29 7b 6b 28 65 2c 7b 63 3a 74 2c 65 3a 6e 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 77 28 65 2c 74 2c 6e 2c 61 29 7b 65 2e 5f 76 61 6c 75 65 3d 74 2c 4c 28 65 2c 74 2c 6e 2c 61 29 2c 65 2e 5f 73 65 74 53 74 61 74 65 28 6d 29 7d 66 75 6e 63 74 69 6f 6e 20 45 28 65 2c 74 29 7b 76 61 72 20 6e 2c 61 2c 69 3d 65 2e 5f 76 61 6c 75 65 2c Data Ascii: 00000F85+g;return e instanceof V&&M(e,n),S(null,t,e,n)}function C(e,t){var n=++g;return e instanceof V&&M(e,n,!0),S(t,null,e,n)}function O(e,t,n){k(e,{c:t,e:n})}function w(e,t,n,a){e._value=t,L(e,t,n,a),e._setState(m)}function E(e,t){var n,a,i=e._value,
2025-03-25 12:37:03 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 29 26 26 61 2e 64 6f 6e 65 28 29 29 7d 63 61 74 63 68 28 65 29 7b 6e 3d 65 7d 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 26 26 6e 2e 6d 65 73 73 61 67 65 3d 3d 3d 62 7c 7c 72 28 6e 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 74 68 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 21 74 29 72 65 74 75 72 6e 20 74 68 69 73 3b 76 61 72 20 6e 2c 61 3d 74 68 69 73 2e 5f 76 61 6c 75 65 3b 74 72 79 7b 74 2e 68 61 6e 64 6c 65 73 4f 6e 45 72 72 6f 72 7c 7c 4c 28 74 68 69 73 2c 61 2c 44 2c 74 68 69 73 2c 74 29 2c 6e 3d 6e 65 77 20 4e 28 74 28 61 29 29 7d 63 61 74 63 68 28 65 29 7b 6e 3d 65 3d 3d 3d 61 3f 74 68 69 73 3a 6e 65 77 20 52 28 65 29 7d 72 65 74 75 72 6e 20 6e 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 63 Data Ascii: 00004000)&&a.done())}catch(e){n=e}n instanceof Error&&n.message===b\|\|r(n)},e.prototype.then=function(e,t){if(!t)return this;var n,a=this._value;try{t.handlesOnError\|\|L(this,a,D,this,t),n=new N(t(a))}catch(e){n=e===a?this:new R(e)}return n},e.prototype.c
2025-03-25 12:37:03 UTC	12	IN	Data Raw: 6c 65 6e 67 74 68 3b 6e 2b 2b 0d 0a Data Ascii: length;n++
2025-03-25 12:37:03 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 29 74 5b 6e 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 3b 69 66 28 21 6f 2e 5f 69 73 44 69 73 70 6f 73 65 64 29 7b 76 61 72 20 61 3b 74 72 79 7b 69 66 28 21 31 3d 3d 3d 28 61 3d 69 2e 61 70 70 6c 79 28 64 2c 74 29 29 26 26 74 5b 30 5d 26 26 74 5b 30 5d 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 29 7b 76 61 72 20 72 3d 74 5b 30 5d 3b 72 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 65 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 72 29 7d 7d 63 61 74 63 68 28 72 29 7b 6f 2e 5f 6f 6e 45 72 72 6f 72 28 72 29 7d 72 65 74 75 72 6e 20 61 7d 7d 3b 6c 2e 65 6c 65 6d 65 6e 74 43 61 6c 6c 62 61 63 6b 3d 75 2c 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 6e 2c 75 2c 72 29 7d 65 6c 73 65 20 6c 2e 6f 62 6a 65 63 Data Ascii: 00004000)t[n]=arguments[n];if(!o._isDisposed){var a;try{if(!1===(a=i.apply(d,t))&&t[0]&&t[0].preventDefault){var r=t[0];r.preventDefault(),e.stopPropagation(r)}}catch(r){o._onError(r)}return a}};l.elementCallback=u,t.addEventListener(n,u,r)}else l.objec
2025-03-25 12:37:03 UTC	12	IN	Data Raw: 73 74 55 72 6c 3b 69 66 28 74 0d 0a Data Ascii: stUrl;if(t
2025-03-25 12:37:03 UTC	16384	IN	Data Raw: 30 30 30 30 36 32 46 33 0d 0a 29 69 66 28 22 2f 22 3d 3d 3d 74 5b 30 5d 7c 7c 74 2e 69 6e 64 65 78 4f 66 28 22 3a 2f 2f 22 29 3e 2d 31 29 65 3d 75 28 74 29 3b 65 6c 73 65 7b 76 61 72 20 6e 3d 74 68 69 73 2e 5f 67 65 74 57 65 62 55 72 6c 28 29 7c 7c 74 68 69 73 2e 64 65 66 61 75 6c 74 46 75 6c 6c 57 65 62 55 72 6c 3b 6e 26 26 28 65 3d 22 22 2e 63 6f 6e 63 61 74 28 6e 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 29 29 7d 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 67 65 74 4c 69 73 74 55 72 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 2c 65 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 67 65 74 57 65 62 55 72 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 3d 74 68 69 73 2e 5f 72 61 77 57 65 62 55 72 6c 3b 72 65 74 75 72 6e 20 74 26 Data Ascii: 000062F3)if("/"===t[0]\|\|t.indexOf("://")>-1)e=u(t);else{var n=this._getWebUrl()\|\|this.defaultFullWebUrl;n&&(e="".concat(n,"/").concat(t))}return this._getListUrl=function(){return e},e},e.prototype._getWebUrl=function(){var e,t=this._rawWebUrl;return t&

