Create Interactive Tour

Windows Analysis Report
https://thetti-my.sharepoint.com/:f:/p/kellieblack/EtssBivICL5BgQEDfbETZP4BZsoHTOyxYMnSj46dgeiAiA?e=0t2fdm

Overview

General Information

Sample URL:	https://thetti-my.sharepoint.com/:f:/p/kellieblack/EtssBivICL5BgQEDfbETZP4BZsoHTOyxYMnSj46dgeiAiA?e=0t2fdm
Analysis ID:	1648544
Infos:

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Yara detected HtmlPhish54

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Phishing site or detected (based on various text indicators)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops files with a non-matching file extension (content does not match file extension)

HTML page contains hidden javascript code

HTML page contains obfuscated script src

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6284 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,18348228627803180148,13274248836850029492,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 1028 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://thetti-my.sharepoint.com/:f:/p/kellieblack/EtssBivICL5BgQEDfbETZP4BZsoHTOyxYMnSj46dgeiAiA?e=0t2fdm" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
6.700..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
6.11.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
6.10.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
6.704..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
6.13.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
6.12.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
6.705..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
6.14.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
6.15.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 4 entries

Suricata Signatures

ET PHISHING Generic Credential Phish Landing Page with Explicit Cloudflare Turnstile Rendering 2024-11-07

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-25T22:31:47.505549+0100	2057301	1	Successful Credential Theft Detected	104.21.32.1	443	192.168.2.16	50176	TCP
2025-03-25T22:31:49.844882+0100	2057301	1	Successful Credential Theft Detected	104.21.32.1	443	192.168.2.16	50177	TCP
2025-03-25T22:31:50.449411+0100	2057301	1	Successful Credential Theft Detected	104.21.112.1	443	192.168.2.16	50203	TCP

Joe Sandbox Signatures

• Phishing
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Persistence and Installation Behavior

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish54

Source: Yara match	File source: 6.700..script.csv, type: HTML
Source: Yara match	File source: 6.11.pages.csv, type: HTML
Source: Yara match	File source: 6.10.pages.csv, type: HTML
Source: Yara match	File source: 6.704..script.csv, type: HTML
Source: Yara match	File source: 6.13.pages.csv, type: HTML
Source: Yara match	File source: 6.12.pages.csv, type: HTML
Source: Yara match	File source: 6.705..script.csv, type: HTML
Source: Yara match	File source: 6.14.pages.csv, type: HTML
Source: Yara match	File source: 6.15.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/onedrive.aspx?ga=1&id=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX%2FThe%20Team%20Training%20Institute%2FThe%20Team%20Training%20Institute%2Epdf&parent=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX%2FThe%20Team%20Training%20Institute

Joe Sandbox AI: Page contains button: 'Secure Open' Source: '3.4.pages.csv'

AI detected suspicious Javascript

Source: 0.7..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: blob:https://thetti-my.sharepoint.com/f55cb044-9f1... This script demonstrates high-risk behaviors, including dynamic code execution via `eval()` and potential data exfiltration through the use of the `fetch()` API to an untrusted domain (`/_layouts/15/spwebworkerproxy.ashx`). The script also attempts to handle errors in a way that could lead to further issues. Overall, the combination of these factors suggests a high-risk script that requires further investigation.

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 3.4

OCR Text: e Share The Team Trmstitute.pdf Adobe Document Cloud This c;urnent is encrypted ushg Ad&e Secure CbudTV. to securety vw contents. Secure Open are With 1

Source: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9Q

HTTP Parser: Base64 decoded: function c(){if(!document.querySelector(".b") || !document.querySelector(".g")){document.head.appendChild(Object.assign(document.createElement("div"),{classList:["b"]}));document.documentElement.style.filter="hue-rotate(4deg)";document.head.appendChild(Ob...

Source: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJ	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX

Source: https://06ce4a55.a65b244135035fa567d4d337.workers.dev/	HTTP Parser: No favicon
Source: https://06ce4a55.a65b244135035fa567d4d337.workers.dev/	HTTP Parser: No favicon
Source: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9Q	HTTP Parser: No favicon
Source: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9Q	HTTP Parser: No favicon
Source: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9Q	HTTP Parser: No favicon
Source: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9Q	HTTP Parser: No favicon
Source: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9Q	HTTP Parser: No favicon
Source: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9Q	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.100:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.136.13:443 -> 192.168.2.16:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.101.65.162:443 -> 192.168.2.16:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.101.65.210:443 -> 192.168.2.16:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.97.190.18:443 -> 192.168.2.16:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.96.157.114:443 -> 192.168.2.16:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.98.71.210:443 -> 192.168.2.16:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.96.111.82:443 -> 192.168.2.16:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.138.10:443 -> 192.168.2.16:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.16:50176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.16:50177 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:50191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:50201 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.16:50203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.45.177.71:443 -> 192.168.2.16:50253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.45.177.71:443 -> 192.168.2.16:50263 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.45.177.71:443 -> 192.168.2.16:50264 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.45.177.71:443 -> 192.168.2.16:50265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.45.177.71:443 -> 192.168.2.16:50270 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.9.156:443 -> 192.168.2.16:50290 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.157.1:443 -> 192.168.2.16:50296 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.152.21:443 -> 192.168.2.16:50301 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.152.21:443 -> 192.168.2.16:50362 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.201.174:443 -> 192.168.2.16:50367 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.201.134:443 -> 192.168.2.16:50364 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.33.44.234:443 -> 192.168.2.16:50366 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.235.187:443 -> 192.168.2.16:50365 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.33.44.234:443 -> 192.168.2.16:50374 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:50704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.201.134:443 -> 192.168.2.16:50850 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 32MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057301 - Severity 1 - ET PHISHING Generic Credential Phish Landing Page with Explicit Cloudflare Turnstile Rendering 2024-11-07 : 104.21.32.1:443 -> 192.168.2.16:50177
Source: Network traffic	Suricata IDS: 2057301 - Severity 1 - ET PHISHING Generic Credential Phish Landing Page with Explicit Cloudflare Turnstile Rendering 2024-11-07 : 104.21.112.1:443 -> 192.168.2.16:50203
Source: Network traffic	Suricata IDS: 2057301 - Severity 1 - ET PHISHING Generic Credential Phish Landing Page with Explicit Cloudflare Turnstile Rendering 2024-11-07 : 104.21.32.1:443 -> 192.168.2.16:50176