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:03 UTC	629	OUT	GET /files/sp-client/odsp.react/odsp.react.lib-9ea4d016.js HTTP/1.1 Host: res-1.public.onecdn.static.microsoft Connection: keep-alive Origin: https://onedrive.live.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://onedrive.live.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:03 UTC	1494	IN	HTTP/1.1 200 OK Last-Modified: Fri, 11 Oct 2024 09:59:33 GMT x-ms-request-id: 84bac740-001e-0012-5a29-60b9d2000000 x-ms-meta-Sourcebuild: odsp-web-prod_2024-10-11.001 x-ms-meta-Sourceid: 2E56118CD5C69BB64C3DB803BF3814D6075069CD6135A499573A4560FBD1084E00 Cache-Control: public, max-age=630720000 Date: Tue, 25 Mar 2025 12:37:03 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,quic=":443"; ma=93600; v="43" Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.57.70.71,b=93432195,c=g,n=US_NJ_SECAUCUS,o=20940] AK-Network: FF Report-To: {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=SECAUCUS&ASN=20940&Country=US&Region=NJ&RequestIdentifier=0.47463917.1742906223.591a983&TotalRTCDNTime=92&CompressionType=gzip&FileSize=42635"}],"include_subdomains ":true} NEL: {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Server-Timing: clientrtt; dur=92, clienttt; dur=, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child X-Content-Type-Options: nosniff Timing-Allow-Origin: * Access-Control-Expose-Headers: date,Akamai-Request-BC,X-Cdn-Provider,X-Ms-Request-Id Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Type: application/javascript X-CDN-Provider: Akamai
2025-03-25 12:37:03 UTC	14890	IN	Data Raw: 30 30 30 30 42 31 37 33 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6f 64 73 70 2e 72 65 61 63 74 2e 6c 69 62 2d 39 65 61 34 64 30 31 36 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 6f 64 73 70 4e 65 78 74 57 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 73 65 6c 66 2e 6f 64 73 70 4e 65 78 74 57 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6f 64 73 70 2e 72 65 61 63 74 2e 6c 69 62 22 5d 2c 7b 72 65 61 63 74 5f 33 34 30 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 2c 6e 3d 4f 62 6a 65 63 74 2e 70 Data Ascii: 0000B173/! For license information please see odsp.react.lib-9ea4d016.js.LICENSE.txt /(self.odspNextWebpackJsonp=self.odspNextWebpackJsonp\|\|[]).push([["odsp.react.lib"],{react_340:function(e){"use strict";var t=Object.getOwnPropertySymbols,n=Object.p
2025-03-25 12:37:03 UTC	16256	IN	Data Raw: 78 4f 72 64 69 6e 61 6c 47 72 6f 75 70 3a 21 30 2c 63 6f 6c 75 6d 6e 43 6f 75 6e 74 3a 21 30 2c 63 6f 6c 75 6d 6e 73 3a 21 30 2c 66 6c 65 78 3a 21 30 2c 66 6c 65 78 47 72 6f 77 3a 21 30 2c 66 6c 65 78 50 6f 73 69 74 69 76 65 3a 21 30 2c 66 6c 65 78 53 68 72 69 6e 6b 3a 21 30 2c 66 6c 65 78 4e 65 67 61 74 69 76 65 3a 21 30 2c 66 6c 65 78 4f 72 64 65 72 3a 21 30 2c 67 72 69 64 41 72 65 61 3a 21 30 2c 67 72 69 64 52 6f 77 3a 21 30 2c 67 72 69 64 52 6f 77 45 6e 64 3a 21 30 2c 67 72 69 64 52 6f 77 53 70 61 6e 3a 21 30 2c 67 72 69 64 52 6f 77 53 74 61 72 74 3a 21 30 2c 67 72 69 64 43 6f 6c 75 6d 6e 3a 21 30 2c 67 72 69 64 43 6f 6c 75 6d 6e 45 6e 64 3a 21 30 2c 67 72 69 64 43 6f 6c 75 6d 6e 53 70 61 6e 3a 21 30 2c 67 72 69 64 43 6f 6c 75 6d 6e 53 74 61 72 74 3a Data Ascii: xOrdinalGroup:!0,columnCount:!0,columns:!0,flex:!0,flexGrow:!0,flexPositive:!0,flexShrink:!0,flexNegative:!0,flexOrder:!0,gridArea:!0,gridRow:!0,gridRowEnd:!0,gridRowSpan:!0,gridRowStart:!0,gridColumn:!0,gridColumnEnd:!0,gridColumnSpan:!0,gridColumnStart:
2025-03-25 12:37:03 UTC	14293	IN	Data Raw: 65 3a 21 30 2c 75 72 6c 3a 21 30 2c 77 65 65 6b 3a 21 30 7d 3b 66 75 6e 63 74 69 6f 6e 20 57 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 22 69 6e 70 75 74 22 3d 3d 3d 74 3f 21 21 4b 6e 5b 65 2e 74 79 70 65 5d 3a 22 74 65 78 74 61 72 65 61 22 3d 3d 3d 74 7d 66 75 6e 63 74 69 6f 6e 20 71 6e 28 65 2c 74 2c 6e 2c 61 29 7b 4c 65 28 61 29 2c 30 3c 28 74 3d 46 61 28 74 2c 22 6f 6e 43 68 61 6e 67 65 22 29 29 2e 6c 65 6e 67 74 68 26 26 28 6e 3d 6e 65 77 20 66 6e 28 22 6f 6e 43 68 61 6e 67 65 22 2c 22 63 68 61 6e 67 65 22 2c 6e 75 6c 6c 2c 6e 2c 61 29 2c 65 2e 70 75 73 68 28 7b 65 76 65 6e 74 3a 6e 2c 6c 69 73 74 65 6e 65 72 73 3a 74 7d 29 Data Ascii: e:!0,url:!0,week:!0};function Wn(e){var t=e&&e.nodeName&&e.nodeName.toLowerCase();return"input"===t?!!Kn[e.type]:"textarea"===t}function qn(e,t,n,a){Le(a),0<(t=Fa(t,"onChange")).length&&(n=new fn("onChange","change",null,n,a),e.push({event:n,listeners:t})
2025-03-25 12:37:03 UTC	16384	IN	Data Raw: 30 30 30 30 43 30 30 30 0d 0a 61 3d 61 2e 67 65 74 43 68 69 6c 64 43 6f 6e 74 65 78 74 28 29 29 69 66 28 21 28 72 20 69 6e 20 65 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 31 30 38 2c 71 28 74 29 7c 7c 22 55 6e 6b 6e 6f 77 6e 22 2c 72 29 29 3b 72 65 74 75 72 6e 20 69 28 7b 7d 2c 6e 2c 61 29 7d 66 75 6e 63 74 69 6f 6e 20 79 69 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 28 65 3d 65 2e 73 74 61 74 65 4e 6f 64 65 29 26 26 65 2e 5f 5f 72 65 61 63 74 49 6e 74 65 72 6e 61 6c 4d 65 6d 6f 69 7a 65 64 4d 65 72 67 65 64 43 68 69 6c 64 43 6f 6e 74 65 78 74 7c 7c 75 69 2c 6d 69 3d 66 69 2e 63 75 72 72 65 6e 74 2c 6c 69 28 66 69 2c 65 29 2c 6c 69 28 70 69 2c 70 69 2e 63 75 72 72 65 6e 74 29 2c 21 30 7d 66 75 6e 63 74 69 6f 6e 20 53 69 28 65 2c 74 2c 6e 29 7b 76 61 72 Data Ascii: 0000C000a=a.getChildContext())if(!(r in e))throw Error(o(108,q(t)\|\|"Unknown",r));return i({},n,a)}function yi(e){return e=(e=e.stateNode)&&e.__reactInternalMemoizedMergedChildContext\|\|ui,mi=fi.current,li(fi,e),li(pi,pi.current),!0}function Si(e,t,n){var
2025-03-25 12:37:03 UTC	16384	IN	Data Raw: 65 2c 72 3d 6e 2e 70 65 6e 64 69 6e 67 3b 69 66 28 6e 75 6c 6c 21 3d 3d 72 29 7b 69 66 28 6e 75 6c 6c 21 3d 3d 69 29 7b 76 61 72 20 73 3d 69 2e 6e 65 78 74 3b 69 2e 6e 65 78 74 3d 72 2e 6e 65 78 74 2c 72 2e 6e 65 78 74 3d 73 7d 61 2e 62 61 73 65 51 75 65 75 65 3d 69 3d 72 2c 6e 2e 70 65 6e 64 69 6e 67 3d 6e 75 6c 6c 7d 69 66 28 6e 75 6c 6c 21 3d 3d 69 29 7b 69 3d 69 2e 6e 65 78 74 2c 61 3d 61 2e 62 61 73 65 53 74 61 74 65 3b 76 61 72 20 63 3d 73 3d 72 3d 6e 75 6c 6c 2c 64 3d 69 3b 64 6f 7b 76 61 72 20 6c 3d 64 2e 6c 61 6e 65 3b 69 66 28 28 58 72 26 6c 29 3d 3d 3d 6c 29 6e 75 6c 6c 21 3d 3d 63 26 26 28 63 3d 63 2e 6e 65 78 74 3d 7b 6c 61 6e 65 3a 30 2c 61 63 74 69 6f 6e 3a 64 2e 61 63 74 69 6f 6e 2c 65 61 67 65 72 52 65 64 75 63 65 72 3a 64 2e 65 61 67 65 Data Ascii: e,r=n.pending;if(null!==r){if(null!==i){var s=i.next;i.next=r.next,r.next=s}a.baseQueue=i=r,n.pending=null}if(null!==i){i=i.next,a=a.baseState;var c=s=r=null,d=i;do{var l=d.lane;if((Xr&l)===l)null!==c&&(c=c.next={lane:0,action:d.action,eagerReducer:d.eage
2025-03-25 12:37:03 UTC	1815	IN	Data Raw: 61 28 22 63 6c 6f 73 65 22 2c 61 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 69 66 72 61 6d 65 22 3a 63 61 73 65 22 6f 62 6a 65 63 74 22 3a 63 61 73 65 22 65 6d 62 65 64 22 3a 41 61 28 22 6c 6f 61 64 22 2c 61 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 76 69 64 65 6f 22 3a 63 61 73 65 22 61 75 64 69 6f 22 3a 66 6f 72 28 65 3d 30 3b 65 3c 43 61 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 41 61 28 43 61 5b 65 5d 2c 61 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 73 6f 75 72 63 65 22 3a 41 61 28 22 65 72 72 6f 72 22 2c 61 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 69 6d 67 22 3a 63 61 73 65 22 69 6d 61 67 65 22 3a 63 61 73 65 22 6c 69 6e 6b 22 3a 41 61 28 22 65 72 72 6f 72 22 2c 61 29 2c 41 61 28 22 6c 6f 61 64 22 2c 61 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 64 65 74 61 69 6c 73 22 3a Data Ascii: a("close",a);break;case"iframe":case"object":case"embed":Aa("load",a);break;case"video":case"audio":for(e=0;e<Ca.length;e++)Aa(Ca[e],a);break;case"source":Aa("error",a);break;case"img":case"image":case"link":Aa("error",a),Aa("load",a);break;case"details":
2025-03-25 12:37:03 UTC	14581	IN	Data Raw: 65 61 22 3a 63 65 28 65 2c 61 29 2c 72 3d 73 65 28 65 2c 61 29 2c 41 61 28 22 69 6e 76 61 6c 69 64 22 2c 65 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 72 3d 61 7d 49 65 28 6e 2c 72 29 3b 76 61 72 20 6c 3d 72 3b 66 6f 72 28 73 20 69 6e 20 6c 29 69 66 28 6c 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 73 29 29 7b 76 61 72 20 75 3d 6c 5b 73 5d 3b 22 73 74 79 6c 65 22 3d 3d 3d 73 3f 53 65 28 65 2c 75 29 3a 22 64 61 6e 67 65 72 6f 75 73 6c 79 53 65 74 49 6e 6e 65 72 48 54 4d 4c 22 3d 3d 3d 73 3f 6e 75 6c 6c 21 3d 28 75 3d 75 3f 75 2e 5f 5f 68 74 6d 6c 3a 76 6f 69 64 20 30 29 26 26 68 65 28 65 2c 75 29 3a 22 63 68 69 6c 64 72 65 6e 22 3d 3d 3d 73 3f 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 75 3f 28 22 74 65 78 74 61 72 65 61 22 21 3d 3d 6e 7c Data Ascii: ea":ce(e,a),r=se(e,a),Aa("invalid",e);break;default:r=a}Ie(n,r);var l=r;for(s in l)if(l.hasOwnProperty(s)){var u=l[s];"style"===s?Se(e,u):"dangerouslySetInnerHTML"===s?null!=(u=u?u.__html:void 0)&&he(e,u):"children"===s?"string"==typeof u?("textarea"!==n\|
2025-03-25 12:37:03 UTC	5695	IN	Data Raw: 30 30 30 30 31 36 33 33 0d 0a 65 72 6e 61 74 65 29 26 26 28 6e 2e 63 68 69 6c 64 4c 61 6e 65 73 7c 3d 74 29 2c 6e 3d 65 2c 65 3d 65 2e 72 65 74 75 72 6e 3b 72 65 74 75 72 6e 20 33 3d 3d 3d 6e 2e 74 61 67 3f 6e 2e 73 74 61 74 65 4e 6f 64 65 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 70 63 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 65 2e 63 61 6c 6c 62 61 63 6b 4e 6f 64 65 2c 61 3d 65 2e 73 75 73 70 65 6e 64 65 64 4c 61 6e 65 73 2c 69 3d 65 2e 70 69 6e 67 65 64 4c 61 6e 65 73 2c 72 3d 65 2e 65 78 70 69 72 61 74 69 6f 6e 54 69 6d 65 73 2c 73 3d 65 2e 70 65 6e 64 69 6e 67 4c 61 6e 65 73 3b 30 3c 73 3b 29 7b 76 61 72 20 63 3d 33 31 2d 7a 74 28 73 29 2c 64 3d 31 3c 3c 63 2c 6c 3d 72 5b 63 5d 3b 69 66 28 2d 31 3d 3d 3d 6c 29 7b 69 66 28 30 3d 3d 28 64 26 Data Ascii: 00001633ernate)&&(n.childLanes\|=t),n=e,e=e.return;return 3===n.tag?n.stateNode:null}function pc(e,t){for(var n=e.callbackNode,a=e.suspendedLanes,i=e.pingedLanes,r=e.expirationTimes,s=e.pendingLanes;0<s;){var c=31-zt(s),d=1<<c,l=r[c];if(-1===l){if(0==(d&
2025-03-25 12:37:03 UTC	16384	IN	Data Raw: 30 30 30 30 37 36 35 41 0d 0a 63 28 65 29 3a 6b 73 3d 74 2c 45 73 2e 63 75 72 72 65 6e 74 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 45 63 28 65 29 7b 76 61 72 20 74 3d 65 3b 64 6f 7b 76 61 72 20 6e 3d 74 2e 61 6c 74 65 72 6e 61 74 65 3b 69 66 28 65 3d 74 2e 72 65 74 75 72 6e 2c 30 3d 3d 28 32 30 34 38 26 74 2e 66 6c 61 67 73 29 29 7b 69 66 28 6e 75 6c 6c 21 3d 3d 28 6e 3d 69 73 28 6e 2c 74 2c 50 73 29 29 29 72 65 74 75 72 6e 20 76 6f 69 64 28 6b 73 3d 6e 29 3b 69 66 28 32 34 21 3d 3d 28 6e 3d 74 29 2e 74 61 67 26 26 32 33 21 3d 3d 6e 2e 74 61 67 7c 7c 6e 75 6c 6c 3d 3d 3d 6e 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 65 7c 7c 30 21 3d 28 31 30 37 33 37 34 31 38 32 34 26 50 73 29 7c 7c 30 3d 3d 28 34 26 6e 2e 6d 6f 64 65 29 29 7b 66 6f 72 28 76 61 72 20 61 Data Ascii: 0000765Ac(e):ks=t,Es.current=null}function Ec(e){var t=e;do{var n=t.alternate;if(e=t.return,0==(2048&t.flags)){if(null!==(n=is(n,t,Ps)))return void(ks=n);if(24!==(n=t).tag&&23!==n.tag\|\|null===n.memoizedState\|\|0!=(1073741824&Ps)\|\|0==(4&n.mode)){for(var a
2025-03-25 12:37:03 UTC	13924	IN	Data Raw: 74 65 72 6e 61 6c 52 6f 6f 74 2c 74 3d 65 2e 63 6f 6e 74 61 69 6e 65 72 49 6e 66 6f 3b 58 63 28 6e 75 6c 6c 2c 65 2c 6e 75 6c 6c 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 5b 24 61 5d 3d 6e 75 6c 6c 7d 29 7d 2c 65 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 31 33 3d 3d 3d 65 2e 74 61 67 26 26 28 75 63 28 65 2c 34 2c 64 63 28 29 29 2c 65 64 28 65 2c 34 29 29 7d 2c 74 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 31 33 3d 3d 3d 65 2e 74 61 67 26 26 28 75 63 28 65 2c 36 37 31 30 38 38 36 34 2c 64 63 28 29 29 2c 65 64 28 65 2c 36 37 31 30 38 38 36 34 29 29 7d 2c 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 31 33 3d 3d 3d 65 2e 74 61 67 29 7b 76 61 72 20 74 3d 64 63 28 29 2c 6e 3d 6c 63 28 65 29 3b 75 63 28 65 2c 6e 2c 74 29 2c 65 64 28 65 2c 6e 29 7d 7d 2c 61 Data Ascii: ternalRoot,t=e.containerInfo;Xc(null,e,null,function(){t[$a]=null})},et=function(e){13===e.tag&&(uc(e,4,dc()),ed(e,4))},tt=function(e){13===e.tag&&(uc(e,67108864,dc()),ed(e,67108864))},nt=function(e){if(13===e.tag){var t=dc(),n=lc(e);uc(e,n,t),ed(e,n)}},a

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:04 UTC	745	OUT	POST /suite/RemoteUls.ashx?usid=c7fcd40e-f3d7-df9e-33b8-2b7b036eb358&officeserverversion= HTTP/1.1 Host: common.online.office.com Connection: keep-alive Content-Length: 699 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-mobile: ?0 Accept: / Origin: https://onedrive.live.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://onedrive.live.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:04 UTC	699	OUT	Data Raw: 7b 22 54 22 3a 31 37 34 32 39 30 36 32 32 33 33 31 32 2c 22 4c 22 3a 5b 7b 22 47 22 3a 35 32 31 31 36 34 32 33 38 2c 22 54 22 3a 34 2c 22 4d 22 3a 22 4f 6e 65 4e 6f 74 65 4a 73 41 70 69 56 32 47 61 74 65 3a 20 44 69 73 61 62 6c 65 64 22 2c 22 43 22 3a 33 30 32 37 2c 22 44 22 3a 35 30 7d 2c 7b 22 47 22 3a 35 37 36 35 37 38 35 38 34 2c 22 54 22 3a 34 2c 22 4d 22 3a 22 4c 65 61 6e 20 55 69 20 48 6f 73 74 3a 20 62 6f 6f 74 41 70 70 22 2c 22 43 22 3a 33 30 32 37 2c 22 44 22 3a 35 30 7d 2c 7b 22 47 22 3a 35 34 36 31 38 32 30 34 38 2c 22 54 22 3a 35 2c 22 4d 22 3a 22 42 6f 6f 74 41 70 70 3a 20 4c 6f 61 64 20 64 6f 63 75 6d 65 6e 74 20 72 65 74 75 72 6e 65 64 22 2c 22 43 22 3a 33 30 32 37 2c 22 44 22 3a 35 30 7d 2c 7b 22 47 22 3a 35 35 33 37 32 36 32 38 35 2c 22 Data Ascii: {"T":1742906223312,"L":[{"G":521164238,"T":4,"M":"OneNoteJsApiV2Gate: Disabled","C":3027,"D":50},{"G":576578584,"T":4,"M":"Lean Ui Host: bootApp","C":3027,"D":50},{"G":546182048,"T":5,"M":"BootApp: Load document returned","C":3027,"D":50},{"G":553726285,"

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:04 UTC	625	OUT	GET /files/sp-client/odsp.1ds/odsp.1ds.lib-6996f8ab.js HTTP/1.1 Host: res-1.public.onecdn.static.microsoft Connection: keep-alive Origin: https://onedrive.live.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://onedrive.live.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:04 UTC	1494	IN	HTTP/1.1 200 OK Last-Modified: Fri, 14 Mar 2025 10:36:03 GMT x-ms-request-id: a27d3b81-e01e-001a-54e4-96a3dd000000 x-ms-meta-Sourcebuild: odsp-web-prod_2025-03-14.001 x-ms-meta-Sourceid: 66B0152992D2B2BDDB4B8AA6A4085BB0784D7C238605C5568FF03996DB42925F00 Cache-Control: public, max-age=630720000 Date: Tue, 25 Mar 2025 12:37:04 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,quic=":443"; ma=93600; v="43" Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.57.70.71,b=93449105,c=g,n=US_NJ_SECAUCUS,o=20940] AK-Network: FF Report-To: {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=SECAUCUS&ASN=20940&Country=US&Region=NJ&RequestIdentifier=0.47463917.1742906224.591eb91&TotalRTCDNTime=93&CompressionType=gzip&FileSize=51416"}],"include_subdomains ":true} NEL: {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Server-Timing: clientrtt; dur=93, clienttt; dur=, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child X-Content-Type-Options: nosniff Timing-Allow-Origin: * Access-Control-Expose-Headers: date,Akamai-Request-BC,X-Cdn-Provider,X-Ms-Request-Id Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Type: application/javascript X-CDN-Provider: Akamai
2025-03-25 12:37:04 UTC	14890	IN	Data Raw: 30 30 30 30 42 46 36 46 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6f 64 73 70 2e 31 64 73 2e 6c 69 62 2d 36 39 39 36 66 38 61 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 6f 64 73 70 4e 65 78 74 57 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 73 65 6c 66 2e 6f 64 73 70 4e 65 78 74 57 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6f 64 73 70 2e 31 64 73 2e 6c 69 62 22 5d 2c 7b 22 31 64 73 2d 6c 69 62 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 72 28 74 29 2c 6e 2e 64 28 74 2c 7b 5f 44 65 62 75 67 50 6c 75 67 69 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 Data Ascii: 0000BF6F/! For license information please see odsp.1ds.lib-6996f8ab.js.LICENSE.txt /"use strict";(self.odspNextWebpackJsonp=self.odspNextWebpackJsonp\|\|[]).push([["odsp.1ds.lib"],{"1ds-lib":function(e,t,n){n.r(t),n.d(t,{_DebugPlugin:function(){return
2025-03-25 12:37:04 UTC	16207	IN	Data Raw: 76 61 72 20 72 3d 74 5b 69 5d 3b 72 26 26 28 6e 2e 6e 73 26 26 6e 2e 6e 73 21 3d 3d 72 2e 65 76 74 4e 61 6d 65 2e 6e 73 7c 7c 61 26 26 21 61 28 72 29 7c 7c 28 58 74 28 65 2c 72 2e 65 76 74 4e 61 6d 65 2c 72 2e 68 61 6e 64 6c 65 72 2c 72 2e 63 61 70 74 75 72 65 29 2c 74 2e 73 70 6c 69 63 65 28 69 2c 31 29 29 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 24 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3f 59 74 28 22 78 78 22 2c 44 65 28 74 29 3f 5b 65 5d 2e 63 6f 6e 63 61 74 28 74 29 3a 5b 65 2c 74 5d 29 2e 6e 73 2e 73 70 6c 69 74 28 22 2e 22 29 3a 65 7d 66 75 6e 63 74 69 6f 6e 20 65 6e 28 65 2c 74 2c 6e 2c 61 2c 69 29 7b 76 61 72 20 72 3b 76 6f 69 64 20 30 3d 3d 3d 69 26 26 28 69 3d 21 31 29 3b 76 61 72 20 6f 3d 21 31 3b 69 66 28 65 29 74 72 79 7b 76 61 72 20 73 3d Data Ascii: var r=t[i];r&&(n.ns&&n.ns!==r.evtName.ns\|\|a&&!a(r)\|\|(Xt(e,r.evtName,r.handler,r.capture),t.splice(i,1)))}}function $t(e,t){return t?Yt("xx",De(t)?[e].concat(t):[e,t]).ns.split("."):e}function en(e,t,n,a,i){var r;void 0===i&&(i=!1);var o=!1;if(e)try{var s=
2025-03-25 12:37:04 UTC	16384	IN	Data Raw: 7c 28 65 3f 28 69 3d 65 2c 6e 3d 21 30 2c 72 3d 21 30 29 3a 6e 3d 21 31 2c 74 3d 21 30 29 7d 7d 29 7d 72 65 74 75 72 6e 20 65 2e 5f 5f 69 65 44 79 6e 3d 31 2c 65 7d 28 29 2c 52 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 76 61 72 20 74 3d 7b 7d 3b 71 28 65 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 73 65 74 4b 69 6c 6c 53 77 69 74 63 68 54 65 6e 61 6e 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 65 26 26 6e 29 74 72 79 7b 76 61 72 20 61 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 5b 5d 3b 72 65 74 75 72 6e 20 65 26 26 45 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 2e 70 75 73 68 28 4c 65 28 65 29 29 7d 29 2c 74 7d 28 65 2e 73 70 6c 69 74 28 22 2c 22 29 29 3b 69 66 28 22 Data Ascii: \|(e?(i=e,n=!0,r=!0):n=!1,t=!0)}})}return e.__ieDyn=1,e}(),Ra=function(){function e(){var t={};q(e,this,function(e){e.setKillSwitchTenants=function(e,n){if(e&&n)try{var a=function(e){var t=[];return e&&Ee(e,function(e){t.push(Le(e))}),t}(e.split(","));if("
2025-03-25 12:37:04 UTC	1538	IN	Data Raw: 2c 77 3d 21 30 2c 45 3d 21 31 2c 41 3d 36 2c 4c 3d 32 2c 64 3d 6e 75 6c 6c 2c 6c 3d 72 69 28 29 2c 72 3d 6e 65 77 20 6e 69 28 35 30 30 2c 32 2c 31 2c 7b 72 65 71 75 65 75 65 3a 51 2c 73 65 6e 64 3a 5a 2c 73 65 6e 74 3a 24 2c 64 72 6f 70 3a 65 65 2c 72 73 70 46 61 69 6c 3a 74 65 2c 6f 74 68 3a 6e 65 7d 2c 6c 29 2c 71 28 29 2c 43 5b 34 5d 3d 7b 62 61 74 63 68 65 73 3a 5b 5d 2c 69 4b 65 79 4d 61 70 3a 7b 7d 7d 2c 43 5b 33 5d 3d 7b 62 61 74 63 68 65 73 3a 5b 5d 2c 69 4b 65 79 4d 61 70 3a 7b 7d 7d 2c 43 5b 32 5d 3d 7b 62 61 74 63 68 65 73 3a 5b 5d 2c 69 4b 65 79 4d 61 70 3a 7b 7d 7d 2c 43 5b 31 5d 3d 7b 62 61 74 63 68 65 73 3a 5b 5d 2c 69 4b 65 79 4d 61 70 3a 7b 7d 7d 2c 61 65 28 29 7d 66 75 6e 63 74 69 6f 6e 20 48 28 65 2c 74 29 7b 30 3d 3d 3d 74 26 26 49 26 Data Ascii: ,w=!0,E=!1,A=6,L=2,d=null,l=ri(),r=new ni(500,2,1,{requeue:Q,send:Z,sent:$,drop:ee,rspFail:te,oth:ne},l),q(),C[4]={batches:[],iKeyMap:{}},C[3]={batches:[],iKeyMap:{}},C[2]={batches:[],iKeyMap:{}},C[1]={batches:[],iKeyMap:{}},ae()}function H(e,t){0===t&&I&
2025-03-25 12:37:04 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 2e 73 68 69 66 74 28 29 2c 74 29 7d 2c 30 29 3a 28 70 3d 6e 75 6c 6c 2c 55 28 29 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 57 28 65 29 7b 72 2e 69 73 43 6f 6d 70 6c 65 74 65 6c 79 49 64 6c 65 28 29 3f 65 28 29 3a 70 3d 48 28 66 75 6e 63 74 69 6f 6e 28 29 7b 70 3d 6e 75 6c 6c 2c 57 28 65 29 7d 2c 2e 32 35 29 7d 66 75 6e 63 74 69 6f 6e 20 71 28 29 7b 28 76 3d 7b 7d 29 2e 52 45 41 4c 5f 54 49 4d 45 3d 5b 32 2c 31 2c 30 5d 2c 76 2e 4e 45 41 52 5f 52 45 41 4c 5f 54 49 4d 45 3d 5b 36 2c 33 2c 30 5d 2c 76 2e 42 45 53 54 5f 45 46 46 4f 52 54 3d 5b 31 38 2c 39 2c 30 5d 7d 66 75 6e 63 74 69 6f 6e 20 51 28 74 2c 6e 29 7b 76 61 72 20 61 3d 5b 5d 2c 69 3d 41 3b 45 26 26 28 69 3d 4c 29 2c 45 65 28 74 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 Data Ascii: 00004000.shift(),t)},0):(p=null,U())})}function W(e){r.isCompletelyIdle()?e():p=H(function(){p=null,W(e)},.25)}function q(){(v={}).REAL_TIME=[2,1,0],v.NEAR_REAL_TIME=[6,3,0],v.BEST_EFFORT=[18,9,0]}function Q(t,n){var a=[],i=A;E&&(i=L),Ee(t,function(t){t
2025-03-25 12:37:04 UTC	12	IN	Data Raw: 74 22 5d 2c 63 6f 6e 73 65 6e 0d 0a Data Ascii: t"],consen
2025-03-25 12:37:04 UTC	16384	IN	Data Raw: 30 30 30 30 41 46 39 45 0d 0a 74 44 65 74 61 69 6c 73 3a 5b 35 2c 22 63 6f 6e 73 65 6e 74 44 65 74 61 69 6c 73 22 5d 7d 29 2c 41 69 3d 74 61 28 7b 6c 6f 63 61 6c 65 3a 5b 30 2c 49 69 5d 2c 6c 6f 63 61 6c 49 64 3a 5b 31 2c 22 6c 6f 63 61 6c 49 64 22 5d 2c 69 64 3a 5b 32 2c 22 69 64 22 5d 7d 29 2c 4c 69 3d 74 61 28 7b 6f 73 4e 61 6d 65 3a 5b 30 2c 43 69 5d 2c 76 65 72 3a 5b 31 2c 78 69 5d 7d 29 2c 6b 69 3d 74 61 28 7b 76 65 72 3a 5b 30 2c 78 69 5d 2c 73 65 71 3a 5b 31 2c 22 73 65 71 22 5d 2c 69 6e 73 74 61 6c 6c 49 64 3a 5b 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 5d 2c 65 70 6f 63 68 3a 5b 33 2c 22 65 70 6f 63 68 22 5d 7d 29 2c 4d 69 3d 74 61 28 7b 6d 73 66 70 63 3a 5b 30 2c 22 6d 73 66 70 63 22 5d 2c 61 6e 69 64 3a 5b 31 2c 22 61 6e 69 64 22 5d 2c 73 65 72 Data Ascii: 0000AF9EtDetails:[5,"consentDetails"]}),Ai=ta({locale:[0,Ii],localId:[1,"localId"],id:[2,"id"]}),Li=ta({osName:[0,Ci],ver:[1,xi]}),ki=ta({ver:[0,xi],seq:[1,"seq"],installId:[2,"installId"],epoch:[3,"epoch"]}),Mi=ta({msfpc:[0,"msfpc"],anid:[1,"anid"],ser
2025-03-25 12:37:04 UTC	16384	IN	Data Raw: 75 72 6e 20 65 2e 72 65 73 6f 6c 76 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 3f 74 3a 74 26 26 4d 72 28 74 2e 74 68 65 6e 29 3f 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 74 72 79 7b 74 2e 74 68 65 6e 28 65 2c 6e 29 7d 63 61 74 63 68 28 65 29 7b 6e 28 65 29 7d 7d 29 3a 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 28 74 29 7d 29 7d 2c 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 6e 28 74 29 7d 29 7d 2c 65 2e 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 26 26 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: urn e.resolve=function(t){return t instanceof e?t:t&&Mr(t.then)?new e(function(e,n){try{t.then(e,n)}catch(e){n(e)}}):new e(function(e){e(t)})},e.reject=function(t){return new e(function(e,n){n(t)})},e.all=function(t){if(t&&t.length)return new e(function(e
2025-03-25 12:37:04 UTC	2162	IN	Data Raw: 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 2d 5f 2e 6c 61 73 74 41 63 63 65 73 73 54 69 6d 65 3e 36 65 35 29 7b 66 6f 72 28 76 61 72 20 68 3d 31 2c 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 5f 2e 65 76 65 6e 74 73 5b 68 5d 2c 74 3d 6e 2e 64 62 2e 65 76 65 6e 74 73 5b 68 5d 3b 62 6f 28 65 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 61 29 7b 72 65 74 75 72 6e 28 71 6e 28 6e 2e 69 4b 65 79 29 7c 7c 6e 2e 69 4b 65 79 29 3d 3d 3d 73 26 26 28 74 5b 61 5d 3d 6e 2c 64 65 6c 65 74 65 20 65 5b 61 5d 29 2c 21 30 7d 29 2c 68 2b 2b 7d 3b 68 3c 3d 32 3b 29 62 28 29 3b 72 3d 21 30 2c 74 2e 70 75 73 68 28 6d 29 7d 7d 65 6c 73 65 20 74 2e 70 75 73 68 28 75 28 63 2c 6e 75 6c 6c 29 29 7d 7d 66 6f 72 28 6f 3d 30 3b 6f 3c 74 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 70 28 Data Ascii: Date).getTime()-_.lastAccessTime>6e5){for(var h=1,b=function(){var e=_.events[h],t=n.db.events[h];bo(e,function(n,a){return(qn(n.iKey)\|\|n.iKey)===s&&(t[a]=n,delete e[a]),!0}),h++};h<=2;)b();r=!0,t.push(m)}}else t.push(u(c,null))}}for(o=0;o<t.length;o++)p(
2025-03-25 12:37:04 UTC	10040	IN	Data Raw: 28 71 6e 28 69 2e 69 4b 65 79 29 7c 7c 69 2e 69 4b 65 79 29 3d 3d 3d 74 2e 74 65 6e 61 6e 74 49 64 26 26 65 2e 70 72 6f 63 65 73 73 4e 65 78 74 28 69 2c 74 2e 63 6f 72 65 52 6f 6f 74 43 74 78 2e 63 72 65 61 74 65 4e 65 77 28 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 29 7d 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 69 4b 65 79 43 6f 6e 66 69 67 3a 74 7d 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 64 28 74 2c 6e 29 7b 58 65 28 65 2e 63 6f 72 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 4c 6f 63 61 6c 53 74 6f 72 61 67 65 43 68 61 6e 6e 65 6c 3a 5f 72 65 6d 6f 76 65 45 76 65 6e 74 73 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 73 28 22 72 65 6d 6f 76 65 45 76 65 6e 74 73 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 61 3d 5b Data Ascii: (qn(i.iKey)\|\|i.iKey)===t.tenantId&&e.processNext(i,t.coreRootCtx.createNew())}catch(e){}})})},function(){return{iKeyConfig:t}})}function d(t,n){Xe(e.core,function(){return"LocalStorageChannel:_removeEvents"},function(){s("removeEvents",function(e){var a=[