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67

Source: global traffic	HTTP traffic detected: GET /:f:/p/kellieblack/EtssBivICL5BgQEDfbETZP4BZsoHTOyxYMnSj46dgeiAiA?e=0t2fdm HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkellieblack_thetti_com%2FDocuments%2FView%20OneDrive%20eFAX&ga=1 HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_api/v2.1/graphql HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/BLANK.gif HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkellieblack_thetti_com%2FDocuments%2FView%20OneDrive%20eFAX&ga=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2025-03-07.002%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.js HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX&ga=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&compWWFlow=true&atomic=true&g=0&l2=true HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX&ga=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/BLANK.gif HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX&TryNewExperienceSingle=TRUE HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_api/v2.0/sites/%7B27a899a8-7938-42bd-99eb-b0bab83aa62e%7D/lists/%7B251f106c-7fed-4015-beb4-5d512f9d2933%7D/items/delta?token=latest HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Content-Type: application/json;odata=verboseX-RestrictedReadCapabilities: ForceCheckOut,RequiredColumn,ContentApproval,Irm,ExcludeFromOfflineClient,DocumentParser,DraftItemSecurity,ItemLevelPermissionsAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2025-03-07.002%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.jsAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_api/v2.0/sites/root/lists/%7B251f106c-7fed-4015-beb4-5d512f9d2933%7D/subscriptions/socketIo?listItemIds= HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Content-Type: application/json;odata=verbosePrefer: NotificationSessionAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/serviceworkerproxy.aspx?serviceWorkerUrl=https%3A%2F%2Fres-1.cdn.office.net%2Ffiles%2Fodsp-web-prod_2025-03-07.002%2Fodspwebworkers%2Fen-us%2Fspartanlistpostpltworker.jsAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/jsonContent-Type: application/jsonSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&compWWFlow=true&atomic=true&g=0&l2=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_api/v2.0/sites/%7B27a899a8-7938-42bd-99eb-b0bab83aa62e%7D/lists/%7B251f106c-7fed-4015-beb4-5d512f9d2933%7D/items/delta?token=latest HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /footprint/v3.2/scripts/fp-min.js HTTP/1.1Host: r4.res.office365.comConnection: keep-aliveOrigin: https://thetti-my.sharepoint.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://thetti-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /conf/v2/o365se/fpconfig.min.json?monitorId=O365se HTTP/1.1Host: config.fp.measure.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://thetti-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX&ga=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /conf/v2/o365se/fpconfig.min.json?monitorId=O365se HTTP/1.1Host: config.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/jsonContent-Type: application/jsonSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&compWWFlow=true&atomic=true&g=0&l2=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]If-None-Match: "41324955_sts_default_en-us"
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx?odsp-web-prod_2025-03-14.003 HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&compWWFlow=true&atomic=true&g=0&l2=trueAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX%2FThe%20Team%20Training%20Institute&View=2e747267-bfec-4d2b-a8d2-5a05d65ee605&TryNewExperienceSingle=TRUE HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?2cf1341cd8578a147a22f2e5ed268e48 HTTP/1.1Host: 577cf093c99335aac213bf037bd04ff3.fp.measure.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://thetti-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX%2FThe%20Team%20Training%20Institute%2FThe%20Team%20Training%20Institute%2Epdf&View=2e747267-bfec-4d2b-a8d2-5a05d65ee605&TryNewExperienceSingle=TRUE HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?d6643879af4bbc192dd407eb3f326bb2 HTTP/1.1Host: 577cf093c99335aac213bf037bd04ff3.fp.measure.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://thetti-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?2cf1341cd8578a147a22f2e5ed268e48 HTTP/1.1Host: 577cf093c99335aac213bf037bd04ff3.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?c95f98c2620b57f9c74ccc331663749a HTTP/1.1Host: outlook.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://thetti-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?d6643879af4bbc192dd407eb3f326bb2 HTTP/1.1Host: 577cf093c99335aac213bf037bd04ff3.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?f6240cb4595a7b3f1b2e60524dbf5c6b HTTP/1.1Host: outlook.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://thetti-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?c95f98c2620b57f9c74ccc331663749a HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?f6240cb4595a7b3f1b2e60524dbf5c6b HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?cde5938419387b82555cd0ce535ad7e1 HTTP/1.1Host: tr-ooc-atm.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://thetti-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?cde5938419387b82555cd0ce535ad7e1 HTTP/1.1Host: tr-ooc-atm.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?207fbef8cf1419be89a5c7d66785703d HTTP/1.1Host: tr-ooc-atm.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://thetti-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?207fbef8cf1419be89a5c7d66785703d HTTP/1.1Host: tr-ooc-atm.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r.gif?MonitorID=O365se&rid=0d1486cd1309b55df31c49718a177db6&w3c=true&prot=https:&v=20190214&tag=[{%22TenantId%22:%2267bb197b-b9fb-4d1d-bdea-510c010d61e6%22,%22AppId%22:%22Documents%22}]&DATA=[{%22RequestID%22:%22577cf093c99335aac213bf037bd04ff3%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1059,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22HEL%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22577cf093c99335aac213bf037bd04ff3%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:992,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22HEL%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22outlook.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:615,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22MNZ%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22outlook.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:506,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22MNZ%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22tr-ooc-atm.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1390,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22XSP%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22tr-ooc-atm.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:1289,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22XSP%22,%22Fe%22:%22cafe%22}] HTTP/1.1Host: upload.fp.measure.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://thetti-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r.gif?MonitorID=O365se&rid=0d1486cd1309b55df31c49718a177db6&w3c=true&prot=https:&v=20190214&tag=[{%22TenantId%22:%2267bb197b-b9fb-4d1d-bdea-510c010d61e6%22,%22AppId%22:%22Documents%22}]&DATA=[{%22RequestID%22:%22577cf093c99335aac213bf037bd04ff3%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1059,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22HEL%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22577cf093c99335aac213bf037bd04ff3%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:992,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22HEL%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22outlook.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:615,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22MNZ%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22outlook.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:506,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22MNZ%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22tr-ooc-atm.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1390,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22XSP%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22tr-ooc-atm.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:1289,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22XSP%22,%22Fe%22:%22cafe%22}] HTTP/1.1Host: upload.fp.measure.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX%2FThe%20Team%20Training%20Institute&View=2e747267-bfec-4d2b-a8d2-5a05d65ee605&TryNewExperienceSingle=TRUE HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fthetti-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!qJmoJzh5vUKZ67C6uDqmLttcl3WmwwJDi3S0jR8-POZsEB8l7X8VQL60XVEvnSkz%2Fitems%2F01LRXEEZPWYVH44HBFHRD3A5VPOQ4OHOZK%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiIyN2E4OTlhOC03OTM4LTQyYmQtOTllYi1iMGJhYjgzYWE2MmUiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvdGhldHRpLW15LnNoYXJlcG9pbnQuY29tQDY3YmIxOTdiLWI5ZmItNGQxZC1iZGVhLTUxMGMwMTBkNjFlNiIsImV4cCI6IjE3NDI5NTgwMDAifQ.CiMKCXNoYXJpbmdpZBIWcys1ejR4MTFPRVNMaUM5MzlSbmJ2QQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjqjDsQARoMMTYxLjc3LjEzLjIwIhRtaWNyb3NvZnQuc2hhcmVwb2ludCosMFltNXAyWTdwWXVneHAxUk4xb3loM01HL2VFSHVYNnpuUC9Ccmx3U01jTT0wdDgBShBoYXNoZWRwcm9vZnRva2VuYgR0cnVlcmEwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiM4YzBjODk4Mjg2ZWJiYWExNGFhOGZjZTRhNWNmYjYwZmY1YWEzYmM5NmVmYThmMGFlMmYzZDJhMmQwNjRiNGIyegEwwgFhMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMg.NxyFVvkpxZDVVvxCgD8gZs59G2b_eSsIvLBBeqT_qG4&cTag=%22c%3A%7BCE4FC5F6-251C-473C-B076-AF7438E3BB2A%7D%2C1%22 HTTP/1.1Host: eastus1-mediap.svc.msConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://thetti-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX%2FThe%20Team%20Training%20Institute%2FThe%20Team%20Training%20Institute%2Epdf&View=2e747267-bfec-4d2b-a8d2-5a05d65ee605&TryNewExperienceSingle=TRUE HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]; MicrosoftApplicationsTelemetryDeviceId=5dd84472-3eda-4b11-8b91-3f65645343b9; ai_session=5FAJA7uqP7lz2kd6cdF7s8\|1742938299091\|1742938299091
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_api/v2.0/sites/root/lists/251f106c-7fed-4015-beb4-5d512f9d2933/subscriptions/socketIo?listItemIds= HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-alivePrefer: NotificationSessionsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/json;odata=verbosesec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/onedrive.aspx?ga=1&id=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX%2FThe%20Team%20Training%20Institute%2FThe%20Team%20Training%20Institute%2Epdf&parent=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX%2FThe%20Team%20Training%20InstituteAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]; MicrosoftApplicationsTelemetryDeviceId=5dd84472-3eda-4b11-8b91-3f65645343b9; ai_session=5FAJA7uqP7lz2kd6cdF7s8\|1742938299091\|1742938299091