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:09 UTC	635	OUT	GET /files/sp-client/odsp.knockout/odsp.knockout.lib-447adea9.js HTTP/1.1 Host: res-1.public.onecdn.static.microsoft Connection: keep-alive Origin: https://onedrive.live.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://onedrive.live.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:09 UTC	1494	IN	HTTP/1.1 200 OK Last-Modified: Fri, 11 Oct 2024 09:59:36 GMT x-ms-request-id: c156496f-601e-0004-488d-5c4f05000000 x-ms-meta-Sourcebuild: odsp-web-prod_2024-10-11.001 x-ms-meta-Sourceid: 58D3F8F0EA5F15953C6C310F722405D880C198BB4FD9447F873CEB7F5A78028400 Cache-Control: public, max-age=630720000 Date: Tue, 25 Mar 2025 12:37:09 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,quic=":443"; ma=93600; v="43" Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.57.70.71,b=93526960,c=g,n=US_NJ_SECAUCUS,o=20940] AK-Network: FF Report-To: {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=SECAUCUS&ASN=20940&Country=US&Region=NJ&RequestIdentifier=0.47463917.1742906229.5931bb0&TotalRTCDNTime=91&CompressionType=gzip&FileSize=22906"}],"include_subdomains ":true} NEL: {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Server-Timing: clientrtt; dur=91, clienttt; dur=, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child X-Content-Type-Options: nosniff Timing-Allow-Origin: * Access-Control-Expose-Headers: date,Akamai-Request-BC,X-Cdn-Provider,X-Ms-Request-Id Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Type: application/javascript X-CDN-Provider: Akamai
2025-03-25 12:37:09 UTC	14890	IN	Data Raw: 30 30 30 30 42 32 41 38 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6f 64 73 70 2e 6b 6e 6f 63 6b 6f 75 74 2e 6c 69 62 2d 34 34 37 61 64 65 61 39 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 6f 64 73 70 4e 65 78 74 57 65 62 70 61 63 6b 4a 73 6f 6e 70 3d 73 65 6c 66 2e 6f 64 73 70 4e 65 78 74 57 65 62 70 61 63 6b 4a 73 6f 6e 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6f 64 73 70 2e 6b 6e 6f 63 6b 6f 75 74 2e 6c 69 62 22 5d 2c 7b 22 6b 6e 6f 63 6b 6f 75 74 2d 70 72 6f 6a 65 63 74 69 6f 6e 73 2d 6c 69 62 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 61 2c 69 2c 72 3b 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 22 75 73 65 20 73 74 72 Data Ascii: 0000B2A8/! For license information please see odsp.knockout.lib-447adea9.js.LICENSE.txt /(self.odspNextWebpackJsonp=self.odspNextWebpackJsonp\|\|[]).push([["odsp.knockout.lib"],{"knockout-projections-lib":function(e,t,n){var a,i,r;!function(o){"use str
2025-03-25 12:37:09 UTC	16238	IN	Data Raw: 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 2c 61 3d 7b 7d 3b 72 65 74 75 72 6e 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 61 3d 65 28 74 2c 21 31 29 3b 72 65 74 75 72 6e 20 61 3d 3d 3d 6f 3f 6f 3a 61 5b 6e 5d 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 61 29 7b 61 3d 3d 3d 6f 26 26 65 28 74 2c 21 31 29 3d 3d 3d 6f 7c 7c 28 65 28 74 2c 21 30 29 5b 6e 5d 3d 61 29 7d 2c 63 6c 65 61 72 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 6e 5d 3b 72 65 74 75 72 6e 21 21 74 26 26 28 64 65 6c 65 74 65 20 61 5b 74 5d 2c 65 5b 6e 5d 3d 6e 75 6c 6c 2c 21 30 29 7d 2c 49 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2b 2b 2b 6e 7d 7d 7d 2c 53 2e 62 28 22 75 74 69 6c 73 2e 64 6f 6d 44 61 74 61 22 Data Ascii: w Date).getTime(),a={};return{get:function(t,n){var a=e(t,!1);return a===o?o:a[n]},set:function(t,n,a){a===o&&e(t,!1)===o\|\|(e(t,!0)[n]=a)},clear:function(e){var t=e[n];return!!t&&(delete a[t],e[n]=null,!0)},I:function(){return t+++n}}},S.b("utils.domData"
2025-03-25 12:37:09 UTC	14620	IN	Data Raw: 20 65 26 26 64 65 6c 65 74 65 20 65 2e 5f 5f 6b 6f 5f 5f 68 61 73 44 6f 6d 44 61 74 61 4f 70 74 69 6f 6e 56 61 6c 75 65 5f 5f 2c 65 2e 76 61 6c 75 65 3d 74 29 3a 28 53 2e 61 2e 66 2e 73 65 74 28 65 2c 53 2e 64 2e 6f 70 74 69 6f 6e 73 2e 78 62 2c 74 29 2c 65 2e 5f 5f 6b 6f 5f 5f 68 61 73 44 6f 6d 44 61 74 61 4f 70 74 69 6f 6e 56 61 6c 75 65 5f 5f 3d 21 30 2c 65 2e 76 61 6c 75 65 3d 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 74 3f 74 3a 22 22 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 73 65 6c 65 63 74 22 3a 22 22 21 3d 3d 74 26 26 6e 75 6c 6c 21 3d 3d 74 7c 7c 28 74 3d 6f 29 3b 66 6f 72 28 76 61 72 20 61 2c 69 3d 2d 31 2c 72 3d 30 2c 73 3d 65 2e 6f 70 74 69 6f 6e 73 2e 6c 65 6e 67 74 68 3b 72 3c 73 3b 2b 2b 72 29 69 66 28 28 61 3d 53 2e 6a 2e 75 28 65 Data Ascii: e&&delete e.__ko__hasDomDataOptionValue__,e.value=t):(S.a.f.set(e,S.d.options.xb,t),e.__ko__hasDomDataOptionValue__=!0,e.value="number"==typeof t?t:"");break;case"select":""!==t&&null!==t\|\|(t=o);for(var a,i=-1,r=0,s=e.options.length;r<s;++r)if((a=S.j.u(e
2025-03-25 12:37:09 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 2e 63 61 6c 6c 28 65 2c 61 2c 7b 65 6c 65 6d 65 6e 74 3a 74 2c 74 65 6d 70 6c 61 74 65 4e 6f 64 65 73 3a 6e 7d 29 3a 61 7d 28 74 2c 65 2c 64 2c 69 29 3b 74 3d 72 2e 63 72 65 61 74 65 43 68 69 6c 64 43 6f 6e 74 65 78 74 28 6e 2c 76 6f 69 64 20 30 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 24 63 6f 6d 70 6f 6e 65 6e 74 3d 6e 2c 65 2e 24 63 6f 6d 70 6f 6e 65 6e 74 54 65 6d 70 6c 61 74 65 4e 6f 64 65 73 3d 64 7d 29 2c 73 3d 6e 2c 53 2e 4b 61 28 74 2c 65 29 7d 7d 29 7d 2c 6e 75 6c 6c 2c 7b 69 3a 65 7d 29 2c 7b 63 6f 6e 74 72 6f 6c 73 44 65 73 63 65 6e 64 61 6e 74 42 69 6e 64 69 6e 67 73 3a 21 30 7d 7d 7d 2c 53 2e 65 2e 56 2e 63 6f 6d 70 6f 6e 65 6e 74 3d 21 30 7d 28 29 3b 76 61 72 20 50 3d 7b 63 6c 61 73 73 3a 22 63 6c 61 73 73 Data Ascii: 00004000.call(e,a,{element:t,templateNodes:n}):a}(t,e,d,i);t=r.createChildContext(n,void 0,function(e){e.$component=n,e.$componentTemplateNodes=d}),s=n,S.Ka(t,e)}})},null,{i:e}),{controlsDescendantBindings:!0}}},S.e.V.component=!0}();var P={class:"class
2025-03-25 12:37:09 UTC	12	IN	Data Raw: 65 6e 67 74 68 26 26 28 53 2e 0d 0a Data Ascii: ength&&(S.
2025-03-25 12:37:09 UTC	2650	IN	Data Raw: 30 30 30 30 30 41 34 45 0d 0a 61 2e 73 63 28 72 2c 6f 29 2c 61 26 26 53 2e 6c 2e 77 28 61 2c 6e 75 6c 6c 2c 5b 6e 2c 6f 2c 69 5d 29 29 2c 72 2e 6c 65 6e 67 74 68 3d 30 2c 53 2e 61 2e 72 61 28 72 2c 6f 29 7d 2c 6e 75 6c 6c 2c 7b 69 3a 65 2c 77 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 53 2e 61 2e 52 62 28 72 29 7d 7d 29 3b 72 65 74 75 72 6e 7b 63 61 3a 72 2c 42 3a 73 2e 62 61 28 29 3f 73 3a 6f 7d 7d 76 61 72 20 74 3d 53 2e 61 2e 66 2e 49 28 29 2c 6e 3d 53 2e 61 2e 66 2e 49 28 29 3b 53 2e 61 2e 42 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 69 2c 72 2c 73 2c 63 29 7b 66 75 6e 63 74 69 6f 6e 20 64 28 65 2c 74 29 7b 44 3d 70 5b 74 5d 2c 67 21 3d 3d 74 26 26 28 43 5b 65 5d 3d 44 29 2c 44 2e 71 62 28 67 2b 2b 29 2c 53 2e 61 2e 7a 61 28 44 2e 63 61 Data Ascii: 00000A4Ea.sc(r,o),a&&S.l.w(a,null,[n,o,i])),r.length=0,S.a.ra(r,o)},null,{i:e,wa:function(){return!S.a.Rb(r)}});return{ca:r,B:s.ba()?s:o}}var t=S.a.f.I(),n=S.a.f.I();S.a.Bb=function(a,i,r,s,c){function d(e,t){D=p[t],g!==t&&(C[e]=D),D.qb(g++),S.a.za(D.ca
2025-03-25 12:37:09 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:13 UTC	626	OUT	GET /files/fabric/assets/icons/fabricmdl2icons.woff HTTP/1.1 Host: spoprod-a.akamaihd.net Connection: keep-alive Origin: https://onenote.officeapps.live.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://onenote.officeapps.live.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:13 UTC	313	IN	HTTP/1.1 302 Moved Temporarily Server: AkamaiGHost Content-Length: 0 Location: https://res-1.cdn.office.net/files/fabric/assets/icons/fabricmdl2icons.woff Date: Tue, 25 Mar 2025 12:37:13 GMT Connection: close Alt-Svc: quic=":443"; ma=93600; v="43" Access-Control-Allow-Origin: * Timing-Allow-Origin: *

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:13 UTC	1009	OUT	OPTIONS /campaignmetadataaggregator?country=US&locale=en-US&app=2158&platform=Web&version=16.0.18718.41003&campaignParams=pageWidth%3D1280%26pageHeight%3D897%26screenWidth%3D1280%26screenHeight%3D1024%26colorDepth%3D24%26more%3Dtrue%26OFC_Audience%3DProduction%26Datacenter%3DPUS3%26TenantId%3D9188040d-6c67-4c5b-b112-36a304b66dad%26SelfTriggerActivity%3D%26&contentType=CampaignContent%3BDynamicSettings&puid=&OFC_FLIGHTS=&ageGroup=0&sessionUserType=2 HTTP/1.1 Host: messaging.engagement.office.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-clientsessionid,x-correlationid Origin: https://onenote.officeapps.live.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://onenote.officeapps.live.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:13 UTC	565	IN	HTTP/1.1 204 No Content Date: Tue, 25 Mar 2025 12:37:13 GMT Connection: close Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Headers: x-clientsessionid,x-correlationid Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: * X-ActivityTraceId: f59a892214585316a0b7ed096af7c300 X-ServiceCorrelationId: f59a8922-1458-5316-a0b7-ed096af7c300 X-Machine: OmexNode20000FC__omexexternal-prod-eus-2-000_552 X-BuildVersion: 25.4.10221.11438 X-ServiceFabricRequestId: d3dce119-e308-4d08-91bc-5a3bf6d7db77 Strict-Transport-Security: max-age=31536000

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:13 UTC	1145	OUT	GET /campaignmetadataaggregator?country=US&locale=en-US&app=2158&platform=Web&version=16.0.18718.41003&campaignParams=pageWidth%3D1280%26pageHeight%3D897%26screenWidth%3D1280%26screenHeight%3D1024%26colorDepth%3D24%26more%3Dtrue%26OFC_Audience%3DProduction%26Datacenter%3DPUS3%26TenantId%3D9188040d-6c67-4c5b-b112-36a304b66dad%26SelfTriggerActivity%3D%26&contentType=CampaignContent%3BDynamicSettings&puid=&OFC_FLIGHTS=&ageGroup=0&sessionUserType=2 HTTP/1.1 Host: messaging.engagement.office.com Connection: keep-alive x-clientsessionid: fd55f5ea-9dc4-43fb-4d97-a280150d6bb5 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 x-correlationid: 27515f35-6be9-4ca7-9e4d-21d8cce8e2a9 Accept: / Origin: https://onenote.officeapps.live.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://onenote.officeapps.live.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:14 UTC	524	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 12:37:14 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * X-ActivityTraceId: a7ea880d01fbdffcf734f02f2fca6f7b X-ServiceCorrelationId: a7ea880d-01fb-dffc-f734-f02f2fca6f7b X-Machine: OMEXNODE2000003__omexexternal-prod-eus-2-000_3 X-BuildVersion: 25.4.10221.11438 X-ServiceFabricRequestId: dbe63124-281d-4dfc-970a-106326255373 Strict-Transport-Security: max-age=31536000
2025-03-25 12:37:14 UTC	120	IN	Data Raw: 36 64 0d 0a 7b 22 43 61 6d 70 61 69 67 6e 43 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 73 22 3a 5b 5d 7d 2c 22 44 79 6e 61 6d 69 63 53 65 74 74 69 6e 67 73 22 3a 7b 22 54 6d 73 4c 6f 61 64 54 69 6d 65 6f 75 74 22 3a 33 30 30 30 2c 22 54 65 61 63 68 69 6e 67 4d 65 73 73 61 67 65 43 6f 6f 6c 64 6f 77 6e 22 3a 33 36 30 30 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d{"CampaignContent":{"campaigns":[]},"DynamicSettings":{"TmsLoadTimeout":3000,"TeachingMessageCooldown":3600}}0

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:14 UTC	730	OUT	GET /mydata/myprofile/expressionprofile/profilephoto:UserTileStatic,UserTileSmall/MeControlMediumUserTile?ck=1&ex=24&fofoff=1&sc=1742906233697 HTTP/1.1 Host: storage.live.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onenote.officeapps.live.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:14 UTC	867	IN	HTTP/1.1 302 Found Content-Length: 0 Location: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=174&ct=1742906234&rver=7.5.2146.0&wp=MBI_SSL&wreply=https:%2F%2Fstorage.live.com%2Fstorageservice%2Fpassport%2Fauth.aspx%3Fsru%3Dhttps:%252f%252fstorage.live.com%252fmydata%252fmyprofile%252fexpressionprofile%252fprofilephoto:UserTileStatic%252cUserTileSmall%252fMeControlMediumUserTile&lc=1033&id=63539 P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" X-MSNSERVER: BL4PPF15D9D12F0 Strict-Transport-Security: max-age=31536000; includeSubDomains MS-CV: Lzvk9WnPekyMjE8Zq/8mlQ.0 X-QosStats: {"ApiId":0,"ResultType":2,"SourcePropertyId":0,"TargetPropertyId":42} X-ThrowSite: 4212.9205 X-ClientErrorCode: PassportAuthFail X-ErrorCodeChain: Unauthenticated X-AsmVersion: UNKNOWN; 19.1628.228.2009 Date: Tue, 25 Mar 2025 12:37:13 GMT Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:14 UTC	515	OUT	GET / HTTP/1.1 Host: augloop.office.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://onenote.officeapps.live.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: nMX8DO5oSkkOlK0GqFu7UQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-03-25 12:37:15 UTC	452	IN	HTTP/1.1 200 OK Content-Length: 2 Connection: close Content-Type: text/plain; charset=utf-8 Date: Tue, 25 Mar 2025 12:37:15 GMT Server: Kestrel Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=15768000; includeSubDomains; preload X-RP-Instance: _D2Worker_80 X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-RP-RouteId: GatewayFallback X-RP-ClusterId: BackendGatewayAperture
2025-03-25 12:37:15 UTC	2	IN	Data Raw: 4f 4b Data Ascii: OK

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:15 UTC	651	OUT	GET /me?partner=OneNoteOnline&version=latest&market=EN-US&wrapperId=suiteshell HTTP/1.1 Host: amcdn.msftauth.net Connection: keep-alive Origin: https://onenote.officeapps.live.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://onenote.officeapps.live.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:15 UTC	577	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 12:37:15 GMT Content-Type: application/javascript Content-Length: 30715 Connection: close Vary: Accept-Encoding Cache-Control: public, no-transform, max-age=43200 Expires: Wed, 26 Mar 2025 00:37:15 GMT X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS X-UA-Compatible: IE=edge Strict-Transport-Security: max-age=31536000; includeSubDomains x-azure-ref: 20250325T123715Z-17cccd5449b89qrjhC1EWR22980000000dng00000000b8ed X-Cache: CONFIG_NOCACHE Accept-Ranges: bytes
2025-03-25 12:37:15 UTC	15807	IN	Data Raw: 77 69 6e 64 6f 77 2e 4d 53 41 3d 77 69 6e 64 6f 77 2e 4d 53 41 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 3d 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 4d 53 41 2e 4d 65 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 66 69 67 3d 7b 22 76 65 72 22 3a 22 31 30 2e 32 34 32 32 38 2e 34 22 2c 22 6d 6b 74 22 3a 22 65 6e 2d 55 53 22 2c 22 70 74 6e 22 3a 22 6f 6e 65 6e 6f 74 65 6f 6e 6c 69 6e 65 22 2c 22 67 66 78 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6d 63 64 6e 2e 6d 73 66 74 61 75 74 68 2e 6e 65 74 22 2c 22 64 62 67 22 3a 66 61 6c 73 65 2c 22 61 61 64 22 3a 74 72 75 65 2c 22 69 6e 74 22 3a 66 61 6c 73 65 2c 22 70 78 79 22 3a 74 72 75 65 2c 22 6d 73 54 78 74 22 3a 66 61 6c 73 65 2c 22 72 77 64 Data Ascii: window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.24228.4","mkt":"en-US","ptn":"onenoteonline","gfx":"https://amcdn.msftauth.net","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd
2025-03-25 12:37:15 UTC	14908	IN	Data Raw: 76 65 28 29 2e 74 68 65 6e 28 65 29 7d 29 2c 54 65 2e 5f 75 6e 68 61 6e 64 6c 65 64 52 65 6a 65 63 74 69 6f 6e 46 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 56 65 28 7b 65 76 65 6e 74 54 79 70 65 3a 22 43 6c 69 65 6e 74 45 72 72 6f 72 22 2c 69 73 43 72 69 74 69 63 61 6c 3a 21 30 2c 6e 61 6d 65 3a 65 2e 6d 65 73 73 61 67 65 7c 7c 22 28 66 61 6c 73 65 79 20 6d 65 73 73 61 67 65 20 70 72 6f 70 65 72 74 79 20 6f 6e 20 65 72 72 6f 72 29 22 2c 74 79 70 65 3a 22 55 6e 68 61 6e 64 6c 65 64 50 72 6f 6d 69 73 65 52 65 6a 65 63 74 69 6f 6e 22 2c 64 65 74 61 69 6c 73 3a 65 2e 73 74 61 63 6b 7c 7c 22 22 2c 64 69 73 70 6c 61 79 65 64 3a 21 31 2c 73 65 76 65 72 69 74 79 3a 65 2e 6d 63 49 73 54 69 6d 65 6f 75 74 3f 33 3a 32 7d 29 7d 3b 76 61 72 20 47 65 3d 5b 5d 3b 76 61 Data Ascii: ve().then(e)}),Te._unhandledRejectionFn=function(e){Ve({eventType:"ClientError",isCritical:!0,name:e.message\|\|"(falsey message property on error)",type:"UnhandledPromiseRejection",details:e.stack\|\|"",displayed:!1,severity:e.mcIsTimeout?3:2})};var Ge=[];va