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fthetti-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!qJmoJzh5vUKZ67C6uDqmLttcl3WmwwJDi3S0jR8-POZsEB8l7X8VQL60XVEvnSkz%2Fitems%2F01LRXEEZPWYVH44HBFHRD3A5VPOQ4OHOZK%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiIyN2E4OTlhOC03OTM4LTQyYmQtOTllYi1iMGJhYjgzYWE2MmUiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvdGhldHRpLW15LnNoYXJlcG9pbnQuY29tQDY3YmIxOTdiLWI5ZmItNGQxZC1iZGVhLTUxMGMwMTBkNjFlNiIsImV4cCI6IjE3NDI5NTgwMDAifQ.CiMKCXNoYXJpbmdpZBIWcys1ejR4MTFPRVNMaUM5MzlSbmJ2QQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjqjDsQARoMMTYxLjc3LjEzLjIwIhRtaWNyb3NvZnQuc2hhcmVwb2ludCosMFltNXAyWTdwWXVneHAxUk4xb3loM01HL2VFSHVYNnpuUC9Ccmx3U01jTT0wdDgBShBoYXNoZWRwcm9vZnRva2VuYgR0cnVlcmEwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiM4YzBjODk4Mjg2ZWJiYWExNGFhOGZjZTRhNWNmYjYwZmY1YWEzYmM5NmVmYThmMGFlMmYzZDJhMmQwNjRiNGIyegEwwgFhMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMg.NxyFVvkpxZDVVvxCgD8gZs59G2b_eSsIvLBBeqT_qG4&cTag=%22c%3A%7BCE4FC5F6-251C-473C-B076-AF7438E3BB2A%7D%2C1%22 HTTP/1.1Host: eastus1-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 06ce4a55.a65b244135035fa567d4d337.workers.devConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://06ce4a55.a65b244135035fa567d4d337.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://06ce4a55.a65b244135035fa567d4d337.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/aipxs/0x4AAAAAABB9-Qwz2OYAulMj/auto/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://06ce4a55.a65b244135035fa567d4d337.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=9261846f8cb01819&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/aipxs/0x4AAAAAABB9-Qwz2OYAulMj/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/aipxs/0x4AAAAAABB9-Qwz2OYAulMj/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 06ce4a55.a65b244135035fa567d4d337.workers.devConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://06ce4a55.a65b244135035fa567d4d337.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 06ce4a55.a65b244135035fa567d4d337.workers.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/2111154936:1742934481:9hDx0vpn1CFAUUBBvheSIfaXGTaIhAzz2jn-AHBPxP8/9261846f8cb01819/e3.ZfYmmvccgyZD1_3OEPtaU1Qvs83A1Vsi781DXVPA-1742938309-1.1.1.1-XrkRXy_pPzq8TuCHyYsp1YyXWaHQIbXxIx4LZLeZQ5lbVT.8aY5wfwRPID9dGBP7 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/9261846f8cb01819/1742938310201/t9vKYmGlrHEaDQ8 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/aipxs/0x4AAAAAABB9-Qwz2OYAulMj/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/9261846f8cb01819/1742938310201/t9vKYmGlrHEaDQ8 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/9261846f8cb01819/1742938310202/3fa0190395472dccb51714b4ba1003c5355923c5f11893ea31e79bc49baaffdf/miMwmXvjywmPqp7 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/aipxs/0x4AAAAAABB9-Qwz2OYAulMj/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/2111154936:1742934481:9hDx0vpn1CFAUUBBvheSIfaXGTaIhAzz2jn-AHBPxP8/9261846f8cb01819/e3.ZfYmmvccgyZD1_3OEPtaU1Qvs83A1Vsi781DXVPA-1742938309-1.1.1.1-XrkRXy_pPzq8TuCHyYsp1YyXWaHQIbXxIx4LZLeZQ5lbVT.8aY5wfwRPID9dGBP7 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/2111154936:1742934481:9hDx0vpn1CFAUUBBvheSIfaXGTaIhAzz2jn-AHBPxP8/9261846f8cb01819/e3.ZfYmmvccgyZD1_3OEPtaU1Qvs83A1Vsi781DXVPA-1742938309-1.1.1.1-XrkRXy_pPzq8TuCHyYsp1YyXWaHQIbXxIx4LZLeZQ5lbVT.8aY5wfwRPID9dGBP7 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?dnygxoni HTTP/1.1Host: homeoillcompany.netConnection: keep-aliveqrc-auth: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: application/jsonsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: https://06ce4a55.a65b244135035fa567d4d337.workers.devSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://06ce4a55.a65b244135035fa567d4d337.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?dnygxoni HTTP/1.1Host: homeoillcompany.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3ByZW5uaXVtb2ZzLmNvbS8iLCJkb21haW4iOiJwcmVubml1bW9mcy5jb20iLCJrZXkiOiJuNWpkR0RydExTWEMiLCJxcmMiOm51bGwsImlhdCI6MTc0MjkzODMxNywiZXhwIjoxNzQyOTM4NDM3fQ.jgnFjEj-x9Zoa9s2rnAkKAKqs23qRnkw8J0M85LMsLo HTTP/1.1Host: prenniumofs.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://06ce4a55.a65b244135035fa567d4d337.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: prenniumofs.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://06ce4a55.a65b244135035fa567d4d337.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=n5jdGDrtLSXC; qPdM.sig=V9TqKJwCQxMHNH18z80x7hGissg
Source: global traffic	HTTP traffic detected: GET /owa/ HTTP/1.1Host: prenniumofs.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://06ce4a55.a65b244135035fa567d4d337.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=n5jdGDrtLSXC; qPdM.sig=V9TqKJwCQxMHNH18z80x7hGissg
Source: global traffic	HTTP traffic detected: GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3ByZW5uaXVtb2ZzLmNvbS8iLCJkb21haW4iOiJwcmVubml1bW9mcy5jb20iLCJrZXkiOiJoZU1rcE9uMU5KdnUiLCJxcmMiOm51bGwsImlhdCI6MTc0MjkzODMxNywiZXhwIjoxNzQyOTM4NDM3fQ.P_k4EmNZRTs0QHbG5vOvxBlkhgxdXjA9viXvzLI6NkY HTTP/1.1Host: prenniumofs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=n5jdGDrtLSXC; qPdM.sig=V9TqKJwCQxMHNH18z80x7hGissg
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: prenniumofs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=heMkpOn1NJvu; qPdM.sig=NS-F2Bb5GUkp7TqJtKDLpGSMpQg
Source: global traffic	HTTP traffic detected: GET /?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9Q HTTP/1.1Host: prenniumofs.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://06ce4a55.a65b244135035fa567d4d337.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=heMkpOn1NJvu; qPdM.sig=NS-F2Bb5GUkp7TqJtKDLpGSMpQg; ClientId=27ED18A864CE4D4A8BC70B9BFD00920F; OIDC=1; OpenIdConnect.nonce.v3.BpY5D279qWT0xxG69r_bhocmxkwQlpkI7TIU4ipFzxE=638785351184218920.78f0f12c-9a5f-4de8-87dd-ce39a7323fae; X-OWA-RedirectHistory=ArLym14BKPsOeeRr3Qg
Source: global traffic	HTTP traffic detected: GET /owa/ HTTP/1.1Host: prenniumofs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=heMkpOn1NJvu; qPdM.sig=NS-F2Bb5GUkp7TqJtKDLpGSMpQg; ClientId=27ED18A864CE4D4A8BC70B9BFD00920F; OIDC=1; OpenIdConnect.nonce.v3.BpY5D279qWT0xxG69r_bhocmxkwQlpkI7TIU4ipFzxE=638785351184218920.78f0f12c-9a5f-4de8-87dd-ce39a7323fae; X-OWA-RedirectHistory=ArLym14BKPsOeeRr3Qg
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js HTTP/1.1Host: prenniumofs.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9QAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=heMkpOn1NJvu; qPdM.sig=NS-F2Bb5GUkp7TqJtKDLpGSMpQg; ClientId=27ED18A864CE4D4A8BC70B9BFD00920F; OIDC=1; OpenIdConnect.nonce.v3.BpY5D279qWT0xxG69r_bhocmxkwQlpkI7TIU4ipFzxE=638785351184218920.78f0f12c-9a5f-4de8-87dd-ce39a7323fae; X-OWA-RedirectHistory=ArLym14BKPsOeeRr3Qg; esctx-axG3SNlyZt4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEettGtW5z8m2b0zaBEPH0MISmD_K4gUEPGxODX_iZWITC5AeY1cbXcJl2DBOW6Qd8UAQBgQ1sDHhGRSB-ZGI-w2sQCQg2yOAPzIF_5cQb778ogoflRWw79z9AOvc1YUDJMJlbdrse1S8fm_ObEOHErCAA; fpc=AhvX0dsukmtCpnrwoW5Dm2I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEAVaXV1t1dYJagAPhJzDRz8ZdF4rQ40nSysd5kPXzV5fwMIk3I9Cok-mlflkKLuelhe4klwfxUcr8jcGiB2sYHJq8IfPuvynG_VzOah2rt3olPcY4X9KggtFcj0bg3vzyzQi7-PFmG3rcYOiubiO-bBvZFI9lUqPCBc8j7aImuV4gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351199053861.ZmQ1ZDUzMTAtMzczYy00ZmMwLThlYWItYjZlN2M3ZTFlNjg4NWJmMTMxOTItZmZjNy00MWU2LWJjODgtMTFiZGNiMTk4ZjYw&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=37046ea2-3090-45b4-ad52-31978ebdc059&state=hXwrK_BhecJREA86ynmf1r2ydkWe_W7hmsOTHQVhR7fVhW9aWAtstLB_OnoTQh4Tbgzge3_492sAHFD1IxEZj_wA1_RZKJqKgp0wiQtPDYvRTB7T1iAbQTsI91nmK4l_rlkF-TiUXiz9rqTN_-ewNeaEdnKmoEFjNl6q2wAtQz-dv9S1J0jiu1HpnKnFVGOAuvwWKPdRDOJ7dY9JE0ixEtdOYylShpkZM0_y-G_A-muFAmwVjNBc6FkkvyTHfRflkIFhzDiu5Jj6tnsh7xYD0KV7LjC8NZWrbS_eWlYPfbHQYty5eGl1mhALypVn2XlPcXvfVlnbFAB194C57PU56rv6w9-3TYg3ovKu-noQS2g&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351201975511.ZjQyNGVkODItNjAyYy00ZDI2LWI1NGYtZGRlNTlkYmY4MTY4YzNmYWI5NmEtNWQ4Yi00NTg2LTk3OGUtZGU4ZjViNTAwOGM3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=2d67dec5-ae30-4af6-94eb-0570aab0f51c&state=whywv-hFGwVyV15QWSaAaRv_XLbb_osajRpx-mBzwSaFvChxrrvG42K6betA7yUqu_SOM6hqf9O17ciDdPIOajvZy7TU0sTgxjkl6NK-HmER_MMilGbmx3AaJQgMMQWJ6AQkKkStHzBunHBj5NKszs-n0pUT06NgQACCTgejBzO1VWqD3YGYQVST5xOpUFeYWn-upnDL_FY3pgrhGzSm-jUNCC4MzMP60MrXNDOC4PTVMgtIFoYXpTjLM0fFWuTKPkY1Q4sqBZurchgKrWVm3tWbFVJTQ20IRRXHfbB936agZigyCxHrDTaIQsU6RxhhB217wLqlNjGKAnYfIdZYXPGUxX54JaI0pagKD_OIzN4&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js HTTP/1.1Host: prenniumofs.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9QAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=heMkpOn1NJvu; qPdM.sig=NS-F2Bb5GUkp7TqJtKDLpGSMpQg; ClientId=27ED18A864CE4D4A8BC70B9BFD00920F; OIDC=1; OpenIdConnect.nonce.v3.BpY5D279qWT0xxG69r_bhocmxkwQlpkI7TIU4ipFzxE=638785351184218920.78f0f12c-9a5f-4de8-87dd-ce39a7323fae; X-OWA-RedirectHistory=ArLym14BKPsOeeRr3Qg; esctx-axG3SNlyZt4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEettGtW5z8m2b0zaBEPH0MISmD_K4gUEPGxODX_iZWITC5AeY1cbXcJl2DBOW6Qd8UAQBgQ1sDHhGRSB-ZGI-w2sQCQg2yOAPzIF_5cQb778ogoflRWw79z9AOvc1YUDJMJlbdrse1S8fm_ObEOHErCAA; fpc=AhvX0dsukmtCpnrwoW5Dm2I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEAVaXV1t1dYJagAPhJzDRz8ZdF4rQ40nSysd5kPXzV5fwMIk3I9Cok-mlflkKLuelhe4klwfxUcr8jcGiB2sYHJq8IfPuvynG_VzOah2rt3olPcY4X9KggtFcj0bg3vzyzQi7-PFmG3rcYOiubiO-bBvZFI9lUqPCBc8j7aImuV4gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1Host: prenniumofs.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9QAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=heMkpOn1NJvu; qPdM.sig=NS-F2Bb5GUkp7TqJtKDLpGSMpQg; ClientId=27ED18A864CE4D4A8BC70B9BFD00920F; OIDC=1; OpenIdConnect.nonce.v3.BpY5D279qWT0xxG69r_bhocmxkwQlpkI7TIU4ipFzxE=638785351184218920.78f0f12c-9a5f-4de8-87dd-ce39a7323fae; X-OWA-RedirectHistory=ArLym14BKPsOeeRr3Qg; esctx-axG3SNlyZt4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEettGtW5z8m2b0zaBEPH0MISmD_K4gUEPGxODX_iZWITC5AeY1cbXcJl2DBOW6Qd8UAQBgQ1sDHhGRSB-ZGI-w2sQCQg2yOAPzIF_5cQb778ogoflRWw79z9AOvc1YUDJMJlbdrse1S8fm_ObEOHErCAA; fpc=AhvX0dsukmtCpnrwoW5Dm2I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEAVaXV1t1dYJagAPhJzDRz8ZdF4rQ40nSysd5kPXzV5fwMIk3I9Cok-mlflkKLuelhe4klwfxUcr8jcGiB2sYHJq8IfPuvynG_VzOah2rt3olPcY4X9KggtFcj0bg3vzyzQi7-PFmG3rcYOiubiO-bBvZFI9lUqPCBc8j7aImuV4gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; .AspNetCore.OpenIdConnect.Nonce.PMg_ts82FxeaHrHRFLULBqWfItVree7NmrnGaG3VRivoHoTqKqA7XOXpGl0rqIpSUPEJ8JtpQPf2ptrh3-7N2G26EbQOZ1_2F5h4d4CfqHmMww8TjPUJFrcY5pzk3jCVcaOjswHz2Fu5sXX00KwpYW1ZnA2AbmPb_NwHGStSo2ntE6Ajt96Kii1zs0w1qCjRDlGyBW1zT9Xjt-CHeaFB4ZAlWiDyCPNlgv5YFwU_P75B8sUUZTVR9SoR4lS0RYH3=N; .AspNetCore.Correlation.f_hDYLZ12UdBMXWjKylp483UejqCJuL9ANC66akyLg8=N; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.V5LV2QqX9weF0G1PZSDNOWoQwtD3SSgxFYFxl8ZkmQzzi4p_q5CFQKMukRq2MVYC4ojqqxl4W6EPHa91GJLuxm6D1YiLnuZE8LMF2xQbclxvszqEao3nMe7oYrbWlacniRXEUuPgPVI83eutARJkhB6nZD3IBp_Pw802wIwlcfqfaYnTpJHVmPZBOJqWB44nP5eqC-W-ytVIgnfktnNypUN0Yl8EoqAzsurWYq1a1O8PNE6EZ1cdpj0Le137s5j4=N; .AspNetCore.Correlation.-ExcJfah25IHd-4FcvOs7H5nTcp33dLlh2D8ZmEtEdY=N