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:15 UTC	761	OUT	GET /officeaddins/learningtools/?et= HTTP/1.1 Host: www.onenote.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Sec-Fetch-Storage-Access: active Referer: https://onenote.officeapps.live.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:15 UTC	1442	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 12:37:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2801 Connection: close Cache-Control: private X-RoutingOfficeCluster: eus-azsc-001.reverseproxy.onenote.com X-RoutingOfficeFE: ReverseProxyFrontEnd_IN_10 X-RoutingOfficeVersion: 16.0.18720.40452 X-RoutingSessionId: 4851f067-450a-4da0-8577-ffb15acc90cc X-RoutingCorrelationId: a4bfa14b-3c4f-4bbb-b723-d06ebeb76ac9 P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" P3P: CP="P3P is not supported anymore; see: https://msdn.microsoft.com/en-us/library/mt146424%28v=vs.85%29.aspx" x-correlationid: a4bfa14b-3c4f-4bbb-b723-d06ebeb76ac9 x-usersessionid: 4851f067-450a-4da0-8577-ffb15acc90cc x-officefe: AgavesFrontEnd_IN_6 x-officeversion: 16.0.18724.40461 x-officecluster: eus-000.appsforoffice.onenote.com x-partitioning-enabled: true strict-transport-security: max-age=31536000; includeSubDomains; preload content-security-policy-report-only: script-src 'nonce-GccMqrzVqseZ00oIgDfS03C/v3u4bU4S' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https:; base-uri 'self' ; object-src 'none'; require-trusted-types-for 'script'; report-uri https://csp.microsoft.com/report/OneService-Agaves-prod x-content-type-options: nosniff x-azure-ref: 20250325T123715Z-17cccd5449bpx5xthC1EWRqmf40000000dsg000000002sd9 X-Cache: CONFIG_NOCACHE Accept-Ranges: bytes
2025-03-25 12:37:15 UTC	2801	IN	Data Raw: 0d 0a 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0d 0a 09 0d 0a 09 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 47 63 63 4d 71 72 7a 56 71 73 65 5a 30 30 6f 49 67 44 66 53 30 33 43 2f 76 33 75 34 62 55 34 53 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6f 6e 65 6e 6f 74 65 2e 6e 65 74 2f 6f 66 66 69 63 65 61 64 64 69 6e 73 2f 31 36 31 38 37 32 34 34 30 34 36 31 5f 53 63 72 69 70 74 73 2f 43 6f 6d 6d 6f 6e 44 69 61 67 6e 6f 73 74 69 63 73 2e 6a 73 22 Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="utf-8"><title></title><script nonce="GccMqrzVqseZ00oIgDfS03C/v3u4bU4S" type="text/javascript" src="https://cdn.onenote.net/officeaddins/161872440461_Scripts/CommonDiagnostics.js"

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:15 UTC	662	OUT	GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.0.5/en-us_web/manifest_web.xml HTTP/1.1 Host: fa000000111.resources.office.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Origin: https://onenote.officeapps.live.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://onenote.officeapps.live.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:15 UTC	462	IN	HTTP/1.1 200 OK Last-Modified: Mon, 04 Mar 2024 06:23:27 GMT ETag: "0xA469F9CB0BD572336E79DA17C4D92777808887EC57EBF3B424F2A62F178652C6" Server: ECAcc (chd/072F) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Type: text/xml Cache-Control: public, max-age=28776 Date: Tue, 25 Mar 2025 12:37:15 GMT Content-Length: 985 Connection: close X-CID: 2 Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: *
2025-03-25 12:37:15 UTC	985	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 4f 66 66 69 63 65 41 70 70 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 6f 66 66 69 63 65 2f 61 70 70 66 6f 72 6f 66 66 69 63 65 2f 31 2e 31 22 0d 0a 20 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 0d 0a 20 20 78 6d 6c 6e 73 3a 62 74 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 6f 66 66 69 63 65 2f 6f 66 66 69 63 65 61 70 70 62 61 73 69 63 74 79 70 65 73 2f 31 2e 30 22 0d 0a 20 20 78 6d 6c 6e 73 3a 63 6f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><OfficeApp xmlns="http://schemas.microsoft.com/office/appforoffice/1.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:bt="http://schemas.microsoft.com/office/officeappbasictypes/1.0" xmlns:con

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:15 UTC	629	OUT	GET /scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive Origin: https://onenote.officeapps.live.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://onenote.officeapps.live.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:16 UTC	892	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 12:37:16 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 91802 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Wed, 05 Feb 2025 20:35:46 GMT ETag: 0x8DD4624AB24003C x-ms-request-id: a02c2631-101e-007d-68bb-9751b9000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 3.2.18 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.shared.analytics.mectrl-3.2.18.gbl.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20250325T123716Z-17cccd5449bkk7bshC1EWR4rww0000000dn000000000c2bb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2025-03-25 12:37:16 UTC	15492	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 20 53 44 4b 20 53 68 61 72 65 64 20 41 6e 61 6c 79 74 69 63 73 2c 20 33 2e 32 2e 31 38 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 74 2c 72 3d 7b 7d 2c 69 3d 22 5f 5f 6d 73 24 6d 6f 64 5f 5f 22 2c 6f 3d 7b 7d 2c 61 3d 6f 2e 65 73 6d 5f 6d 73 5f 73 68 61 72 65 64 5f 61 6e 61 6c 79 74 69 63 73 5f 6d 65 63 74 72 6c 5f 33 5f 32 5f 31 38 3d 7b 7d 2c 75 3d 22 33 2e 32 2e 31 38 22 2c 63 3d 22 6f 6e 65 44 73 4d 65 43 Data Ascii: /! 1DS JS SDK Shared Analytics, 3.2.18 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,n){var t,r={},i="__ms$mod__",o={},a=o.esm_ms_shared_analytics_mectrl_3_2_18={},u="3.2.18",c="oneDsMeC
2025-03-25 12:37:16 UTC	16384	IN	Data Raw: 6f 7d 76 61 72 20 48 72 3d 22 74 6f 47 4d 54 53 74 72 69 6e 67 22 2c 6a 72 3d 22 74 6f 55 54 43 53 74 72 69 6e 67 22 2c 57 72 3d 22 63 6f 6f 6b 69 65 22 2c 58 72 3d 22 65 78 70 69 72 65 73 22 2c 47 72 3d 22 65 6e 61 62 6c 65 64 22 2c 51 72 3d 22 69 73 43 6f 6f 6b 69 65 55 73 65 44 69 73 61 62 6c 65 64 22 2c 4a 72 3d 22 64 69 73 61 62 6c 65 43 6f 6f 6b 69 65 73 55 73 61 67 65 22 2c 24 72 3d 22 5f 63 6b 4d 67 72 22 2c 5a 72 3d 6e 75 6c 6c 2c 59 72 3d 6e 75 6c 6c 2c 65 69 3d 6e 75 6c 6c 2c 6e 69 3d 24 74 28 29 2c 74 69 3d 7b 7d 2c 72 69 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 69 69 28 65 29 7b 72 65 74 75 72 6e 21 65 7c 7c 65 2e 69 73 45 6e 61 62 6c 65 64 28 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 69 28 65 2c 6e 29 7b 72 65 74 75 72 6e 20 6e 26 26 65 26 26 72 65 Data Ascii: o}var Hr="toGMTString",jr="toUTCString",Wr="cookie",Xr="expires",Gr="enabled",Qr="isCookieUseDisabled",Jr="disableCookiesUsage",$r="_ckMgr",Zr=null,Yr=null,ei=null,ni=$t(),ti={},ri={};function ii(e){return!e\|\|e.isEnabled()}function oi(e,n){return n&&e&&re
2025-03-25 12:37:16 UTC	16384	IN	Data Raw: 20 72 5b 6e 65 5d 7d 2c 70 2e 72 65 6c 65 61 73 65 51 75 65 75 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3b 67 26 26 30 3c 72 5b 6e 65 5d 26 26 28 65 3d 72 2c 72 3d 5b 5d 2c 69 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 79 28 29 5b 46 5d 28 65 29 7d 29 29 7d 2c 70 2e 70 6f 6c 6c 49 6e 74 65 72 6e 61 6c 4c 6f 67 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 50 3d 65 7c 7c 6e 75 6c 6c 2c 4e 3d 21 31 2c 41 26 26 28 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 41 29 2c 41 3d 6e 75 6c 6c 29 2c 68 28 21 30 29 7d 2c 70 5b 4b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 4e 3d 21 30 2c 41 26 26 28 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 41 29 2c 41 3d 30 2c 66 28 29 29 7d 2c 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 Data Ascii: r[ne]},p.releaseQueue=function(){var e;g&&0<r[ne]&&(e=r,r=[],ie(e,function(e){y()[F](e)}))},p.pollInternalLogs=function(e){return P=e\|\|null,N=!1,A&&(clearInterval(A),A=null),h(!0)},p[Ke]=function(){N=!0,A&&(clearInterval(A),A=0,f())},t=function(){return
2025-03-25 12:37:16 UTC	16384	IN	Data Raw: 72 3a 63 2e 41 4e 44 52 4f 49 44 2c 6f 73 3a 22 41 6e 64 72 6f 69 64 22 7d 2c 7b 72 3a 63 2e 4c 49 4e 55 58 2c 6f 73 3a 22 4c 69 6e 75 78 22 7d 2c 7b 72 3a 63 2e 43 52 4f 53 2c 6f 73 3a 22 43 68 72 6f 6d 65 20 4f 53 22 7d 2c 7b 73 3a 22 78 31 31 22 2c 6f 73 3a 22 55 6e 69 78 22 7d 2c 7b 73 3a 22 62 6c 61 63 6b 62 65 72 72 79 22 2c 6f 73 3a 22 42 6c 61 63 6b 42 65 72 72 79 22 7d 2c 7b 73 3a 22 73 79 6d 62 69 61 6e 22 2c 6f 73 3a 22 53 79 6d 62 69 61 6e 22 7d 2c 7b 73 3a 22 6e 6f 6b 69 61 22 2c 6f 73 3a 22 4e 6f 6b 69 61 22 7d 2c 7b 72 3a 63 2e 4f 53 58 2c 6f 73 3a 22 4d 61 63 20 4f 53 20 58 22 7d 5d 3b 66 75 6e 63 74 69 6f 6e 20 7a 61 28 65 2c 6e 29 7b 6e 3d 65 2e 6d 61 74 63 68 28 52 65 67 45 78 70 28 6e 2b 22 20 22 2b 4c 61 29 29 3b 72 65 74 75 72 6e 20 Data Ascii: r:c.ANDROID,os:"Android"},{r:c.LINUX,os:"Linux"},{r:c.CROS,os:"Chrome OS"},{s:"x11",os:"Unix"},{s:"blackberry",os:"BlackBerry"},{s:"symbian",os:"Symbian"},{s:"nokia",os:"Nokia"},{r:c.OSX,os:"Mac OS X"}];function za(e,n){n=e.match(RegExp(n+" "+La));return
2025-03-25 12:37:16 UTC	16384	IN	Data Raw: 61 72 20 6f 3d 6f 26 26 6f 2e 73 6c 69 63 65 28 29 2c 73 3d 30 3b 73 3c 63 2d 31 3b 73 2b 2b 29 7b 76 61 72 20 6c 3d 75 5b 73 5d 2c 61 3d 61 5b 6c 5d 3d 61 5b 6c 5d 7c 7c 7b 7d 3b 72 2b 3d 22 2e 22 2b 6c 2c 6f 26 26 6f 2e 70 75 73 68 28 6c 29 7d 69 3d 75 5b 63 2d 31 5d 7d 7d 28 65 3d 76 26 26 28 28 74 3d 53 5b 65 3d 72 5d 29 3d 3d 3d 75 6e 64 65 66 69 6e 65 64 26 26 28 37 3c 3d 65 2e 6c 65 6e 67 74 68 26 26 28 74 3d 61 74 28 65 2c 22 65 78 74 2e 6d 65 74 61 64 61 74 61 22 29 7c 7c 61 74 28 65 2c 22 65 78 74 2e 77 65 62 22 29 29 2c 53 5b 65 5d 3d 74 29 2c 74 29 7c 7c 21 62 7c 7c 21 62 2e 68 61 6e 64 6c 65 46 69 65 6c 64 28 72 2c 69 29 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 21 65 26 26 21 58 6f 28 65 29 7c 7c 22 73 74 72 69 6e 67 22 21 3d 74 Data Ascii: ar o=o&&o.slice(),s=0;s<c-1;s++){var l=u[s],a=a[l]=a[l]\|\|{};r+="."+l,o&&o.push(l)}i=u[c-1]}}(e=v&&((t=S[e=r])===undefined&&(7<=e.length&&(t=at(e,"ext.metadata")\|\|at(e,"ext.web")),S[e]=t),t)\|\|!b\|\|!b.handleField(r,i)?function(e,n){if(!e&&!Xo(e)\|\|"string"!=t
2025-03-25 12:37:16 UTC	10774	IN	Data Raw: 51 3f 4d 61 74 68 2e 6d 69 6e 28 51 2c 72 29 3a 72 2c 6b 3d 4d 61 74 68 2e 6d 61 78 28 6b 2c 6e 29 29 2c 69 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 71 3d 7b 52 45 41 4c 5f 54 49 4d 45 3a 5b 32 2c 31 2c 30 5d 2c 4e 45 41 52 5f 52 45 41 4c 5f 54 49 4d 45 3a 5b 36 2c 33 2c 30 5d 2c 42 45 53 54 5f 45 46 46 4f 52 54 3a 5b 31 38 2c 39 2c 30 5d 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 6e 29 7b 76 61 72 20 74 3d 5b 5d 2c 72 3d 24 3f 59 3a 5a 3b 69 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 30 3c 65 2e 63 6f 75 6e 74 28 29 26 26 69 65 28 65 2e 65 76 65 6e 74 73 28 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 28 65 2e 73 79 6e 63 26 26 28 65 2e 6c 61 74 65 6e 63 79 3d 34 2c 65 2e 73 79 6e 63 3d 21 31 29 2c 65 2e 73 65 6e 64 41 74 74 65 6d Data Ascii: Q?Math.min(Q,r):r,k=Math.max(k,n)),i}function n(){q={REAL_TIME:[2,1,0],NEAR_REAL_TIME:[6,3,0],BEST_EFFORT:[18,9,0]}}function e(e,n){var t=[],r=$?Y:Z;ie(e,function(e){e&&0<e.count()&&ie(e.events(),function(e){e&&(e.sync&&(e.latency=4,e.sync=!1),e.sendAttem