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; .AspNetCore.OpenIdConnect.Nonce.PMg_ts82FxeaHrHRFLULBqWfItVree7NmrnGaG3VRivoHoTqKqA7XOXpGl0rqIpSUPEJ8JtpQPf2ptrh3-7N2G26EbQOZ1_2F5h4d4CfqHmMww8TjPUJFrcY5pzk3jCVcaOjswHz2Fu5sXX00KwpYW1ZnA2AbmPb_NwHGStSo2ntE6Ajt96Kii1zs0w1qCjRDlGyBW1zT9Xjt-CHeaFB4ZAlWiDyCPNlgv5YFwU_P75B8sUUZTVR9SoR4lS0RYH3=N; .AspNetCore.Correlation.f_hDYLZ12UdBMXWjKylp483UejqCJuL9ANC66akyLg8=N; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.V5LV2QqX9weF0G1PZSDNOWoQwtD3SSgxFYFxl8ZkmQzzi4p_q5CFQKMukRq2MVYC4ojqqxl4W6EPHa91GJLuxm6D1YiLnuZE8LMF2xQbclxvszqEao3nMe7oYrbWlacniRXEUuPgPVI83eutARJkhB6nZD3IBp_Pw802wIwlcfqfaYnTpJHVmPZBOJqWB44nP5eqC-W-ytVIgnfktnNypUN0Yl8EoqAzsurWYq1a1O8PNE6EZ1cdpj0Le137s5j4=N; .AspNetCore.Correlation.-ExcJfah25IHd-4FcvOs7H5nTcp33dLlh2D8ZmEtEdY=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351219094033.YTc0MzAyMDEtODEzMi00ZjcyLTk4MGYtM2IwMjM5NjQwZTI1NjZkZDk5MjQtNzdlYy00ZTMwLTkxMmEtMzNhMjE1Njc4ZDM0&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=03b1531c-b237-4731-933e-b8c01a6f1b85&state=rLzi6I99XMxH8mXU0NiaRy7Cx7qDAX9zhHtTlOs7u24JkdvrYVYtjxbLBwiNXqBffQidaH0S6oFHXX1fCzxaAZYMcb5anWia8fh-JyAwEzAC4prdOHVxVIHk0sdPO5z3i6GRXOGMhd3i21e2u_v88TQFksqfDqBo7u82JzZMbTTkkkfOnJJ6WVj2INPkkrythmp1EW3zE7xXabrDqxVCeQfWJ-jefla6m028sVwQI1eWsbsUU6I9F3aAdt1YAN7mLdhOK_ts9AV4xuFQD1hT6IO1JLqUbSNbyxk6m14Vrp7ddBWvfuQj-9d2LK6kGF-vUtKNsMHi5xXiqqOSzt7U5HhDXG48jXv-j9kZN_diRL8&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-z8zLowgC78I=AQABCQEAAABVrSpeuWamRam2jAF1XRQES7CVcJ0rU7bmKY3AfDvf--18DADE12BUG4_7gg3D5sX38CRBhGZMfhqwoI5r760q2t2yt91hJxpLmiTa3HVE5q2p6SFCGNNuP_IsdVD-EOMvK-pWm_K7CjXRlVY9PA8LhC-twx0IrNnTC0xFmzYUiCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-GHrgP2v8bQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_gIhzJ1Z38YwGIrzFOLlDpkVIsuwIOEzkwA0r9btZv9ppHKUOEkBSxPKMp_fmvgP3TGNycrIunTS9gsRJ_aAdenhUhBeIaAxr_2vdeLbbSXGfx3AAy82t63iTjvU1JvwbXHgGJr0buv7TEomnlZEuiAA; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351224162088.MTM0ODA0YzktMzlkNy00ZTBhLWE3NmUtZjUyOGYwZjIwY2U1MjI3MzU4YzMtM2JmYy00M2VlLWIxZjktZDIwNTViMzllN2Yw&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=c95536ba-6816-4f2f-811d-f207c32911ea&state=Sx3DslR2sMvPEzFnislbOttKEKNq13VmFAWUT_jpZOiN8wWmSbP8RsyGj1CQVy5TbLvXTC8L-eF_iFhJ0ne7CWetjdaoa-ZjOu4OgFTAOpNwZQqf9N13C47EhTo5Xt4tqNBFllDGD9WN8Fte-JT4R4WVerYp0BeDvXnRmPsvCcxJOCJKR5X3cARnTCAU6z_5SateydS_G3aqgMzHEzvbXdfcKH4yAIBwXlVK-ockauTJuKNR-SRb1Hz4jYU49KYqdEuixJxocbUTTXG5-laYwE6qw8RNncq2uQqltRHkDPSCYM57DwnQ__OP8a393XdLTX4OiiaKLwzPCZN5N3VGSKCFxJm1zQe0yY-G2JxCV58&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-z8zLowgC78I=AQABCQEAAABVrSpeuWamRam2jAF1XRQES7CVcJ0rU7bmKY3AfDvf--18DADE12BUG4_7gg3D5sX38CRBhGZMfhqwoI5r760q2t2yt91hJxpLmiTa3HVE5q2p6SFCGNNuP_IsdVD-EOMvK-pWm_K7CjXRlVY9PA8LhC-twx0IrNnTC0xFmzYUiCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-GHrgP2v8bQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_gIhzJ1Z38YwGIrzFOLlDpkVIsuwIOEzkwA0r9btZv9ppHKUOEkBSxPKMp_fmvgP3TGNycrIunTS9gsRJ_aAdenhUhBeIaAxr_2vdeLbbSXGfx3AAy82t63iTjvU1JvwbXHgGJr0buv7TEomnlZEuiAA; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.eiI96w1yszFlIxEnSow9-NmpCCXHCO70yzxuPHFWQ6xtalwavnCz0Ji-xk9_GwEHshknrEFro2F8NzqOe14zxBoOv4M_Wu2Y6fvNfvLS1kGk8o0arCPsb2GdMFLZJXcEcnJlTBDy_if_41lJHrgX6FwQplQekqGuIlx7UL04mWVsh0LcmFbF93FmdkjMc2ozMXY7yBhNb45a6_lbybVGRYQLjVwxa4WenuJirjhgJYHApt-FfSaIEHWSPQOrpX1b=N; .AspNetCore.Correlation.1FOJEU-OL4x74RQ-MEbNPWrV_EPy63QM9HWMosHkCAI=N; .AspNetCore.OpenIdConnect.Nonce.AVrTDbtGvy8CJGTyz3PvELrFw-aS5vV4KI3HQATgQums7PZSQjAbX-zsHBz7mLP__MGoghzwBiSRf30TMADOF39mXhJ7Hf6qEUbCQCUSplz57Cth2iwzeTCfcxgoTRmqEOXCSOCa4HArksdasPO5l58P1R2cU5Tqc-fgKCTUQEyzqHJRkjtjbfQjnVz4zCVoCp7j5W41VUg0x22J_qxGB-D3NeXUztO1fNZP_fy0fiUNpuWuVQaqr6MsUYVi5yPT=N; .AspNetCore.Correlation.P4VGmT_5DnQNVW99-d-tCZn3vSXm_-Bg6BuWnpFa3JA=N
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1Host: prenniumofs.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9QAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=heMkpOn1NJvu; qPdM.sig=NS-F2Bb5GUkp7TqJtKDLpGSMpQg; ClientId=27ED18A864CE4D4A8BC70B9BFD00920F; OIDC=1; OpenIdConnect.nonce.v3.BpY5D279qWT0xxG69r_bhocmxkwQlpkI7TIU4ipFzxE=638785351184218920.78f0f12c-9a5f-4de8-87dd-ce39a7323fae; X-OWA-RedirectHistory=ArLym14BKPsOeeRr3Qg; esctx-axG3SNlyZt4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEettGtW5z8m2b0zaBEPH0MISmD_K4gUEPGxODX_iZWITC5AeY1cbXcJl2DBOW6Qd8UAQBgQ1sDHhGRSB-ZGI-w2sQCQg2yOAPzIF_5cQb778ogoflRWw79z9AOvc1YUDJMJlbdrse1S8fm_ObEOHErCAA; fpc=AhvX0dsukmtCpnrwoW5Dm2I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEAVaXV1t1dYJagAPhJzDRz8ZdF4rQ40nSysd5kPXzV5fwMIk3I9Cok-mlflkKLuelhe4klwfxUcr8jcGiB2sYHJq8IfPuvynG_VzOah2rt3olPcY4X9KggtFcj0bg3vzyzQi7-PFmG3rcYOiubiO-bBvZFI9lUqPCBc8j7aImuV4gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351232250708.ZDA5NjY1ZmQtZDhhZS00MmNlLWJjY2EtZDJhNmJhYzBiZTliY2RkZGI5ODQtNDc2OS00NzZjLWFlMTUtMGM4NTYzNWQ3MzQ5&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=c3c4ad46-09ee-4257-b167-3fd77bc112b9&state=bPX5QcjfmwU7gbU8aO13ZNVj1sIuV2XM1W7DvtPfoGXXBPEjy_RpNiacb3fGhiWkKoh1qOYIRw8HzAdIwEX0Wt1CjWRhai9-qZSBB3t9p9EtgwP0aNHJOLAoC-3s5a4OHvdXF_Ao51hrdPd1pWZkFBZlrhDYGmzlpwhv-IK7vfgz3WIAGK5eGQUjbpEr038IBi9G7KxiJSP-NVuI1seSz8HFcnSnIDaJS6VCOIwpCR-ryWLzjUnp3WgRx5wMPD6igcQPQ-HgU0wicXoI212_MeXKu663zNieYAOi_9tj9QrY1EMrlbaS6wFwl-t2osLpQUi7sle1hqez9sbHBNDKMkpsfjAWc37-Y-BYxImdniA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-z8zLowgC78I=AQABCQEAAABVrSpeuWamRam2jAF1XRQES7CVcJ0rU7bmKY3AfDvf--18DADE12BUG4_7gg3D5sX38CRBhGZMfhqwoI5r760q2t2yt91hJxpLmiTa3HVE5q2p6SFCGNNuP_IsdVD-EOMvK-pWm_K7CjXRlVY9PA8LhC-twx0IrNnTC0xFmzYUiCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-GHrgP2v8bQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_gIhzJ1Z38YwGIrzFOLlDpkVIsuwIOEzkwA0r9btZv9ppHKUOEkBSxPKMp_fmvgP3TGNycrIunTS9gsRJ_aAdenhUhBeIaAxr_2vdeLbbSXGfx3AAy82t63iTjvU1JvwbXHgGJr0buv7TEomnlZEuiAA; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-wZiyBCRKoU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEh1X8MQd6ktyF3OjKMfx1OvHNKLGgUDLBXiV4S25DOlErredG-HNc_lpQjSfoIh9LS_SRftV4CfJ4NPF90XbP4ueAYW-TIJahmDljgVZeDA3opz4AMx4e4HTGH5kHpKbD-G2_1TwfQqYtxDw6vSl9FSAA; esctx-eWpOYYCYfZM=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_9SDxSOraUUrvUu2fRRbToMdb7awa92hWw1KIoWxczFExgeb45EFz2zRTNjvuWZI7sLHGqnjByZFETXel0iBd3eNeFwbp-T_0CcLhXOZHyPQMt-IVy72bId51tJwi-EJC7OdEZttHUcidUjzSBIdviAA
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.9qinbWb-qSr6I0RMsVLNHLfxuKmg6SGiePsPIzlTtvRahIKaPmiD8oOscn--7X4NsCPi-6uyYrrqfcHqQqLfYNaoL9B2eWYsFlkaHwwlVCyc841VtDAtBXoj2xbCqgzMnIKlQF_OTnrf6mXfJuehuFkV5TF_6AiDlSCe6e8-ppbxNZp9dC3OG4TYyHBFRsLoWZuK8rx9DYcmG9UjIu1cDghhEM1bHxNkXidAo7xSGQ2Qdjgtvko5Re2A6grDbBRP=N; .AspNetCore.Correlation.tlv5ScVqq0OGK8YYxyaFmnTRnxFdqTW_kDaINSvDS0U=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351241526609.YjM1NWM0ODUtYmU0MC00ZjA0LWE3YWMtZDQ5OWYwZGEwOGJhZDAzMmQxZTItMTI1My00MmE3LWI1YTMtNDI3ZTQ3M2JjNzU0&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=2c477191-574e-4827-9bf7-3d4e555f522d&state=LjTVfAY8vi8QuOp6KfI68XmQmZPi9HkPHiaC7g-3USUdMWeecyruBY8E2wbk_jpIMr8n6wtLz4-RS9WyjUR4iVbiD8boyx_k7gXui7GoZw3f1PTpG2vJavnQB_7EKX9CWE25-LsQmLv3eBGEoPoHQpmqoAxLvQbMSWr1aSCKfCv7DOQFhT-MQhqP42xvkbhUTyPr0ptLhjH8hj6ZmbDke1oDHo8iS_6A8vSnd9mN6bfsqIY50hm93sdTRtMknJu7dvQoqGvwtbis-Joryh8WLiaHfgNrn3WCF4I87tpv-aXyV8yNuziHV-XeJrRmVMAwvTAQCGHKrTR302rKxS5pyPjvt5zbCHeB8OepElrCrIE&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-z8zLowgC78I=AQABCQEAAABVrSpeuWamRam2jAF1XRQES7CVcJ0rU7bmKY3AfDvf--18DADE12BUG4_7gg3D5sX38CRBhGZMfhqwoI5r760q2t2yt91hJxpLmiTa3HVE5q2p6SFCGNNuP_IsdVD-EOMvK-pWm_K7CjXRlVY9PA8LhC-twx0IrNnTC0xFmzYUiCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-GHrgP2v8bQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_gIhzJ1Z38YwGIrzFOLlDpkVIsuwIOEzkwA0r9btZv9ppHKUOEkBSxPKMp_fmvgP3TGNycrIunTS9gsRJ_aAdenhUhBeIaAxr_2vdeLbbSXGfx3AAy82t63iTjvU1JvwbXHgGJr0buv7TEomnlZEuiAA; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-wZiyBCRKoU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEh1X8MQd6ktyF3OjKMfx1OvHNKLGgUDLBXiV4S25DOlErredG-HNc_lpQjSfoIh9LS_SRftV4CfJ4NPF90XbP4ueAYW-TIJahmDljgVZeDA3opz4AMx4e4HTGH5kHpKbD-G2_1TwfQqYtxDw6vSl9FSAA; esctx-eWpOYYCYfZM=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_9SDxSOraUUrvUu2fRRbToMdb7awa92hWw1KIoWxczFExgeb45EFz2zRTNjvuWZI7sLHGqnjByZFETXel0iBd3eNeFwbp-T_0CcLhXOZHyPQMt-IVy72bId51tJwi-EJC7OdEZttHUcidUjzSBIdviAA; esctx-YVIep8e7iLI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEjJFZ04KJsq3nhmzc09ooycaSGwysNUxJeCwFIBVZEdYg2x9IsPbzpBm18nDQZsU-xCoTrJGHDsGHW6hCLMbpD58fE4dk9rK93enlmdEdIyQatyI4Zr8lFku_OJEcWBH1SzYiKGyJZ7jlkZdxFnVlkSAA
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.NSvcmOwncqco4XytQ99id04Cz9Jjz9_WpBM8JPHRowpG8qQkiBIUpR-5grBdhVOuFuOxICIgsynStEXPGhvSRHl57ZgqpTa3m-omUEwDpIfENkaooSRdCCpuYHGi4FUzvaoM86GmEwaZuJbACkTzupET8TRYrovGxiHzwnxdryMHPSGd2xCc0EYag5LroUR25VMz8smEf1pOytRxSRs_YOhISxCj7NGDXXGgEHqk0PUNjY32ueJ1gl8suf9Zl9RX=N; .AspNetCore.Correlation.HuinByKFV3ei4OTXQW-1M3Oj3eFm5CcPZ8KW1Cd7-fw=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351253578636.MDk2Mzg5ZDYtOGE2NS00NjM1LWEwZjctYjMyMDk2Zjg5N2Y0OTJjMWZiYjItMmU5OC00NjgyLThiNzMtZmQwOGQzNmRkMGM1&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=7b4b7266-ba70-4226-ad9a-85eee84800a6&state=Om3b_5lSL6riv4VkDpc0oaZ2co7HP_HE_f5jodEpPMnQv_0ozYea903iNgOq169-6yzRuGWjI72JQNb3y5EUA93yVk10sbxVYJeK2VvaxYMnnjEojyYoDAqCXZm_C492t5MEmeltKCc-j2bgKZU3cGn8Y1vrY8zuDDBk2H8Rb-tyLmTCne-Hw--o4AgT5pa08qbGrTfs5EDpwjs_dMojOc8WWbBxBK9HNB4oMe31IFP7BR0np7lWvWftMpgAuDkviLeXvRfqRuUK6euArTM25ODSMpwfcAAh1tn1Mb2BrAvmBnQsNdF5bjs1bgaxaF9se9jy9BjSSI-LvsTKHOJ353cUS414uv6OxMYFhTYm2RI&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-z8zLowgC78I=AQABCQEAAABVrSpeuWamRam2jAF1XRQES7CVcJ0rU7bmKY3AfDvf--18DADE12BUG4_7gg3D5sX38CRBhGZMfhqwoI5r760q2t2yt91hJxpLmiTa3HVE5q2p6SFCGNNuP_IsdVD-EOMvK-pWm_K7CjXRlVY9PA8LhC-twx0IrNnTC0xFmzYUiCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-GHrgP2v8bQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_gIhzJ1Z38YwGIrzFOLlDpkVIsuwIOEzkwA0r9btZv9ppHKUOEkBSxPKMp_fmvgP3TGNycrIunTS9gsRJ_aAdenhUhBeIaAxr_2vdeLbbSXGfx3AAy82t63iTjvU1JvwbXHgGJr0buv7TEomnlZEuiAA; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-wZiyBCRKoU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEh1X8MQd6ktyF3OjKMfx1OvHNKLGgUDLBXiV4S25DOlErredG-HNc_lpQjSfoIh9LS_SRftV4CfJ4NPF90XbP4ueAYW-TIJahmDljgVZeDA3opz4AMx4e4HTGH5kHpKbD-G2_1TwfQqYtxDw6vSl9FSAA; esctx-eWpOYYCYfZM=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_9SDxSOraUUrvUu2fRRbToMdb7awa92hWw1KIoWxczFExgeb45EFz2zRTNjvuWZI7sLHGqnjByZFETXel0iBd3eNeFwbp-T_0CcLhXOZHyPQMt-IVy72bId51tJwi-EJC7OdEZttHUcidUjzSBIdviAA; esctx-YVIep8e7iLI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEjJFZ04KJsq3nhmzc09ooycaSGwysNUxJeCwFIBVZEdYg2x9IsPbzpBm18nDQZsU-xCoTrJGHDsGHW6hCLMbpD58fE4dk9rK93enlmdEdIyQatyI4Zr8lFku_OJEcWBH1SzYiKGyJZ7jlkZdxFnVlkSAA; esctx-0mQkj8ss2WU=AQABCQEAAABVrSpeuWamRam2jAF1XRQExWpP2_SywBy7fyQWPiNPyChDVc6T7uWIVUh0aSwk_k8B5Q6ywwn--LQi0f3iol3jLBg5ROVoKFsY_OdTwI78WYExBV923bFN2zYZfrG1QGBh6BvO0UVzB4pcqvCdA414mdjHTDvvCF5pt5matfp1TyAA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: prenniumofs.