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 188

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Chrome Cache Entry: 195

Chrome Cache Entry: 196

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Chrome Cache Entry: 199

Chrome Cache Entry: 200

Chrome Cache Entry: 201

Windows Analysis Report
https://1drv.ms/o/c/8fc032da5fada757/EgEHU26Ga4FAl_1Su2lfpkUBqQItqpp0mP4_5cipPDmMcg?e=PyJVMi

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:16 UTC	589	OUT	GET /ajax/jQuery/jquery-3.5.0.min.js HTTP/1.1 Host: ajax.aspnetcdn.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://www.onenote.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:16 UTC	450	IN	HTTP/1.1 200 OK Content-Type: application/javascript Access-Control-Allow-Origin: * ETag: "06faa87112d61:0" Last-Modified: Tue, 14 Apr 2020 15:26:14 GMT Timing-Allow-Origin: * X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: public, max-age=31131062 Date: Tue, 25 Mar 2025 12:37:16 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-GRN: 0.deeb3717.1742906236.235c754
2025-03-25 12:37:16 UTC	15934	IN	Data Raw: 30 30 30 30 42 35 39 36 0d 0a 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 35 2e 30 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f Data Ascii: 0000B596/! jQuery v3.5.0 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Erro
2025-03-25 12:37:16 UTC	15903	IN	Data Raw: 6f 64 65 2c 66 3d 78 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 70 3d 21 6e 26 26 21 78 2c 64 3d 21 31 3b 69 66 28 63 29 7b 69 66 28 79 29 7b 77 68 69 6c 65 28 6c 29 7b 61 3d 65 3b 77 68 69 6c 65 28 61 3d 61 5b 6c 5d 29 69 66 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 21 31 3b 75 3d 6c 3d 22 6f 6e 6c 79 22 3d 3d 3d 68 26 26 21 75 26 26 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 7d 72 65 74 75 72 6e 21 30 7d 69 66 28 75 3d 5b 6d 3f 63 2e 66 69 72 73 74 43 68 69 6c 64 3a 63 2e 6c 61 73 74 43 68 69 6c 64 5d 2c 6d 26 26 70 29 7b 64 3d 28 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 63 29 5b 53 5d 7c 7c 28 61 5b 53 Data Ascii: ode,f=x&&e.nodeName.toLowerCase(),p=!n&&!x,d=!1;if(c){if(y){while(l){a=e;while(a=a[l])if(x?a.nodeName.toLowerCase()===f:1===a.nodeType)return!1;u=l="only"===h&&!u&&"nextSibling"}return!0}if(u=[m?c.firstChild:c.lastChild],m&&p){d=(s=(r=(i=(o=(a=c)[S]\|\|(a[S
2025-03-25 12:37:16 UTC	14661	IN	Data Raw: 65 6e 74 4c 6f 61 64 65 64 22 2c 42 29 2c 43 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 42 29 2c 53 2e 72 65 61 64 79 28 29 7d 53 2e 66 6e 2e 72 65 61 64 79 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 46 2e 74 68 65 6e 28 65 29 5b 22 63 61 74 63 68 22 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 53 2e 72 65 61 64 79 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 29 2c 74 68 69 73 7d 2c 53 2e 65 78 74 65 6e 64 28 7b 69 73 52 65 61 64 79 3a 21 31 2c 72 65 61 64 79 57 61 69 74 3a 31 2c 72 65 61 64 79 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 28 21 30 3d 3d 3d 65 3f 2d 2d 53 2e 72 65 61 64 79 57 61 69 74 3a 53 2e 69 73 52 65 61 64 79 29 7c 7c 28 53 2e 69 73 52 65 61 64 79 3d 21 30 29 21 3d 3d 65 26 26 30 3c 2d 2d 53 Data Ascii: entLoaded",B),C.removeEventListener("load",B),S.ready()}S.fn.ready=function(e){return F.then(e)["catch"](function(e){S.readyException(e)}),this},S.extend({isReady:!1,readyWait:1,ready:function(e){(!0===e?--S.readyWait:S.isReady)\|\|(S.isReady=!0)!==e&&0<--S
2025-03-25 12:37:16 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6d 6f 75 73 65 6f 76 65 72 22 2c 6d 6f 75 73 65 6c 65 61 76 65 3a 22 6d 6f 75 73 65 6f 75 74 22 2c 70 6f 69 6e 74 65 72 65 6e 74 65 72 3a 22 70 6f 69 6e 74 65 72 6f 76 65 72 22 2c 70 6f 69 6e 74 65 72 6c 65 61 76 65 3a 22 70 6f 69 6e 74 65 72 6f 75 74 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 69 29 7b 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 5b 65 5d 3d 7b 64 65 6c 65 67 61 74 65 54 79 70 65 3a 69 2c 62 69 6e 64 54 79 70 65 3a 69 2c 68 61 6e 64 6c 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3d 65 2e 72 65 6c 61 74 65 64 54 61 72 67 65 74 2c 72 3d 65 2e 68 61 6e 64 6c 65 4f 62 6a 3b 72 65 74 75 72 6e 20 6e 26 26 28 6e 3d 3d 3d 74 68 69 73 7c 7c 53 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2c 6e 29 29 7c Data Ascii: 00004000mouseover",mouseleave:"mouseout",pointerenter:"pointerover",pointerleave:"pointerout"},function(e,i){S.event.special[e]={delegateType:i,bindType:i,handle:function(e){var t,n=e.relatedTarget,r=e.handleObj;return n&&(n===this\|\|S.contains(this,n))\|
2025-03-25 12:37:16 UTC	12	IN	Data Raw: 65 65 64 73 5b 72 2e 64 75 72 0d 0a Data Ascii: eeds[r.dur
2025-03-25 12:37:16 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 61 74 69 6f 6e 5d 3a 72 2e 64 75 72 61 74 69 6f 6e 3d 53 2e 66 78 2e 73 70 65 65 64 73 2e 5f 64 65 66 61 75 6c 74 29 2c 6e 75 6c 6c 21 3d 72 2e 71 75 65 75 65 26 26 21 30 21 3d 3d 72 2e 71 75 65 75 65 7c 7c 28 72 2e 71 75 65 75 65 3d 22 66 78 22 29 2c 72 2e 6f 6c 64 3d 72 2e 63 6f 6d 70 6c 65 74 65 2c 72 2e 63 6f 6d 70 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6d 28 72 2e 6f 6c 64 29 26 26 72 2e 6f 6c 64 2e 63 61 6c 6c 28 74 68 69 73 29 2c 72 2e 71 75 65 75 65 26 26 53 2e 64 65 71 75 65 75 65 28 74 68 69 73 2c 72 2e 71 75 65 75 65 29 7d 2c 72 7d 2c 53 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 66 61 64 65 54 6f 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 66 69 6c 74 65 72 28 61 Data Ascii: 00004000ation]:r.duration=S.fx.speeds._default),null!=r.queue&&!0!==r.queue\|\|(r.queue="fx"),r.old=r.complete,r.complete=function(){m(r.old)&&r.old.call(this),r.queue&&S.dequeue(this,r.queue)},r},S.fn.extend({fadeTo:function(e,t,n,r){return this.filter(a
2025-03-25 12:37:16 UTC	12	IN	Data Raw: 73 65 20 69 66 28 22 2a 22 21 0d 0a Data Ascii: se if("*"!
2025-03-25 12:37:16 UTC	10251	IN	Data Raw: 30 30 30 30 32 37 46 46 0d 0a 3d 3d 75 26 26 75 21 3d 3d 6f 29 7b 69 66 28 21 28 61 3d 6c 5b 75 2b 22 20 22 2b 6f 5d 7c 7c 6c 5b 22 2a 20 22 2b 6f 5d 29 29 66 6f 72 28 69 20 69 6e 20 6c 29 69 66 28 28 73 3d 69 2e 73 70 6c 69 74 28 22 20 22 29 29 5b 31 5d 3d 3d 3d 6f 26 26 28 61 3d 6c 5b 75 2b 22 20 22 2b 73 5b 30 5d 5d 7c 7c 6c 5b 22 2a 20 22 2b 73 5b 30 5d 5d 29 29 7b 21 30 3d 3d 3d 61 3f 61 3d 6c 5b 69 5d 3a 21 30 21 3d 3d 6c 5b 69 5d 26 26 28 6f 3d 73 5b 30 5d 2c 63 2e 75 6e 73 68 69 66 74 28 73 5b 31 5d 29 29 3b 62 72 65 61 6b 7d 69 66 28 21 30 21 3d 3d 61 29 69 66 28 61 26 26 65 5b 22 74 68 72 6f 77 73 22 5d 29 74 3d 61 28 74 29 3b 65 6c 73 65 20 74 72 79 7b 74 3d 61 28 74 29 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 7b 73 74 61 74 65 3a 22 70 Data Ascii: 000027FF==u&&u!==o){if(!(a=l[u+" "+o]\|\|l["* "+o]))for(i in l)if((s=i.split(" "))[1]===o&&(a=l[u+" "+s[0]]\|\|l["* "+s[0]])){!0===a?a=l[i]:!0!==l[i]&&(o=s[0],c.unshift(s[1]));break}if(!0!==a)if(a&&e["throws"])t=a(t);else try{t=a(t)}catch(e){return{state:"p
2025-03-25 12:37:16 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:17 UTC	838	OUT	GET /campaignmetadataaggregator?country=US&locale=en-US&app=2158&platform=Web&version=16.0.18718.41003&campaignParams=pageWidth%3D1280%26pageHeight%3D897%26screenWidth%3D1280%26screenHeight%3D1024%26colorDepth%3D24%26more%3Dtrue%26OFC_Audience%3DProduction%26Datacenter%3DPUS3%26TenantId%3D9188040d-6c67-4c5b-b112-36a304b66dad%26SelfTriggerActivity%3D%26&contentType=CampaignContent%3BDynamicSettings&puid=&OFC_FLIGHTS=&ageGroup=0&sessionUserType=2 HTTP/1.1 Host: messaging.engagement.office.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:17 UTC	493	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 12:37:17 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: Microsoft-HTTPAPI/2.0 X-ActivityTraceId: 29fa42bf34e4cbc0d59b7852a749b4a6 X-ServiceCorrelationId: 29fa42bf-34e4-cbc0-d59b-7852a749b4a6 X-Machine: OMEXNODE2000005__omexexternal-prod-ncus-2-000_5 X-BuildVersion: 25.4.10221.11438 X-ServiceFabricRequestId: 2e6d73e3-6fcb-44fb-909a-745fbb026ef0 Strict-Transport-Security: max-age=31536000
2025-03-25 12:37:17 UTC	120	IN	Data Raw: 36 64 0d 0a 7b 22 43 61 6d 70 61 69 67 6e 43 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 73 22 3a 5b 5d 7d 2c 22 44 79 6e 61 6d 69 63 53 65 74 74 69 6e 67 73 22 3a 7b 22 54 6d 73 4c 6f 61 64 54 69 6d 65 6f 75 74 22 3a 33 30 30 30 2c 22 54 65 61 63 68 69 6e 67 4d 65 73 73 61 67 65 43 6f 6f 6c 64 6f 77 6e 22 3a 33 36 30 30 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d{"CampaignContent":{"campaigns":[]},"DynamicSettings":{"TmsLoadTimeout":3000,"TeachingMessageCooldown":3600}}0