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://prenniumofs.com/?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9QAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=heMkpOn1NJvu; qPdM.sig=NS-F2Bb5GUkp7TqJtKDLpGSMpQg; ClientId=27ED18A864CE4D4A8BC70B9BFD00920F; OIDC=1; OpenIdConnect.nonce.v3.BpY5D279qWT0xxG69r_bhocmxkwQlpkI7TIU4ipFzxE=638785351184218920.78f0f12c-9a5f-4de8-87dd-ce39a7323fae; X-OWA-RedirectHistory=ArLym14BKPsOeeRr3Qg; esctx-axG3SNlyZt4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEettGtW5z8m2b0zaBEPH0MISmD_K4gUEPGxODX_iZWITC5AeY1cbXcJl2DBOW6Qd8UAQBgQ1sDHhGRSB-ZGI-w2sQCQg2yOAPzIF_5cQb778ogoflRWw79z9AOvc1YUDJMJlbdrse1S8fm_ObEOHErCAA; fpc=AhvX0dsukmtCpnrwoW5Dm2I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEAVaXV1t1dYJagAPhJzDRz8ZdF4rQ40nSysd5kPXzV5fwMIk3I9Cok-mlflkKLuelhe4klwfxUcr8jcGiB2sYHJq8IfPuvynG_VzOah2rt3olPcY4X9KggtFcj0bg3vzyzQi7-PFmG3rcYOiubiO-bBvZFI9lUqPCBc8j7aImuV4gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.HjXpQ6_xvsiIDVIrb7_kfGf__QaA4pdG9kSQZHZ6QsEQ14s5r0FzrYvr14MqsgQMSSB14PY4jZzWyp8yBK8znYWuRbN5m0Kztafv1Gr9oV73R8LNM7xm_dT8h2Lrj59_vY-yFb9a9zJ8GSZZeYw-vpqMNpg8VEcZ1mmcxvPzEsMhsE3IF9bE4Z09nq8PuHimvWQXPH4rXKm67A1qxJdds1iOC1lYoARUviC5CuP_lEnuNhPu52czaVlf2jcVXXXP=N; .AspNetCore.Correlation.9ZTANi4ua3onD-wDBZ6J04rY17dEJ9DzNSg4ckh2PJY=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351269733026.MTY1NjM4OWUtNWM2Ny00NmI5LWI4ZTItZWVjYTEzNDNkMTI2MTQzNmU4YjktMDg3MC00ZTQzLThlNWEtYjEwYmEyYmE2YWFh&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=cfe37ebe-2320-4cdc-b288-947cbe9ea5f5&state=XChcFws8fq9YwxARLEJsNy8obDW4rI2uNHAnvtctRHlJlratbr3XNBebhkGjM2UkAuee3iFHB5UVptf4KVw8Ry7XiurJtz5sjavkphi-4C2covM4lMdHeZw8l4H-QhrKWUiuHURsV2UCj5Mpixhehi42lTrz909FXN2Wwal9w7DMOl4Mp1-WLviSsmFu-vSNHv6wapS9YkUrifoxBzn4KsXCbX5NSTEqOmC2PaCilXvYgMiwkvcNRQAc7vUD17np4aJRrE_BZZKwkMG8SWkUuphcMVtLiVLoJJPoRRYF-aUt5PS_03YasXEZYlTwvZ_3N61JetCmdvunXdNNyHMTm4GK1NkYx3BG2qRtJwsRktA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-z8zLowgC78I=AQABCQEAAABVrSpeuWamRam2jAF1XRQES7CVcJ0rU7bmKY3AfDvf--18DADE12BUG4_7gg3D5sX38CRBhGZMfhqwoI5r760q2t2yt91hJxpLmiTa3HVE5q2p6SFCGNNuP_IsdVD-EOMvK-pWm_K7CjXRlVY9PA8LhC-twx0IrNnTC0xFmzYUiCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-GHrgP2v8bQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_gIhzJ1Z38YwGIrzFOLlDpkVIsuwIOEzkwA0r9btZv9ppHKUOEkBSxPKMp_fmvgP3TGNycrIunTS9gsRJ_aAdenhUhBeIaAxr_2vdeLbbSXGfx3AAy82t63iTjvU1JvwbXHgGJr0buv7TEomnlZEuiAA; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-wZiyBCRKoU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEh1X8MQd6ktyF3OjKMfx1OvHNKLGgUDLBXiV4S25DOlErredG-HNc_lpQjSfoIh9LS_SRftV4CfJ4NPF90XbP4ueAYW-TIJahmDljgVZeDA3opz4AMx4e4HTGH5kHpKbD-G2_1TwfQqYtxDw6vSl9FSAA; esctx-eWpOYYCYfZM=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_9SDxSOraUUrvUu2fRRbToMdb7awa92hWw1KIoWxczFExgeb45EFz2zRTNjvuWZI7sLHGqnjByZFETXel0iBd3eNeFwbp-T_0CcLhXOZHyPQMt-IVy72bId51tJwi-EJC7OdEZttHUcidUjzSBIdviAA; esctx-YVIep8e7iLI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEjJFZ04KJsq3nhmzc09ooycaSGwysNUxJeCwFIBVZEdYg2x9IsPbzpBm18nDQZsU-xCoTrJGHDsGHW6hCLMbpD58fE4dk9rK93enlmdEdIyQatyI4Zr8lFku_OJEcWBH1SzYiKGyJZ7jlkZdxFnVlkSAA; esctx-0mQkj8ss2WU=AQABCQEAAABVrSpeuWamRam2jAF1XRQExWpP2_SywBy7fyQWPiNPyChDVc6T7uWIVUh0aSwk_k8B5Q6ywwn--LQi0f3iol3jLBg5ROVoKFsY_OdTwI78WYExBV923bFN2zYZfrG1QGBh6Bv
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_layouts/15/AccessDenied.aspx?correlation=52168ea1%2D1031%2D8000%2D6a3d%2Da656b6c637d0 HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]; MicrosoftApplicationsTelemetryDeviceId=5dd84472-3eda-4b11-8b91-3f65645343b9; ai_session=5FAJA7uqP7lz2kd6cdF7s8\|1742938299091\|1742938299091; MSFPC=GUID=b504d534f9ad4157b071bed92b743a9f&HASH=b504&LV=202503&V=4&LU=1742938302625
Source: global traffic	HTTP traffic detected: GET /?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9Q HTTP/1.1Host: prenniumofs.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://06ce4a55.a65b244135035fa567d4d337.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=heMkpOn1NJvu; qPdM.sig=NS-F2Bb5GUkp7TqJtKDLpGSMpQg; ClientId=27ED18A864CE4D4A8BC70B9BFD00920F; OIDC=1; OpenIdConnect.nonce.v3.BpY5D279qWT0xxG69r_bhocmxkwQlpkI7TIU4ipFzxE=638785351184218920.78f0f12c-9a5f-4de8-87dd-ce39a7323fae; X-OWA-RedirectHistory=ArLym14BKPsOeeRr3Qg; esctx-axG3SNlyZt4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEettGtW5z8m2b0zaBEPH0MISmD_K4gUEPGxODX_iZWITC5AeY1cbXcJl2DBOW6Qd8UAQBgQ1sDHhGRSB-ZGI-w2sQCQg2yOAPzIF_5cQb778ogoflRWw79z9AOvc1YUDJMJlbdrse1S8fm_ObEOHErCAA; fpc=AhvX0dsukmtCpnrwoW5Dm2I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEAVaXV1t1dYJagAPhJzDRz8ZdF4rQ40nSysd5kPXzV5fwMIk3I9Cok-mlflkKLuelhe4klwfxUcr8jcGiB2sYHJq8IfPuvynG_VzOah2rt3olPcY4X9KggtFcj0bg3vzyzQi7-PFmG3rcYOiubiO-bBvZFI9lUqPCBc8j7aImuV4gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.tmVp_qNZKxNyxZwYrmnDi_5lGxkzTSADimjASAKXz0hn-iJhlmmpgPUBgUELMH8H8eLYH3IRKEqwPU6r3ukLFaSDHRx14JbHGllmC2n-egOIVzoi639X6eWZFCgbjM-2_3cSP3-H9OFheFd9_9BbZ8oTiF1F-rgKZWmlIA8dpUxSrwp7ndY9e90lrRg1G47SC9yR6dO52MC6Xs6S66cPB7qmVcqrMktzyby0AKZIagJAeohuaZ2h0iGz-TGgUyD1=N; .AspNetCore.Correlation._wx8Wz36R3q066uJxV8eDMOnhr9Cr7aUu1dZ-OaeUNw=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351460063035.Zjg2NGNmNmEtMTRmYi00MTcxLWIxZTEtN2YyNDBkZTUzNDk0YTAyY2FiZjAtZTU3ZS00YTZhLTk3MjAtZTIxZDhkMzFhNTI3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=0b067fb8-038f-4a95-bffa-93a89d300d07&state=Wqs_HrAxE1bsSGBtX8D7UkJFxq413a8B4dLuGF8HP57FhmTdhcY_wdtPQ4NtTwh_tOap1icUY5XFLqdbTvwV_zhRuNMVsM1i71s9jvQtDsCfTm6wnvxMmtVoi5l3kL6m3O8_w3Lub1OiNWrPjyFx2JpffDB1dILztGccI0xQ9BzJl4PqY02iedGRa_02URNml2hzzGr7oxLaIIC3uC0nYwYNLhyh0kvr7Rq-j7jgcoMg4y1qrl3P4vNt3VLPZWKEvAlwIBCTZhSygxoUXPU3M9yQEpKWtWh4RIqAI2X78oPDBwTD5bULmJ8XFw2YjXRMHOzKMS8hpImbITzLiu_7JhbYr2SNwp0SPAJIOoy_fZI&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-z8zLowgC78I=AQABCQEAAABVrSpeuWamRam2jAF1XRQES7CVcJ0rU7bmKY3AfDvf--18DADE12BUG4_7gg3D5sX38CRBhGZMfhqwoI5r760q2t2yt91hJxpLmiTa3HVE5q2p6SFCGNNuP_IsdVD-EOMvK-pWm_K7CjXRlVY9PA8LhC-twx0IrNnTC0xFmzYUiCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-GHrgP2v8bQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_gIhzJ1Z38YwGIrzFOLlDpkVIsuwIOEzkwA0r9btZv9ppHKUOEkBSxPKMp_fmvgP3TGNycrIunTS9gsRJ_aAdenhUhBeIaAxr_2vdeLbbSXGfx3AAy82t63iTjvU1JvwbXHgGJr0buv7TEomnlZEuiAA; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-wZiyBCRKoU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEh1X8MQd6ktyF3OjKMfx1OvHNKLGgUDLBXiV4S25DOlErredG-HNc_lpQjSfoIh9LS_SRftV4CfJ4NPF90XbP4ueAYW-TIJahmDljgVZeDA3opz4AMx4e4HTGH5kHpKbD-G2_1TwfQqYtxDw6vSl9FSAA; esctx-eWpOYYCYfZM=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_9SDxSOraUUrvUu2fRRbToMdb7awa92hWw1KIoWxczFExgeb45EFz2zRTNjvuWZI7sLHGqnjByZFETXel0iBd3eNeFwbp-T_0CcLhXOZHyPQMt-IVy72bId51tJwi-EJC7OdEZttHUcidUjzSBIdviAA; esctx-YVIep8e7iLI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEjJFZ04KJsq3nhmzc09ooycaSGwysNUxJeCwFIBVZEdYg2x9IsPbzpBm18nDQZsU-xCoTrJGHDsGHW6hCLMbpD58fE4dk9rK93enlmdEdIyQatyI4Zr8lFku_OJEcWBH1SzYiKGyJZ7jlkZdxFnVlkSAA; esctx-0mQkj8ss2WU=AQABCQEAAABVrSpeuWamRam2jAF1XRQExWpP2_SywBy7fyQWPiNPyChDVc6T7uWIVUh0aSwk_k8B5Q6ywwn--LQi0f3iol3jLBg5ROVoKFsY_OdTwI78WYExBV923bFN2zYZfrG1QGBh6BvO0UVzB4pcqvCdA414mdjHTDvvCF5pt5matfp1TyAA; esctx-hEVUhf6Ubto
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.a6-tvnOiDYGDgP-dOU1-CDRW7-ZIVsbYsDZJd4LVvoTdFaflo_6-1_DwwMQnb2yIbMrAMU2WdESJ5XULaG_Fhan5KpI77jDUXfhteKAtMgQlQ-o0qq8ZQYUnLKMyNCGHYwGoDMfY7Goa-ycAhC4lMRNVIUM8s9McrXNaKIoAId08_go0pBB_UXG53plypFlEt7Ur_jE6ZGqJ83MK4o_bUzHY62SklUb2WkdrN-v_62YfUrRLMAlcqqG9LznglwQY=N; .AspNetCore.Correlation.-ubZ3Jpjrfe1KWnY59_IN-kjWsjvtX1eLKl-1NMtUsY=N
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.a6-tvnOiDYGDgP-dOU1-CDRW7-ZIVsbYsDZJd4LVvoTdFaflo_6-1_DwwMQnb2yIbMrAMU2WdESJ5XULaG_Fhan5KpI77jDUXfhteKAtMgQlQ-o0qq8ZQYUnLKMyNCGHYwGoDMfY7Goa-ycAhC4lMRNVIUM8s9McrXNaKIoAId08_go0pBB_UXG53plypFlEt7Ur_jE6ZGqJ83MK4o_bUzHY62SklUb2WkdrN-v_62YfUrRLMAlcqqG9LznglwQY=N; .AspNetCore.Correlation.-ubZ3Jpjrfe1KWnY59_IN-kjWsjvtX1eLKl-1NMtUsY=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351469195374.ZDY0NDVlZDUtZDJmOS00ZDlmLWE2NTctYjFhNzlmN2RkYTY0NjQwYmQ5MmYtNDE0MS00YWRlLWJlOTQtNThmMjIwY2IyNzdk&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=f0f0b9d8-60e0-46ac-a7b3-8623b7187be6&state=dhUCWJ8pWMeG-mX4942_idIlM3GbUacw7Y1x3u2U7KooVT1i2eguD95yrUZWb0JGT432ewaUwInSjrsplSI2rC3fY9xzXOpf18QOlQLEsHqLJ1JHadqVbXh6F5orkOQbUVGGsFIz19dKldOHRdvzF85M8CRhzKl_QKy3Fo6cyemEwExYzhyMwh6wt5gAedVSbjMLgvU5nrp7iU7AAPXOxMAtQudWg-WTb81DNNo_YMX15Yb-qCWgZWX4iYSGV7PXghdt354N479_Y-84pJ38VEZKOrKG5-CRDbxgc-QiyPR5DdtNq3Q9n1GLJqYK6MxFQkLRHGcBtgCY3LN6IJ9_KWc1WbJnkDTj886LYKfynTg&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-z8zLowgC78I=AQABCQEAAABVrSpeuWamRam2jAF1XRQES7CVcJ0rU7bmKY3AfDvf--18DADE12BUG4_7gg3D5sX38CRBhGZMfhqwoI5r760q2t2yt91hJxpLmiTa3HVE5q2p6SFCGNNuP_IsdVD-EOMvK-pWm_K7CjXRlVY9PA8LhC-twx0IrNnTC0xFmzYUiCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-GHrgP2v8bQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_gIhzJ1Z38YwGIrzFOLlDpkVIsuwIOEzkwA0r9btZv9ppHKUOEkBSxPKMp_fmvgP3TGNycrIunTS9gsRJ_aAdenhUhBeIaAxr_2vdeLbbSXGfx3AAy82t63iTjvU1JvwbXHgGJr0buv7TEomnlZEuiAA; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-wZiyBCRKoU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEh1X8MQd6ktyF3OjKMfx1OvHNKLGgUDLBXiV4S25DOlErredG-HNc_lpQjSfoIh9LS_SRftV4CfJ4NPF90XbP4ueAYW-TIJahmDljgVZeDA3opz4AMx4e4HTGH5kHpKbD-G2_1TwfQqYtxDw6vSl9FSAA; esctx-eWpOYYCYfZM=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_9SDxSOraUUrvUu2fRRbToMdb7awa92hWw1KIoWxczFExgeb45EFz2zRTNjvuWZI7sLHGqnjByZFETXel0iBd3eNeFwbp-T_0CcLhXOZHyPQMt-IVy72bId51tJwi-EJC7OdEZttHUcidUjzSBIdviAA; esctx-YVIep8e7iLI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEjJFZ04KJsq3nhmzc09ooycaSGwysNUxJeCwFIBVZEdYg2x9IsPbzpBm18nDQZsU-xCoTrJGHDsGHW6hCLMbpD58fE4dk9rK93enlmdEdIyQatyI4Zr8lFku_OJEcWBH1SzYiKGyJZ7jlkZdxFnVlkSAA; esctx-0mQkj8ss2WU=AQABCQEAAABVrSpeuWamRam2jAF1XRQExWpP2_SywBy7fyQWPiNPyChDVc6T7uWIVUh0aSwk_k8B5Q6ywwn--LQi0f3iol3jLBg5ROVoKFsY_OdTwI78WYExBV923bFN2zYZfrG1QGBh6BvO0UVzB4pcqvCdA414mdjHTDvvCF5pt5matfp1TyAA; esctx-hEVUhf6Ubto
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351474413847.ZTM2ODUyY2EtMTBlNi00NmViLWExNmMtYjQ1ZjVlZmFiZmY5ZTMzMjk1ZWMtMjk4Yy00NmE2LWEzZjUtNTdjMmZkMjk4NzBk&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=0dc923a3-b023-4c43-98c5-b6550252d799&state=F_vvzhONKS45YigoA7wy3SNg8LawfyZSb2KYe6uKE8VJ-IWCRYks8AW6CCdqhvh_B6M3C72CEyGzHZVB1WnvdggdCWQqvRLE0JomDS03S6j595FzGGTBsCjcGGjX01DwMJYZU6KiUjnBly7UAlQugjMVrpSRpRhYpFyHzGCIBwiVAY88NteZDVvIYwZs9UsAdkFijzrwef0NOoCM1uiOmDqc8zXL-oswkDBGShulqwnjOTf-jiVyjmvE0Vd8gqmUZl9pWXpNE2Iged82zO7tQwBcEHF7AyOFYaMRfMGsnOQG3-PpC-6KdDDLgKtFSK6qMYmRzb-Ork6fMDPctZHorgrZrwl7x8lBQROzpW20H6o&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-z8zLowgC78I=AQABCQEAAABVrSpeuWamRam2jAF1XRQES7CVcJ0rU7bmKY3AfDvf--18DADE12BUG4_7gg3D5sX38CRBhGZMfhqwoI5r760q2t2yt91hJxpLmiTa3HVE5q2p6SFCGNNuP_IsdVD-EOMvK-pWm_K7CjXRlVY9PA8LhC-twx0IrNnTC0xFmzYUiCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-GHrgP2v8bQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_gIhzJ1Z38YwGIrzFOLlDpkVIsuwIOEzkwA0r9btZv9ppHKUOEkBSxPKMp_fmvgP3TGNycrIunTS9gsRJ_aAdenhUhBeIaAxr_2vdeLbbSXGfx3AAy82t63iTjvU1JvwbXHgGJr0buv7TEomnlZEuiAA; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-wZiyBCRKoU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEh1X8MQd6ktyF3OjKMfx1OvHNKLGgUDLBXiV4S25DOlErredG-HNc_lpQjSfoIh9LS_SRftV4CfJ4NPF90XbP4ueAYW-TIJahmDljgVZeDA3opz4AMx4e4HTGH5kHpKbD-G2_1TwfQqYtxDw6vSl9FSAA; esctx-eWpOYYCYfZM=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_9SDxSOraUUrvUu2fRRbToMdb7awa92hWw1KIoWxczFExgeb45EFz2zRTNjvuWZI7sLHGqnjByZFETXel0iBd3eNeFwbp-T_0CcLhXOZHyPQMt-IVy72bId51tJwi-EJC7OdEZttHUcidUjzSBIdviAA; esctx-YVIep8e7iLI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEjJFZ04KJsq3nhmzc09ooycaSGwysNUxJeCwFIBVZEdYg2x9IsPbzpBm18nDQZsU-xCoTrJGHDsGHW6hCLMbpD58fE4dk9rK93enlmdEdIyQatyI4Zr8lFku_OJEcWBH1SzYiKGyJZ7jlkZdxFnVlkSAA; esctx-0mQkj8ss2WU=AQABCQEAAABVrSpeuWamRam2jAF1XRQExWpP2_SywBy7fyQWPiNPyChDVc6T7uWIVUh0aSwk_k8B5Q6ywwn--LQi0f3iol3jLBg5ROVoKFsY_OdTwI78WYExBV923bFN2zYZfrG1QGBh6BvO0UVzB4pcqvCdA414mdjHTDvvCF5pt5matfp1TyAA; esctx-hEVUhf6Ubto
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.Vmhfiff8gplEJiKvS2b1JMlG26vDLHoL4mBp9si98OkIM-ymjMjoKtucLCok5x8jLijRwvFqzXgt8MkD0GJaDoYMrV13vk8EgmFWvTCNDOYzmnyV9DGxng8_CT-y3teN_uMidxXKSd5S4ddh4JdyV8xTXmsvRZoNeAqSzuLr_Tr3jYEz0HKUeaKp1mQGCTCxnSiX1tEC110VCm9Q5ytEdHI_ifiNAgjWmIsSptvGNyFDdlEMuiWOWyHxiBguRQNz=N; .AspNetCore.Correlation.DQXcB9rydrlDXoKDE7xJKuW4xoKHwStvLiw-cEcaUWY=N; .AspNetCore.OpenIdConnect.Nonce.9rkFHH1OU-StQrsS1xdY2zLOauGDBp04-FK6tjzBmk6G16C-tRa3tGPzBK2YNG5aSdCfB0q485EEWQRkTNaa95AcH5RJMFFJjmp5Zw4HBFS9k69IEFLgkpJNi1EjnSRESBxoi07YizTq4bDm54SrxKMgwHVujiYJRbiiA8Khjr73nov2hMI337iAhvrNwsOyOBvxh1vB0BezGfxHGo4OGNDSCUJ4HmaMG-t9LxyUXc_tCSUuOICVfIav5482EiKH=N; .AspNetCore.Correlation.E9KRQ7NCRrK5vkb-t0h6W1Iq34DKizQF4n-ogiHMhJg=N
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.A6NaKCS1kjogTCQoCT-Qr3Zont06Rk3KQv8jaWK3nujulM9w3USfxvBUPMNsjVq2L6an65fsWpTN_egb598AZssera7pnoGA3VFdlvOTd2k5MReSnt3_Pu0XLQafxo4PmKlMgkB1lpexeNIRU_PPbH8VxPNnYzHjySkmniEC8lmja-SchdX6fYS0KTNmAKAzfP0AEAvJ_tXShaarUGtULEyLPVv0orsrwuKYVvgC4QpDAltF3wnaqVEt5XixbSli=N; .AspNetCore.Correlation.-p8tUB5ZruJI1RZqEslDC0uPhaA2uFY7O0UHVpqDbb8=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351481116382.OWE5MGU0ODktZmZjYy00NTM2LTlmYTItZTY3M2I2NjM2OTMzZTRjN2JlNDItZDBhNy00OTE0LWJkNWYtZTIwOTIwZjkxZDQ3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=187674c7-24aa-4da0-8016-313301a1cf65&state=-J4laP7Nzg8tXHsSuObTf-92JyVLZaoKEEvisNKDsUNbIEMd1F2vNi_ETJglaObuA3Yvm6V7t1OG6wVDlmUog8l6HPV3a4kmv6KWO85q801Ge1lN5zmZW9j7niskKRNHhaYFDHRm-z-vCYK1dBfhdXlHmLC6mfdNd9ETSQpfq2KaD8CvT6RdDu07vZkj9oIx7ggAUemnhcmAAEWC7Ugdzuy5D-vZ1cSkUNO4-NdI2mccUCXlWzFxy4IQg2_Dsbhb80DnlOWMlGi5XEOiuBvNMr7NmNrjs3ktic9d3Rnr6nXFtHROI1paRhTljvJJ-d0ngjoJA1cOaiUbJssJEaIzTxtNCuzZACz0zjxxv26SW5o&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-z8zLowgC78I=AQABCQEAAABVrSpeuWamRam2jAF1XRQES7CVcJ0rU7bmKY3AfDvf--18DADE12BUG4_7gg3D5sX38CRBhGZMfhqwoI5r760q2t2yt91hJxpLmiTa3HVE5q2p6SFCGNNuP_IsdVD-EOMvK-pWm_K7CjXRlVY9PA8LhC-twx0IrNnTC0xFmzYUiCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-GHrgP2v8bQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_gIhzJ1Z38YwGIrzFOLlDpkVIsuwIOEzkwA0r9btZv9ppHKUOEkBSxPKMp_fmvgP3TGNycrIunTS9gsRJ_aAdenhUhBeIaAxr_2vdeLbbSXGfx3AAy82t63iTjvU1JvwbXHgGJr0buv7TEomnlZEuiAA; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-wZiyBCRKoU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEh1X8MQd6ktyF3OjKMfx1OvHNKLGgUDLBXiV4S25DOlErredG-HNc_lpQjSfoIh9LS_SRftV4CfJ4NPF90XbP4ueAYW-TIJahmDljgVZeDA3opz4AMx4e4HTGH5kHpKbD-G2_1TwfQqYtxDw6vSl9FSAA; esctx-eWpOYYCYfZM=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_9SDxSOraUUrvUu2fRRbToMdb7awa92hWw1KIoWxczFExgeb45EFz2zRTNjvuWZI7sLHGqnjByZFETXel0iBd3eNeFwbp-T_0CcLhXOZHyPQMt-IVy72bId51tJwi-EJC7OdEZttHUcidUjzSBIdviAA; esctx-YVIep8e7iLI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEjJFZ04KJsq3nhmzc09ooycaSGwysNUxJeCwFIBVZEdYg2x9IsPbzpBm18nDQZsU-xCoTrJGHDsGHW6hCLMbpD58fE4dk9rK93enlmdEdIyQatyI4Zr8lFku_OJEcWBH1SzYiKGyJZ7jlkZdxFnVlkSAA; esctx-0mQkj8ss2WU=AQABCQEAAABVrSpeuWamRam2jAF1XRQExWpP2_SywBy7fyQWPiNPyChDVc6T7uWIVUh0aSwk_k8B5Q6ywwn--LQi0f3iol3jLBg5ROVoKFsY_OdTwI78WYExBV923bFN2zYZfrG1QGBh6BvO0UVzB4pcqvCdA414mdjHTDvvCF5pt5matfp1TyAA; esctx-hEVUhf6Ubto
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351486269514.ZDUwNDdjY2ItYzAyMC00MTgzLTllNmYtMWI0MzI4ZTIzMWIwODBlNmU5M2QtOWE1NC00Y2NkLWFjMjYtOTczMDk0ZjE0MGQ4&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=eaf16e0d-e18c-4017-b463-28fee0b644b7&state=aIKPwBPLkukyrtQTE4Sq9vo9ba9ht6TvTXk1jsmnZtXsoLYwPgcKILPxjuhOxlG3eVcYApF9BlFosXGu6kX8A4yX-JxX_XBWPh7HxzITC0MF2U4qxKKAKqgyYKXE3CMcJ2_82C_50lS-znoLkJZN9ToYdx-_m8YZPE0vnTv_W8Hs73A62wnfCPkiuQ_Yy7GvMtHshmtFRRu0nsmj0_DCEPrEqN1Q8344oDZNfYpR1N-mwnjj9mYPEiBANzU_JZ91vjVsk1HBPHva1to9b2QH0VBQekCKvc1e9muoc8PzgGvdz8z61n42XWTfyq9obKZa-Yu0wASVtLOewMLdvFck_e7H-JLZWWP41TzBY2e6b4U&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-z8zLowgC78I=AQABCQEAAABVrSpeuWamRam2jAF1XRQES7CVcJ0rU7bmKY3AfDvf--18DADE12BUG4_7gg3D5sX38CRBhGZMfhqwoI5r760q2t2yt91hJxpLmiTa3HVE5q2p6SFCGNNuP_IsdVD-EOMvK-pWm_K7CjXRlVY9PA8LhC-twx0IrNnTC0xFmzYUiCAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-GHrgP2v8bQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_gIhzJ1Z38YwGIrzFOLlDpkVIsuwIOEzkwA0r9btZv9ppHKUOEkBSxPKMp_fmvgP3TGNycrIunTS9gsRJ_aAdenhUhBeIaAxr_2vdeLbbSXGfx3AAy82t63iTjvU1JvwbXHgGJr0buv7TEomnlZEuiAA; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-wZiyBCRKoU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEh1X8MQd6ktyF3OjKMfx1OvHNKLGgUDLBXiV4S25DOlErredG-HNc_lpQjSfoIh9LS_SRftV4CfJ4NPF90XbP4ueAYW-TIJahmDljgVZeDA3opz4AMx4e4HTGH5kHpKbD-G2_1TwfQqYtxDw6vSl9FSAA; esctx-eWpOYYCYfZM=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_9SDxSOraUUrvUu2fRRbToMdb7awa92hWw1KIoWxczFExgeb45EFz2zRTNjvuWZI7sLHGqnjByZFETXel0iBd3eNeFwbp-T_0CcLhXOZHyPQMt-IVy72bId51tJwi-EJC7OdEZttHUcidUjzSBIdviAA; esctx-YVIep8e7iLI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEjJFZ04KJsq3nhmzc09ooycaSGwysNUxJeCwFIBVZEdYg2x9IsPbzpBm18nDQZsU-xCoTrJGHDsGHW6hCLMbpD58fE4dk9rK93enlmdEdIyQatyI4Zr8lFku_OJEcWBH1SzYiKGyJZ7jlkZdxFnVlkSAA; esctx-0mQkj8ss2WU=AQABCQEAAABVrSpeuWamRam2jAF1XRQExWpP2_SywBy7fyQWPiNPyChDVc6T7uWIVUh0aSwk_k8B5Q6ywwn--LQi0f3iol3jLBg5ROVoKFsY_OdTwI78WYExBV923bFN2zYZfrG1QGBh6BvO0UVzB4pcqvCdA414mdjHTDvvCF5pt5matfp1TyAA; esctx-hEVUhf6Ubto
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.GudKEcZpF7I4ENjYgnzeTSJ_qI1Vw1P57zj841txu7M7-kBj7wRFp2VqK5jvOKAdri-t7-e5u_Tg8EKmKC9pFYEX05H3In8djA6-uJz_mD-8qnj32bnB9N_Kn7rUDagI01Au3RQpHJ5oKA3TjI_dgqZLzIx99CYc7PZd80zmp585ZAsD7CfYNliO4mZCraqHnDETMbfvh5_x1q1ZJsJCuFXQO6_YHcKTm7jx85M3-9Hi5mSaDU1yEhMsdwqW4u1F=N; .AspNetCore.Correlation.pUo7JDxm5MXLetxop39eCmIW5UU-ci1OgT9kuR1GkN4=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351498622424.ZmJlMjE1MDctZTUzMS00ZjBlLWI4YjktZjIzZWY5Yjc5YzAyNjg3NGRhMjUtMjlmMi00MWE4LThjMjYtMDFlN2NhYmNhYTg4&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=be6bf579-e380-4d7b-8cec-b9965e0d79fa&state=luVLeRimDgRPK1Fj9Z6ZLy_v8bvqq6g7_hokAvH6Lqg25vl093dWqMt45GUHqyYu_JUskQoymqtG9VQtt2FU1giX6ygYlObl4Cxm76d4jQtUKHt83b9WxoW767h8GvkNiQamnd_oTsJ_tvoEONzgIjLyFi_aqeDLaQzX0H8ixcRDGp9qM7V3F1Sa8spuxiMl7ReoPv_1E4bR9JVmVNIlL2J0qXGxjn2bhOAZ-ovqIcihqJT_Oqbw9Y9nwBLzxcEVXpiN0eg6OIEjSS4QzWGnk9fgUKbip6YO0NCDx5acVprgxb3T-mTxtwt4jPVuXhLn2CYrgkyY5r5UwY0awuwwLD8k20pa53Y2fvEGwBxDKXY&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-wZiyBCRKoU=AQABCQEAAABVrSpeuWamRam2jAF1XRQEh1X8MQd6ktyF3OjKMfx1OvHNKLGgUDLBXiV4S25DOlErredG-HNc_lpQjSfoIh9LS_SRftV4CfJ4NPF90XbP4ueAYW-TIJahmDljgVZeDA3opz4AMx4e4HTGH5kHpKbD-G2_1TwfQqYtxDw6vSl9FSAA; esctx-eWpOYYCYfZM=AQABCQEAAABVrSpeuWamRam2jAF1XRQE_9SDxSOraUUrvUu2fRRbToMdb7awa92hWw1KIoWxczFExgeb45EFz2zRTNjvuWZI7sLHGqnjByZFETXel0iBd3eNeFwbp-T_0CcLhXOZHyPQMt-IVy72bId51tJwi-EJC7OdEZttHUcidUjzSBIdviAA; esctx-YVIep8e7iLI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEjJFZ04KJsq3nhmzc09ooycaSGwysNUxJeCwFIBVZEdYg2x9IsPbzpBm18nDQZsU-xCoTrJGHDsGHW6hCLMbpD58fE4dk9rK93enlmdEdIyQatyI4Zr8lFku_OJEcWBH1SzYiKGyJZ7jlkZdxFnVlkSAA; esctx-0mQkj8ss2WU=AQABCQEAAABVrSpeuWamRam2jAF1XRQExWpP2_SywBy7fyQWPiNPyChDVc6T7uWIVUh0aSwk_k8B5Q6ywwn--LQi0f3iol3jLBg5ROVoKFsY_OdTwI78WYExBV923bFN2zYZfrG1QGBh6BvO0UVzB4pcqvCdA414mdjHTDvvCF5pt5matfp1TyAA; esctx-hEVUhf6Ubto=AQABCQEAAABVrSpeuWamRam2jAF1XRQEoodQEjCN7WIeDhWqhg9MEJkOYUZvTapEELe1t3ka2qNxyvVSVwlQn1UprpbxzZWxvDfPn92jeHCBtmge1jKA7ZNV-ZQyx0wkr4RKsp84N0sljYOPC1r59Evx02N7TI7roT3Uq8Vl8P_ze543DpiGzyAA; esctx-0yd0DtKc0vI=AQABCQEAAABVrSpeuWamRam2jAF1XRQE3Le05cRNmww9RSs3dirdzGLCSspqjaxrhHm4d2_rBGbSpDSdUhR4WURVQaeQeE-kwttUc8tzDMhLMAA9dOdjq7pQ19QvfaVEwFZvSnYB1YmYS0RXFZ9kSvuDl21ezXaJMkNQYb0oEMmGWEcdj5GwwCAA; esctx-dARGdn1UGQw
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.rGhaWu8iX8aIP4Dcp-X86TU5MWspirn_067kEZo5ZPDLxbOvZzjdWZzPWALt0vIzpuXq0zwT3-2F6W_dBUhPu7yY1cWnHnJ-igU9_pwOl0brsO0Wlkg8EQLLsbFVgUm4eWn7LDwa-dh7znWPAWWdhuPviv75sGyPsY5PUJrx96rpKosBgvboeKUYbEEPqI1ImSEBmHnRj-2Im2L5DwQClEDJnsKujY3zeUlYKVZvZdCFB3njgTS4STO6JH6Jvyu3=N; .AspNetCore.Correlation.cQsCxwsxJZBCIz5m68TJHpnI_ZQ13et7vP8uP3kwfPU=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351510414445.MzQ3MTI2ZjAtMDU4Mi00MzM1LTgzNGMtYmNmZDlkNzljZTMwMTFmNzc1ZDgtNTdiYi00NTg5LTgzODYtMjYxNWQ5YzJkNmVh&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=c904392d-a1a9-4480-ba3d-c890a8f93f53&state=peCnNKyjLVHuhEaLe3pETL5LF6Vjb9h2HcchYZ0S5wZ0e6OVm-wnFYL3qnyw4pdBZkda87qIIRkaRoNcNCNeF-OqDIzFvI40rgPl5NLs4vuBKuVkqK5Syv7wjXYmkYHTA8XmDvPhXF5xdxiZ0cgZONirHc92EDtf-3UB4jGMrNe0BezefhC8GTRpMbJcMsXcRMkmyX0RwL8kBcVSMTcPs3uw5n9ePArWyl6WkM-Vml22YQkZEudbFQT-FV_f-__aCmjlbNA5RvrVvHDBmaqjHD-8sJZtUbZN58XRBHTLxrhLN_a7lqDmfy44ne5j9Dr9QhaDcwSh1RqhDRJDWxUw5rm8QarUCy9KaeJhBpzzUqE&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-YVIep8e7iLI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEjJFZ04KJsq3nhmzc09ooycaSGwysNUxJeCwFIBVZEdYg2x9IsPbzpBm18nDQZsU-xCoTrJGHDsGHW6hCLMbpD58fE4dk9rK93enlmdEdIyQatyI4Zr8lFku_OJEcWBH1SzYiKGyJZ7jlkZdxFnVlkSAA; esctx-0mQkj8ss2WU=AQABCQEAAABVrSpeuWamRam2jAF1XRQExWpP2_SywBy7fyQWPiNPyChDVc6T7uWIVUh0aSwk_k8B5Q6ywwn--LQi0f3iol3jLBg5ROVoKFsY_OdTwI78WYExBV923bFN2zYZfrG1QGBh6BvO0UVzB4pcqvCdA414mdjHTDvvCF5pt5matfp1TyAA; esctx-hEVUhf6Ubto=AQABCQEAAABVrSpeuWamRam2jAF1XRQEoodQEjCN7WIeDhWqhg9MEJkOYUZvTapEELe1t3ka2qNxyvVSVwlQn1UprpbxzZWxvDfPn92jeHCBtmge1jKA7ZNV-ZQyx0wkr4RKsp84N0sljYOPC1r59Evx02N7TI7roT3Uq8Vl8P_ze543DpiGzyAA; esctx-0yd0DtKc0vI=AQABCQEAAABVrSpeuWamRam2jAF1XRQE3Le05cRNmww9RSs3dirdzGLCSspqjaxrhHm4d2_rBGbSpDSdUhR4WURVQaeQeE-kwttUc8tzDMhLMAA9dOdjq7pQ19QvfaVEwFZvSnYB1YmYS0RXFZ9kSvuDl21ezXaJMkNQYb0oEMmGWEcdj5GwwCAA; esctx-dARGdn1UGQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQEElUKLWUK9aKNn3Yxb9CXVjh-Fkz9bMsscdGDMXyydCsCBCxx-l3RjL6gpOHMUn8hjDKDHawIw45TjSSO3kAhM86ZabfgI86ca6oJd09hUxs2GvrPBq-w3KMvwnV867XBO2d0dFVKL0jBuEETcaH-FiAA; esctx-YE9YxjbOJM=AQABCQEAAABVrSpeuWamRam2jAF1XRQEMKpGLS2VM07TZhSHWhjUC9AjigkUoXmixCjyMp4v62k2k-2PNioUZfoNY4ES_AlKKe_-ee7MHAQHyTRze_t1F0DJ0zecpQyVQql6eYeXjA-R8AV