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:18 UTC	474	OUT	GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2409.12011/en-us_web/manifest_web.xml HTTP/1.1 Host: fa000000138.resources.office.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:18 UTC	464	IN	HTTP/1.1 200 OK Last-Modified: Thu, 19 Sep 2024 20:08:56 GMT ETag: "0xC00E4175135270F0809B50C783FB3CC66F968310E4C9F99D1B90D572E583D9D6" Server: ECAcc (chd/071A) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Type: text/xml Cache-Control: public, max-age=166110 Date: Tue, 25 Mar 2025 12:37:18 GMT Content-Length: 9258 Connection: close X-CID: 2 Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: *
2025-03-25 12:37:18 UTC	9258	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 20 73 74 61 6e 64 61 6c 6f 6e 65 3d 22 79 65 73 22 3f 3e 0d 0a 3c 4f 66 66 69 63 65 41 70 70 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 6f 66 66 69 63 65 2f 61 70 70 66 6f 72 6f 66 66 69 63 65 2f 31 2e 31 22 0d 0a 20 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 0d 0a 20 20 78 6d 6c 6e 73 3a 62 74 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 6f 66 66 69 63 65 2f 6f 66 66 69 63 65 61 70 70 62 61 73 69 63 74 79 70 65 73 2f Data Ascii: <?xml version="1.0" encoding="UTF-8" standalone="yes"?><OfficeApp xmlns="http://schemas.microsoft.com/office/appforoffice/1.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:bt="http://schemas.microsoft.com/office/officeappbasictypes/

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:37:18 UTC	474	OUT	GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2404.23003/en-us_web/manifest_web.xml HTTP/1.1 Host: fa000000096.resources.office.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:37:19 UTC	464	IN	HTTP/1.1 200 OK Last-Modified: Wed, 24 Apr 2024 07:45:09 GMT ETag: "0xA75EDBF8D6FD6E64EC15A55BED859C6D856ED5E78B4556F6A89F2A5D9E7FAAD4" Server: ECAcc (chd/0770) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Type: text/xml Cache-Control: public, max-age=178987 Date: Tue, 25 Mar 2025 12:37:18 GMT Content-Length: 1626 Connection: close X-CID: 2 Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Origin: *
2025-03-25 12:37:19 UTC	1626	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 4f 66 66 69 63 65 41 70 70 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 6f 66 66 69 63 65 2f 61 70 70 66 6f 72 6f 66 66 69 63 65 2f 31 2e 31 22 0d 0a 20 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 0d 0a 20 20 78 6d 6c 6e 73 3a 62 74 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 6f 66 66 69 63 65 2f 6f 66 66 69 63 65 61 70 70 62 61 73 69 63 74 79 70 65 73 2f 31 2e 30 22 0d 0a 20 20 78 6d 6c 6e 73 3a 63 6f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><OfficeApp xmlns="http://schemas.microsoft.com/office/appforoffice/1.1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:bt="http://schemas.microsoft.com/office/officeappbasictypes/1.0" xmlns:con

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:38:04 UTC	496	OUT	OPTIONS /api/report?FrontEnd=AFD&DestinationEndpoint=Edge-Prod-EWR31r5b&DC=&FileSource= HTTP/1.1 Host: onenoteonline.nel.measure.office.net Connection: keep-alive Origin: https://onenote.officeapps.live.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:38:04 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Tue, 25 Mar 2025 12:38:04 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-03-25 12:38:04 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:38:04 UTC	480	OUT	POST /api/report?FrontEnd=AFD&DestinationEndpoint=Edge-Prod-EWR31r5b&DC=PUS3&FileSource= HTTP/1.1 Host: onenoteonline.nel.measure.office.net Connection: keep-alive Content-Length: 2497 Content-Type: application/reports+json Origin: https://usc-onenote.officeapps.live.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:38:04 UTC	2497	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 34 30 31 34 33 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 34 30 31 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 35 32 2e 31 30 38 2e 38 2e 31 32 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 35 30 30 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 75 73 63 2d 6f 6e 65 6e 6f 74 65 2e 6f 66 Data Ascii: [{"age":40143,"body":{"elapsed_time":401,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"52.108.8.12","status_code":500,"type":"http.error"},"type":"network-error","url":"https://usc-onenote.of
2025-03-25 12:38:05 UTC	399	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 Request-Context: appId=cid-v1:41ca65cb-08a6-4a29-94ab-18b081ee8b8b Date: Tue, 25 Mar 2025 12:38:05 GMT Connection: close Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:38:19 UTC	752	OUT	POST /officeaddins/RemoteUls.ashx HTTP/1.1 Host: www.onenote.com Connection: keep-alive Content-Length: 221 X-UserSessionId: 4851f067-450a-4da0-8577-ffb15acc90cc sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/json sec-ch-ua-mobile: ?0 Accept: / Origin: https://www.onenote.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Referer: https://www.onenote.com/officeaddins/learningtools/?et= Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:38:19 UTC	221	OUT	Data Raw: 7b 22 54 22 3a 31 37 34 32 39 30 36 32 33 38 32 36 35 2c 22 4c 22 3a 5b 7b 22 47 22 3a 36 31 36 30 38 36 31 2c 22 54 22 3a 30 2c 22 4d 22 3a 22 4f 6e 50 61 67 65 53 68 6f 77 22 2c 22 43 22 3a 32 30 30 33 2c 22 44 22 3a 35 30 7d 2c 7b 22 47 22 3a 32 30 37 31 37 37 38 32 2c 22 54 22 3a 35 33 2c 22 4d 22 3a 22 55 49 2d 6c 65 73 73 20 70 61 72 74 20 6f 66 20 4c 65 61 72 6e 69 6e 67 20 54 6f 6f 6c 73 20 41 67 61 76 65 20 6c 6f 61 64 65 64 22 2c 22 43 22 3a 32 30 30 33 2c 22 44 22 3a 35 30 7d 5d 2c 22 53 22 3a 22 34 38 35 31 66 30 36 37 2d 34 35 30 61 2d 34 64 61 30 2d 38 35 37 37 2d 66 66 62 31 35 61 63 63 39 30 63 63 22 2c 22 49 22 3a 30 2c 22 56 22 3a 31 7d Data Ascii: {"T":1742906238265,"L":[{"G":6160861,"T":0,"M":"OnPageShow","C":2003,"D":50},{"G":20717782,"T":53,"M":"UI-less part of Learning Tools Agave loaded","C":2003,"D":50}],"S":"4851f067-450a-4da0-8577-ffb15acc90cc","I":0,"V":1}
2025-03-25 12:38:19 UTC	1173	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 12:38:19 GMT Content-Type: text/plain Content-Length: 0 Connection: close Cache-Control: private X-RoutingOfficeCluster: eus-azsc-001.reverseproxy.onenote.com X-RoutingOfficeFE: ReverseProxyFrontEnd_IN_11 X-RoutingOfficeVersion: 16.0.18720.40452 X-RoutingSessionId: 4851f067-450a-4da0-8577-ffb15acc90cc X-RoutingCorrelationId: c0ee055a-74ec-4faf-a800-79f1f65da27c P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" x-correlationid: c0ee055a-74ec-4faf-a800-79f1f65da27c x-usersessionid: 4851f067-450a-4da0-8577-ffb15acc90cc x-officefe: AgavesFrontEnd_IN_3 x-officeversion: 16.0.18724.40461 x-officecluster: eus-000.appsforoffice.onenote.com x-partitioning-enabled: true strict-transport-security: max-age=31536000; includeSubDomains; preload x-buls-suppressionetag: N/A x-buls-suppressedtags: x-content-type-options: nosniff x-download-options: noopen content-disposition: attachment x-content-type-options: nosniff x-azure-ref: 20250325T123819Z-17cccd5449bgvc9thC1EWR7dt00000000dq000000000a29f X-Cache: CONFIG_NOCACHE Accept-Ranges: bytes

Timestamp	Bytes transferred	Direction	Data
2025-03-25 12:38:20 UTC	406	OUT	GET /officeaddins/RemoteUls.ashx HTTP/1.1 Host: www.onenote.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 12:38:20 UTC	1171	IN	HTTP/1.1 500 Date: Tue, 25 Mar 2025 12:38:20 GMT Content-Type: text/html Content-Length: 1208 Connection: close Cache-Control: private X-RoutingOfficeCluster: eus-azsc-000.reverseproxy.onenote.com X-RoutingOfficeFE: ReverseProxyFrontEnd_IN_4 X-RoutingOfficeVersion: 16.0.18720.40452 X-RoutingSessionId: 07cf5a89-bf43-4da5-af18-80328fa18402 X-RoutingCorrelationId: 6881b82e-73ee-443c-a081-7becd754219f P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" x-correlationid: 6881b82e-73ee-443c-a081-7becd754219f x-usersessionid: 07cf5a89-bf43-4da5-af18-80328fa18402 x-officefe: AgavesFrontEnd_IN_5 x-officeversion: 16.0.18724.40461 x-officecluster: eus-000.appsforoffice.onenote.com x-partitioning-enabled: true strict-transport-security: max-age=31536000; includeSubDomains; preload x-buls-suppressionetag: N/A x-buls-suppressedtags: x-invalidulsjson: x-content-type-options: nosniff x-download-options: noopen content-disposition: attachment x-content-type-options: nosniff x-azure-ref: 20250325T123820Z-17cccd5449bkk7bshC1EWR4rww0000000ds00000000042yt X-Cache: CONFIG_NOCACHE
2025-03-25 12:38:20 UTC	1208	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 35 30 30 20 2d 20 49 6e 74 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>500 - Int

Target ID:	1
Start time:	08:36:52
Start date:	25/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	08:36:53
Start date:	25/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2012,i,1976209174990249533,4674015126003251835,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2060 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false