Source: global traffic	HTTP traffic detected: GET /?pp06xij46=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmY2xpZW50LXJlcXVlc3QtaWQ9ZDg5ZjQwNGUtODIzMi03MTRhLWM1ZGEtNmUxMzE3ZjBjODhlJnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODc4NTM1MTE4NDIxODkyMC43OGYwZjEyYy05YTVmLTRkZTgtODdkZC1jZTM5YTczMjNmYWUmc3RhdGU9RGN0QkVvQWdDRUJScmVrNHBJQUdIb2RSMmJicy1yRjRmX2R6U3VrTVI4ZzFrdVJoRmUzY0ViVVI2cUI2aTNwMXBBbkR1a05iVzBGbExaaWJod2tUdS0wYzcxWGV6OG9Q HTTP/1.1Host: prenniumofs.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://06ce4a55.a65b244135035fa567d4d337.workers.dev/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: qPdM=heMkpOn1NJvu; qPdM.sig=NS-F2Bb5GUkp7TqJtKDLpGSMpQg; ClientId=27ED18A864CE4D4A8BC70B9BFD00920F; OIDC=1; OpenIdConnect.nonce.v3.BpY5D279qWT0xxG69r_bhocmxkwQlpkI7TIU4ipFzxE=638785351184218920.78f0f12c-9a5f-4de8-87dd-ce39a7323fae; X-OWA-RedirectHistory=ArLym14BKPsOeeRr3Qg; esctx-axG3SNlyZt4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEettGtW5z8m2b0zaBEPH0MISmD_K4gUEPGxODX_iZWITC5AeY1cbXcJl2DBOW6Qd8UAQBgQ1sDHhGRSB-ZGI-w2sQCQg2yOAPzIF_5cQb778ogoflRWw79z9AOvc1YUDJMJlbdrse1S8fm_ObEOHErCAA; fpc=AhvX0dsukmtCpnrwoW5Dm2I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEAVaXV1t1dYJagAPhJzDRz8ZdF4rQ40nSysd5kPXzV5fwMIk3I9Cok-mlflkKLuelhe4klwfxUcr8jcGiB2sYHJq8IfPuvynG_VzOah2rt3olPcY4X9KggtFcj0bg3vzyzQi7-PFmG3rcYOiubiO-bBvZFI9lUqPCBc8j7aImuV4gAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-xK9X01DxLA=AQABCQEAAABVrSpeuWamRam2jAF1XRQEPFx17gFsZ9AyORI-KwnMhSqEImUHn5lwWuY6ODyX6J-_KbShp9_SdQuaceQipCVSOVOrIViOtJ0JLWscd0Kk7EA4htQ1w1hPLnPrkGenJTrJ69-v9vrFsIn9TTacKRyKEcGqpazeP3yhaVIOqBmGiyAA
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.RAJRRK2QorddOUCEYSsO-D2wBLR74_SHYAFSPIWZkrrz9a8wDtoUtxw5vH3FgGW-dl46JOaHPQ6SOpJ34TauvhpEixhJcqyfCYMrTPj17PAhWWguS2wvwyF4JEqH2j6TIGUTlIrvmyDhwYz-K8gUNcxzuDOSe9RXziyHvGntFtuC-aoAgKbmcMDS0-_fWPBcZs-OqwXEMK558pFZnPk6fah86CldpPPhmWIeq8uqdbTL77WiPIe-LjHQYVbQnEkl=N; .AspNetCore.Correlation.kw2XdizIgI-mjuu3nW1r7FvU9jM-K515BG9I1SbduUE=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351586817305.OTBmMzkzM2ItYzNiZS00MTJjLWE5NWYtNjYzNTM3ODJmZjU1MDdhOGRmZmQtYTM1YS00YWUxLThlNjItNDkyMDkwNGQ4NjYy&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=6a7e5169-cd59-414b-adb5-58eafa7c6b6a&state=yz5d26wahpaYMgLF3eG0lRyw6tJhFrFtIlRj4Du0hU8f4JVWn50JDN2KK60G3cdEa9bVe6w31GVnScG0_JHApmbGoCSmvYfp54xkA_iaPUGj249RB5OAoHziYD7WWQQrj_shLJVJscd2VN7f45hf3aX9e6sQdeRJFxT-bbDf3qNL_YTBS5vZyYVhZGU8PqA-RAPTlCfAua4fHrf8IJPCvuwoqktAVbKS9gNs92KEWJk0u9NREh5D7mRI5Iathw_VQhXmeda-97ymMPMuqye5v7BNPrNx8-dP41PpdnKPHfgTd3KpG9oOXClpwqH3gPCRNx7Mv8XeQ_0zHmq9NN9EFBDp4zKDphRV8GXgead3GrE&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-0mQkj8ss2WU=AQABCQEAAABVrSpeuWamRam2jAF1XRQExWpP2_SywBy7fyQWPiNPyChDVc6T7uWIVUh0aSwk_k8B5Q6ywwn--LQi0f3iol3jLBg5ROVoKFsY_OdTwI78WYExBV923bFN2zYZfrG1QGBh6BvO0UVzB4pcqvCdA414mdjHTDvvCF5pt5matfp1TyAA; esctx-hEVUhf6Ubto=AQABCQEAAABVrSpeuWamRam2jAF1XRQEoodQEjCN7WIeDhWqhg9MEJkOYUZvTapEELe1t3ka2qNxyvVSVwlQn1UprpbxzZWxvDfPn92jeHCBtmge1jKA7ZNV-ZQyx0wkr4RKsp84N0sljYOPC1r59Evx02N7TI7roT3Uq8Vl8P_ze543DpiGzyAA; esctx-0yd0DtKc0vI=AQABCQEAAABVrSpeuWamRam2jAF1XRQE3Le05cRNmww9RSs3dirdzGLCSspqjaxrhHm4d2_rBGbSpDSdUhR4WURVQaeQeE-kwttUc8tzDMhLMAA9dOdjq7pQ19QvfaVEwFZvSnYB1YmYS0RXFZ9kSvuDl21ezXaJMkNQYb0oEMmGWEcdj5GwwCAA; esctx-dARGdn1UGQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQEElUKLWUK9aKNn3Yxb9CXVjh-Fkz9bMsscdGDMXyydCsCBCxx-l3RjL6gpOHMUn8hjDKDHawIw45TjSSO3kAhM86ZabfgI86ca6oJd09hUxs2GvrPBq-w3KMvwnV867XBO2d0dFVKL0jBuEETcaH-FiAA; esctx-YE9YxjbOJM=AQABCQEAAABVrSpeuWamRam2jAF1XRQEMKpGLS2VM07TZhSHWhjUC9AjigkUoXmixCjyMp4v62k2k-2PNioUZfoNY4ES_AlKKe_-ee7MHAQHyTRze_t1F0DJ0zecpQyVQql6eYeXjA-R8AVu5uAFw7GuLhZWDjzODD4tbOwWaU0IJ4SpFUNMrCAA; esctx-cTUloMaRiTw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE5NpD20HO0CUKTrWkVEgfi9GueRF3BvFFPRsyeO9-JNavO96JioFXpaFEtf7mO_XU0AXS5OdWqkXD6ZAde1remW5YvfTbDYv0UsJUlsW7_nBjNgsSTkU6nsMSB-tDML4oP8VAMGO95e72wLK-gAzhryAA; esctx-0HggVCBMXw=
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.S-psFDlkTzchVCoBkZf2GVogMVOHBd0E8KF_IriNFhypCJLByk3o7QT38W2Ozq0VoyoEgGHvf9Px__r7yM09DabckUXsaJ5lfTdfFrCK-k2sqGZxBGuyWDhO-Mul-kAbYp7z2OcKaF9Nkot7kpsBXVlsUzZfZJK4UAjw5uSZIYmXFd0jLGVOpqB1xylpHlJ_HLR986IquAHxaLYg4P6wHq-LnGo1ulIOnfac5H-CvQUD5zOcNWC2_3w7BFDBdyQP=N; .AspNetCore.Correlation.P_E15KOL5-4gylp1xhXHiKtqbcSJOC96bK24afcWbQs=N
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.S-psFDlkTzchVCoBkZf2GVogMVOHBd0E8KF_IriNFhypCJLByk3o7QT38W2Ozq0VoyoEgGHvf9Px__r7yM09DabckUXsaJ5lfTdfFrCK-k2sqGZxBGuyWDhO-Mul-kAbYp7z2OcKaF9Nkot7kpsBXVlsUzZfZJK4UAjw5uSZIYmXFd0jLGVOpqB1xylpHlJ_HLR986IquAHxaLYg4P6wHq-LnGo1ulIOnfac5H-CvQUD5zOcNWC2_3w7BFDBdyQP=N; .AspNetCore.Correlation.P_E15KOL5-4gylp1xhXHiKtqbcSJOC96bK24afcWbQs=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351595900207.NTIzMTg5NWUtZGU0NC00Yzg5LWE3N2EtM2NlYjgyNmViZTMwMjM0NWIzNzUtYmE3Ni00OGZhLTk5MjAtZTVlYzU5NjA1NjJm&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=671a2ffd-a4e2-4a3e-a893-557586f49757&state=txjKri5gpIX542wo57-3P5-slwKknpgT39l0SEAzBS3CvoZ2wfpUn2DdEgDfA2GmghXRTlTs1m1tVEfvchr6zGO-FceDZCvGwwNyJpYUMrYZL6KZq08w7TaKuPw8O55M9F5itBrgnbmPWdurXyd5uC1aUFvQSE-NhtGqjnOv3dXX85M085Lrk9BkuPK0Xbkt5LpU8c-6oz16gwtYDrNn67l_Mw3hn1UpNInYo6AGin8Z39Fhj88G2Cvo4Z-_sbsXZVw5VOlSL0bLXvy-B-w9Zh62UH782hu0Z6tm1CTewkc12nVHvCGEoeCVxWEKvJhycgP60jnyacjfl2QI3e80CNHE0-Fnm6UKJ_CHUFCSK3I&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-hEVUhf6Ubto=AQABCQEAAABVrSpeuWamRam2jAF1XRQEoodQEjCN7WIeDhWqhg9MEJkOYUZvTapEELe1t3ka2qNxyvVSVwlQn1UprpbxzZWxvDfPn92jeHCBtmge1jKA7ZNV-ZQyx0wkr4RKsp84N0sljYOPC1r59Evx02N7TI7roT3Uq8Vl8P_ze543DpiGzyAA; esctx-0yd0DtKc0vI=AQABCQEAAABVrSpeuWamRam2jAF1XRQE3Le05cRNmww9RSs3dirdzGLCSspqjaxrhHm4d2_rBGbSpDSdUhR4WURVQaeQeE-kwttUc8tzDMhLMAA9dOdjq7pQ19QvfaVEwFZvSnYB1YmYS0RXFZ9kSvuDl21ezXaJMkNQYb0oEMmGWEcdj5GwwCAA; esctx-dARGdn1UGQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQEElUKLWUK9aKNn3Yxb9CXVjh-Fkz9bMsscdGDMXyydCsCBCxx-l3RjL6gpOHMUn8hjDKDHawIw45TjSSO3kAhM86ZabfgI86ca6oJd09hUxs2GvrPBq-w3KMvwnV867XBO2d0dFVKL0jBuEETcaH-FiAA; esctx-YE9YxjbOJM=AQABCQEAAABVrSpeuWamRam2jAF1XRQEMKpGLS2VM07TZhSHWhjUC9AjigkUoXmixCjyMp4v62k2k-2PNioUZfoNY4ES_AlKKe_-ee7MHAQHyTRze_t1F0DJ0zecpQyVQql6eYeXjA-R8AVu5uAFw7GuLhZWDjzODD4tbOwWaU0IJ4SpFUNMrCAA; esctx-cTUloMaRiTw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE5NpD20HO0CUKTrWkVEgfi9GueRF3BvFFPRsyeO9-JNavO96JioFXpaFEtf7mO_XU0AXS5OdWqkXD6ZAde1remW5YvfTbDYv0UsJUlsW7_nBjNgsSTkU6nsMSB-tDML4oP8VAMGO95e72wLK-gAzhryAA; esctx-0HggVCBMXw=AQABCQEAAABVrSpeuWamRam2jAF1XRQEM7rFWAdo61QFTNw7ghXg02lIDHNW0qjsdH3EZv5Y6-YJ3xe5z2fznrQC-JVPaLyk87bEUqgEJmq6zsZf9Kpl7WZ7-iLFuSL0sZsLTkUdX0EXVyebTW1zSDusNi_19mpbiQzgAnZLaJHU6GjlBn167iAA; esctx-Ifuf8SfwKyg=
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351600683312.ODhlM2ZlZTYtY2MzMy00YmUyLWE0ODItYmI0NGY0MGFmZWM4MTE5MTVlNjktYjY0OS00M2UyLWE1NTgtZjBmOGQwNWU2YzJi&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=57e9bbf8-37ce-4799-8046-c41ac062ef89&state=1GblaXw9RRkuaQna7sN1s1XygB012GUnyCazz98Yc4WiOPpVFbWw76Aw3k-5YegozZK9dxn05eetUWWx_B8C4WU6fOe-0ARAwg57hzF4f1xixtI1BkbePgH0UJPHNZBDaxEUyn_deOvuyN5hAncVukPi8zqM_nzhXrBWARH9gUJc_eWzXyFvKQZ6FFUNsASEdrc4Um3cyINWI4Kzbls5YY-s_cJlKU28h603ICs28AATM0lHtdZhojILT4rXzQezhttlLGfzszt9nupcS50-fg4HhzsS5NAkbq1-K-7COdeL64fIuZNZgBiBnWJy5CjGl9mSU4fIfLbJrj0UE2zdWs90EiDN2UV9ztHzmoofgLs&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-hEVUhf6Ubto=AQABCQEAAABVrSpeuWamRam2jAF1XRQEoodQEjCN7WIeDhWqhg9MEJkOYUZvTapEELe1t3ka2qNxyvVSVwlQn1UprpbxzZWxvDfPn92jeHCBtmge1jKA7ZNV-ZQyx0wkr4RKsp84N0sljYOPC1r59Evx02N7TI7roT3Uq8Vl8P_ze543DpiGzyAA; esctx-0yd0DtKc0vI=AQABCQEAAABVrSpeuWamRam2jAF1XRQE3Le05cRNmww9RSs3dirdzGLCSspqjaxrhHm4d2_rBGbSpDSdUhR4WURVQaeQeE-kwttUc8tzDMhLMAA9dOdjq7pQ19QvfaVEwFZvSnYB1YmYS0RXFZ9kSvuDl21ezXaJMkNQYb0oEMmGWEcdj5GwwCAA; esctx-dARGdn1UGQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQEElUKLWUK9aKNn3Yxb9CXVjh-Fkz9bMsscdGDMXyydCsCBCxx-l3RjL6gpOHMUn8hjDKDHawIw45TjSSO3kAhM86ZabfgI86ca6oJd09hUxs2GvrPBq-w3KMvwnV867XBO2d0dFVKL0jBuEETcaH-FiAA; esctx-YE9YxjbOJM=AQABCQEAAABVrSpeuWamRam2jAF1XRQEMKpGLS2VM07TZhSHWhjUC9AjigkUoXmixCjyMp4v62k2k-2PNioUZfoNY4ES_AlKKe_-ee7MHAQHyTRze_t1F0DJ0zecpQyVQql6eYeXjA-R8AVu5uAFw7GuLhZWDjzODD4tbOwWaU0IJ4SpFUNMrCAA; esctx-cTUloMaRiTw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE5NpD20HO0CUKTrWkVEgfi9GueRF3BvFFPRsyeO9-JNavO96JioFXpaFEtf7mO_XU0AXS5OdWqkXD6ZAde1remW5YvfTbDYv0UsJUlsW7_nBjNgsSTkU6nsMSB-tDML4oP8VAMGO95e72wLK-gAzhryAA; esctx-0HggVCBMXw=AQABCQEAAABVrSpeuWamRam2jAF1XRQEM7rFWAdo61QFTNw7ghXg02lIDHNW0qjsdH3EZv5Y6-YJ3xe5z2fznrQC-JVPaLyk87bEUqgEJmq6zsZf9Kpl7WZ7-iLFuSL0sZsLTkUdX0EXVyebTW1zSDusNi_19mpbiQzgAnZLaJHU6GjlBn167iAA; esctx-Ifuf8SfwKyg=
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.2SLXT6ljx7QgSw81AD9YozDiFkDuUXdklluFeyR73QrCqDM_LBmcwfncE703MVzQFz7uug9F8YVjZooehlKAR4CjXkNfAO95yv0HF2KThGb6DBD-x9OF4jbNCr1TR-gGEY5THkdly7QOGx9G4JMoAu69hMCRKRtfQLN3p92OHXUTzwUAeyBOCnNIcojwS8ATziwYDHqrKkzbH4S-XxLchIjXObtKmF1JrC_1RUzfXmGW01nAqF1yJ2zmpE0qWNGl=N; .AspNetCore.Correlation.HcfrOC7aS-M7roL9kcBYTERWcdCtoBWxzqoUyEC7LNM=N; .AspNetCore.OpenIdConnect.Nonce.LSil_wsQa36cyo9pvvHOX5Yp4t41op6qqILO5hrX0TxAhxMA1W7X6AnCynJpzvRFFPyXgWIMSbUMfI7Yc9hSnft5V5-tr5t-XzH7krDcavZGb2wCbE8JfEW27TbcGOpGBJrG8o2-K7xRqn7YtvPaHwNiZcLG1mxoNOE-uCPlLMrlTNxTNGO66cZvpMzBDBAy2hzkfeqQEmMrJCRrnHkh6LuCaLx2p83e9hhG-QDbqRLklrF3tDbaz8lcUDfQUiw3=N; .AspNetCore.Correlation.syTZUW1eQhdRJCuM-Uvl-jvkKmvNMKqX8e2cDGorzpo=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351607939929.MmMwNTA2ZjAtZmQ2ZS00OTZhLThlYTUtNzllMDMxNTI5MjYyMmNlYTNkMWMtZWRlYi00YzdlLThmZGMtODk1OWNmOTkxZGFi&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=3138ed4a-671e-4240-9609-18d4c7f10532&state=rXAjuQdDOYAOA-ItJOYT3sRO9ncsKUql8Pa_-UnlDIBhphMaPB69AZ4Elc0rmAkUoHX9BSfTuAXVWGiYodQTWNYx8_tYqPpAFrtvZ4ni-fRN2PdkD2fZbx_216bNX4Bavv8mHRSSp6HCekj0Et1-VgIugXsROl-gGJkvcEOul18b_0er9wF6jEU_6EK-Rvc7I1whLobZoh9SssPOkrHwayDdADTJ2KgQmF_osFGq0FUY_uwympLokiAieyZuzWN7niOGLKbqnuyBhrOCR0ZhyZCYsIDLUJKgpBGJde0BDGc8WW5JQm1waOUHrxPfZ4tAAsMKwEGTvIpbqu8AX8eQPENuEdzXwjys4twpzODotiM&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-0yd0DtKc0vI=AQABCQEAAABVrSpeuWamRam2jAF1XRQE3Le05cRNmww9RSs3dirdzGLCSspqjaxrhHm4d2_rBGbSpDSdUhR4WURVQaeQeE-kwttUc8tzDMhLMAA9dOdjq7pQ19QvfaVEwFZvSnYB1YmYS0RXFZ9kSvuDl21ezXaJMkNQYb0oEMmGWEcdj5GwwCAA; esctx-dARGdn1UGQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQEElUKLWUK9aKNn3Yxb9CXVjh-Fkz9bMsscdGDMXyydCsCBCxx-l3RjL6gpOHMUn8hjDKDHawIw45TjSSO3kAhM86ZabfgI86ca6oJd09hUxs2GvrPBq-w3KMvwnV867XBO2d0dFVKL0jBuEETcaH-FiAA; esctx-YE9YxjbOJM=AQABCQEAAABVrSpeuWamRam2jAF1XRQEMKpGLS2VM07TZhSHWhjUC9AjigkUoXmixCjyMp4v62k2k-2PNioUZfoNY4ES_AlKKe_-ee7MHAQHyTRze_t1F0DJ0zecpQyVQql6eYeXjA-R8AVu5uAFw7GuLhZWDjzODD4tbOwWaU0IJ4SpFUNMrCAA; esctx-cTUloMaRiTw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE5NpD20HO0CUKTrWkVEgfi9GueRF3BvFFPRsyeO9-JNavO96JioFXpaFEtf7mO_XU0AXS5OdWqkXD6ZAde1remW5YvfTbDYv0UsJUlsW7_nBjNgsSTkU6nsMSB-tDML4oP8VAMGO95e72wLK-gAzhryAA; esctx-0HggVCBMXw=AQABCQEAAABVrSpeuWamRam2jAF1XRQEM7rFWAdo61QFTNw7ghXg02lIDHNW0qjsdH3EZv5Y6-YJ3xe5z2fznrQC-JVPaLyk87bEUqgEJmq6zsZf9Kpl7WZ7-iLFuSL0sZsLTkUdX0EXVyebTW1zSDusNi_19mpbiQzgAnZLaJHU6GjlBn167iAA; esctx-Ifuf8SfwKyg=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs1dHi74U4dW3jJ6XYKe2LwVDn39Sl5v2UA4UeV8eT_ixo53L_HSg7MlsHhY9p8OYSzgcE22vQBXZ3WWZFOMEFJye6Ft0jYoY3tXJAFTY_EMNP9b2p1VY_ghiThuIXs1OK0mR13vcN135_Zw0C_Z35iAA; esctx-OIfAwmzTAAo=
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.W_wGCJTo0PAS-0oauy1NhRkKkyRais10Bqgv9jbmf1LugXIFNEvCcgDAiBEnNI8lszdY8Dppq-IEU4WzIC6YBRXgBulUYHGG_K2Tbszde7mwgwlmtIJQvqg5dHyrzkZD6UZZ4pRAr3v2PYUn_AQESzQsPBehfKzxGlP_v98SXjtIU4M9b-fUwVz79mpmsv9u1Q9V4s54CEQV1_cg_1O8a-W_8eszXo_lZbyh-5byTeLRsjx0bVxKCSG8LT1Kzu3R=N; .AspNetCore.Correlation.mHH1rUNZcYeuwg0jgWJ9CJEDh4S7C_5mD44Q_j-HJB4=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351613640534.YmExYTViMWYtZjgyZi00MTJmLWExMzUtZTI1MmU0Y2Q5NGM1NzIxZTIxNjYtYTA3OS00MDdkLWE3YTgtNjRkYzEzZTgxOGU0&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=de310938-8e91-4d83-85ac-020d3bb5c75f&state=wkpjYZQl1xv65xb9_G-s8dAr7BENrOacn_KVqZHeii5G4M4Db3VvcADKYenx_Y10Uc2EukkItisI1RdsG16zXM4E3gu6-U4KH5tj1e7fG_9jNpQ6pQAAbiGftNP_0F5JCZ1QMbjGs9xbk2gmlwGZyJL9uJ-xEG2TQ6H7a0dLfpnozUOt2qmSIIHq1fKn2RBWkO8KcuL0IeAY_VLdw6tSAJrDLnAmI7etFe3PhJXelSeND-J9QDvrperfFvATmMlfZ0CYshlwSBKH_YDkkTVFSWeXNXNcyafYOLKvQRA8UWQfQduBcPxN0RuY3hTHj3vOZCthnRJE6C_V8AP9OawKjJCQQN085itQKj-PeLp6Uko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-0yd0DtKc0vI=AQABCQEAAABVrSpeuWamRam2jAF1XRQE3Le05cRNmww9RSs3dirdzGLCSspqjaxrhHm4d2_rBGbSpDSdUhR4WURVQaeQeE-kwttUc8tzDMhLMAA9dOdjq7pQ19QvfaVEwFZvSnYB1YmYS0RXFZ9kSvuDl21ezXaJMkNQYb0oEMmGWEcdj5GwwCAA; esctx-dARGdn1UGQw=AQABCQEAAABVrSpeuWamRam2jAF1XRQEElUKLWUK9aKNn3Yxb9CXVjh-Fkz9bMsscdGDMXyydCsCBCxx-l3RjL6gpOHMUn8hjDKDHawIw45TjSSO3kAhM86ZabfgI86ca6oJd09hUxs2GvrPBq-w3KMvwnV867XBO2d0dFVKL0jBuEETcaH-FiAA; esctx-YE9YxjbOJM=AQABCQEAAABVrSpeuWamRam2jAF1XRQEMKpGLS2VM07TZhSHWhjUC9AjigkUoXmixCjyMp4v62k2k-2PNioUZfoNY4ES_AlKKe_-ee7MHAQHyTRze_t1F0DJ0zecpQyVQql6eYeXjA-R8AVu5uAFw7GuLhZWDjzODD4tbOwWaU0IJ4SpFUNMrCAA; esctx-cTUloMaRiTw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE5NpD20HO0CUKTrWkVEgfi9GueRF3BvFFPRsyeO9-JNavO96JioFXpaFEtf7mO_XU0AXS5OdWqkXD6ZAde1remW5YvfTbDYv0UsJUlsW7_nBjNgsSTkU6nsMSB-tDML4oP8VAMGO95e72wLK-gAzhryAA; esctx-0HggVCBMXw=AQABCQEAAABVrSpeuWamRam2jAF1XRQEM7rFWAdo61QFTNw7ghXg02lIDHNW0qjsdH3EZv5Y6-YJ3xe5z2fznrQC-JVPaLyk87bEUqgEJmq6zsZf9Kpl7WZ7-iLFuSL0sZsLTkUdX0EXVyebTW1zSDusNi_19mpbiQzgAnZLaJHU6GjlBn167iAA; esctx-Ifuf8SfwKyg=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs1dHi74U4dW3jJ6XYKe2LwVDn39Sl5v2UA4UeV8eT_ixo53L_HSg7MlsHhY9p8OYSzgcE22vQBXZ3WWZFOMEFJye6Ft0jYoY3tXJAFTY_EMNP9b2p1VY_ghiThuIXs1OK0mR13vcN135_Zw0C_Z35iAA; esctx-OIfAwmzTAAo=
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.CL5_KW36zAKxe0lFD1rOMPIgQICyHFhFxZIkSVGb1sdpRHoyieSSeaBF-IhUkwIIG7xJtNgqjxXm8od14yYXO7MfDKja6XbmvrjVYAUF8u4zTA8ztYfd5ZbowIZTLPNrtg8DRuf0JuKJUGL4f1Wzul3kckXH-ywv2NaRQw4gJQ-U_ylgXH7QTA8V6l8luEglEyjzlW-9btZSF9UWBjoRph5bXge8Hy0vsntSumWAcrrHYsFPYHetct73o9dkOA57=N; .AspNetCore.Correlation.AaCbsS-nGglrFX_jIdeJngE05iO2Vi0LLXLSkk5FXek=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351625553706.ZjNlMzQ3OTAtYzllMy00M2NkLWI4ZDctMTVmMGY5NGMzMzczZjA4ZTk1ODgtNWZkZS00ODE4LTk3MWYtMDA0ZmRmNTVhMzA4&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=0d59b80d-bbf9-494c-be32-8c35b2669de5&state=RMBOGC-iTvST3xiO-CS3yV5PSG-lros_218xK8a5Z1JqZ3IOulcEyzcUwJCuzaWORqKvOr5ddFvoYkx7N9cGIc3Vue6OLKA20cW2_TtuSjOTQ2EIhGEQpjTvH2NlqKbA457wImmxKbDyLmqYVxlCamZEBlmpk2W3ESAqhNtwz1_ebPhTMkH8PrqFWwf3fjzdK-kveFgmcy8gk7Fal5qCZopd0WBo_zWDyBQT62t6giUNqmka3it2BuRGkaO5_0E3V0LXQcH1oOB_zvXs-2mnNHbKUnrUd5S19Vn97MbwDNzmcfDJklD_OS_CbZt_QxQ2dm8cnDpM1_hwVAnp6drFoQWJE65vrbqvAlRbIeORsbY&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-YE9YxjbOJM=AQABCQEAAABVrSpeuWamRam2jAF1XRQEMKpGLS2VM07TZhSHWhjUC9AjigkUoXmixCjyMp4v62k2k-2PNioUZfoNY4ES_AlKKe_-ee7MHAQHyTRze_t1F0DJ0zecpQyVQql6eYeXjA-R8AVu5uAFw7GuLhZWDjzODD4tbOwWaU0IJ4SpFUNMrCAA; esctx-cTUloMaRiTw=AQABCQEAAABVrSpeuWamRam2jAF1XRQE5NpD20HO0CUKTrWkVEgfi9GueRF3BvFFPRsyeO9-JNavO96JioFXpaFEtf7mO_XU0AXS5OdWqkXD6ZAde1remW5YvfTbDYv0UsJUlsW7_nBjNgsSTkU6nsMSB-tDML4oP8VAMGO95e72wLK-gAzhryAA; esctx-0HggVCBMXw=AQABCQEAAABVrSpeuWamRam2jAF1XRQEM7rFWAdo61QFTNw7ghXg02lIDHNW0qjsdH3EZv5Y6-YJ3xe5z2fznrQC-JVPaLyk87bEUqgEJmq6zsZf9Kpl7WZ7-iLFuSL0sZsLTkUdX0EXVyebTW1zSDusNi_19mpbiQzgAnZLaJHU6GjlBn167iAA; esctx-Ifuf8SfwKyg=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs1dHi74U4dW3jJ6XYKe2LwVDn39Sl5v2UA4UeV8eT_ixo53L_HSg7MlsHhY9p8OYSzgcE22vQBXZ3WWZFOMEFJye6Ft0jYoY3tXJAFTY_EMNP9b2p1VY_ghiThuIXs1OK0mR13vcN135_Zw0C_Z35iAA; esctx-OIfAwmzTAAo=AQABCQEAAABVrSpeuWamRam2jAF1XRQEG45AZujM3pZHqYqe6lbgsw5CmUQ_hNvyBo3jB1Nuhh1zlVzlnMAK_V_IaeX_AJFuNK83oSvFix0ZIwo0vIEcLvc3ZKok8SgK-Kq8ApKKbbalyLHh0oniYzVmORxigr_XcwjoSo2mmFcjOOAuc7Bf3yAA; esctx-G7ee2mDAXbA=AQABCQEAAABVrSpeuWamRam2jAF1XRQENU-GUit-UqJZXmOk0cDZuGOVPG9BXoTiezGNiGd4gboHPAmwWH_CdmBQfqtHoCiL5TWaJ1iKMtU-Ce8wBsDgV_O4RnUfDcvwh4PqW7jg9prylNzmdw0T8HsPqTjEFWEYuYvFDfF1nGK-pwU1y2NDPCAA; esctx-3vgodXlSR3M=
Source: global traffic	HTTP traffic detected: GET /?auth=2 HTTP/1.1Host: www.office.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: OH.DCAffinity=OH-eus; OH.FLID=af1ed736-5ba8-499f-9a4d-d2ff117fdb5c; .AspNetCore.OpenIdConnect.Nonce.zF8Ww-Y0f-748tEnlu85FQeiydcOKKar1DhptgC793LW2tm66Dw4MD4-zyXP6tdVnXSTsH7HyFd-01S0DDqSuEM-nrxMANaq8V0D0eyrBPpBezX_l33TyeoKANq_4639zfyngozb4133UqHkVLbti4njhQHZSOcO_v2yfq23xRS-chRfdfpox8qcCvKprnMPsd2sHBpjJNqfuXWkkwes9gNCoQmUzx53xBQ43KwPUVZfH-6fmy3QG6FnXsxOBEmG=N; .AspNetCore.Correlation.RqWfSjSsXvt-6vNiy-A3-WhUkUXhU84GmFRT8RtHWNc=N
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351637172722.YjE3ZWI2NzQtOTg5Zi00ZjQ0LTg2NTYtMTcxNDc3NWZjNzRiMmU2ZmZiOGUtMDc4Yy00MmNmLTgyMDktNjA5ZDNhMzZhNTJh&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=5f274ece-d086-4613-ae04-d6a2c6d2e298&state=VEk34uaHatrLPjU-6upabpYhD3-1G6GWasjWH4OwRwBiEJnp6cpWABp8mKEWRyMx5VTLGaxYVO1tsIXxo6xDUGkY6gHatg2Crol2ZK4cKQBCDu3wEuHVK6LjH_TNfDWR3tCjoKIWUeCR8nR9I5jvJIc6fmqoeq0oqVIHP_auZw5zatYoznV8_ZsP4TDajGTVW3UTcZyCNpAF6evZzZ0JMefdA35gjPoFtlkzE_tQ7kuowM6981T9NO_QEI72QENptZ0ENOWzdr1FIBAVYydF0ve5hjXCK1RKgtlbvA61LE2eOznT1lzCftIm-t8YZWHeDWspv2GuRhBwBlwJnGGopwAtFJRn-G3TzMSg3rjFZgQ&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://prenniumofs.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; fpc=Aq1v4W_gQlRApKmgJFg1cAI; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEtJXR-4pZUvlCFjReylArH_uYsDCyoUdgL_HiLEH81-thFoNn_u3fPbdcvnxWipwTtuK_-IEsU-6zSWNhMidUAoSz6k-yTvHY1-oQdMbgRY5EA9G1bpAJ7IBqysHkpbEfV6XwFsVtPcvaynX8hbFSghg5gKbi4AULL0QfgD9m3l4gAA; esctx-0HggVCBMXw=AQABCQEAAABVrSpeuWamRam2jAF1XRQEM7rFWAdo61QFTNw7ghXg02lIDHNW0qjsdH3EZv5Y6-YJ3xe5z2fznrQC-JVPaLyk87bEUqgEJmq6zsZf9Kpl7WZ7-iLFuSL0sZsLTkUdX0EXVyebTW1zSDusNi_19mpbiQzgAnZLaJHU6GjlBn167iAA; esctx-Ifuf8SfwKyg=AQABCQEAAABVrSpeuWamRam2jAF1XRQEs1dHi74U4dW3jJ6XYKe2LwVDn39Sl5v2UA4UeV8eT_ixo53L_HSg7MlsHhY9p8OYSzgcE22vQBXZ3WWZFOMEFJye6Ft0jYoY3tXJAFTY_EMNP9b2p1VY_ghiThuIXs1OK0mR13vcN135_Zw0C_Z35iAA; esctx-OIfAwmzTAAo=AQABCQEAAABVrSpeuWamRam2jAF1XRQEG45AZujM3pZHqYqe6lbgsw5CmUQ_hNvyBo3jB1Nuhh1zlVzlnMAK_V_IaeX_AJFuNK83oSvFix0ZIwo0vIEcLvc3ZKok8SgK-Kq8ApKKbbalyLHh0oniYzVmORxigr_XcwjoSo2mmFcjOOAuc7Bf3yAA; esctx-G7ee2mDAXbA=AQABCQEAAABVrSpeuWamRam2jAF1XRQENU-GUit-UqJZXmOk0cDZuGOVPG9BXoTiezGNiGd4gboHPAmwWH_CdmBQfqtHoCiL5TWaJ1iKMtU-Ce8wBsDgV_O4RnUfDcvwh4PqW7jg9prylNzmdw0T8HsPqTjEFWEYuYvFDfF1nGK-pwU1y2NDPCAA; esctx-3vgodXlSR3M=AQABCQEAAABVrSpeuWamRam2jAF1XRQEsvjjp-_cmzB9YydhL-Ie1SbbcTm1RzFDu2P7e2nAOK3bcp41IaNgte4v9ADf3dZn6OstRe8QtHfNHAWO61pdqZjJyyDDOK3Ilma2MV-JZ0uXYbMy8oK-vyXXZgrSCAvF0xsCjtxxaipO_yiX6FE63yAA; esctx-8fWEAOQ1mo=AQABCQEAAABVrSpeuWamRam2jAF1XRQEQTqqEFxky9oBqZEotj2nO-K6lo0oA-rVJGUIFY6yCV_qjD4jh2nHsygKZq0Y2wNUMeJdKv9Koh0wA1m3ELeVzqDB_fLWe4yqO05ahojAc5XQ56lT
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX%2FThe%20Team%20Training%20Institute%2FThe%20Team%20Training%20Institute%2Epdf&View=2e747267-bfec-4d2b-a8d2-5a05d65ee605&TryNewExperienceSingle=TRUE HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]; MicrosoftApplicationsTelemetryDeviceId=5dd84472-3eda-4b11-8b91-3f65645343b9; ai_session=5FAJA7uqP7lz2kd6cdF7s8\|1742938299091\|1742938299091; MSFPC=GUID=b504d534f9ad4157b071bed92b743a9f&HASH=b504&LV=202503&V=4&LU=1742938302625
Source: global traffic	HTTP traffic detected: GET /personal/kellieblack_thetti_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX%2FThe%20Team%20Training%20Institute&View=2e747267-bfec-4d2b-a8d2-5a05d65ee605&TryNewExperienceSingle=TRUE HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; FeatureOverrides_experiments=[]; MicrosoftApplicationsTelemetryDeviceId=5dd84472-3eda-4b11-8b91-3f65645343b9; MSFPC=GUID=b504d534f9ad4157b071bed92b743a9f&HASH=b504&LV=202503&V=4&LU=1742938302625; ai_session=5FAJA7uqP7lz2kd6cdF7s8\|1742938299091\|1742938371820

Source: global traffic	DNS traffic detected: DNS query: thetti-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: config.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: 577cf093c99335aac213bf037bd04ff3.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: outlook.office.com
Source: global traffic	DNS traffic detected: DNS query: tr-ooc-atm.office.com
Source: global traffic	DNS traffic detected: DNS query: upload.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: eastus1-mediap.svc.ms
Source: global traffic	DNS traffic detected: DNS query: 06ce4a55.a65b244135035fa567d4d337.workers.dev
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: homeoillcompany.net
Source: global traffic	DNS traffic detected: DNS query: prenniumofs.com
Source: global traffic	DNS traffic detected: DNS query: www.office.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net

Source: unknown

HTTP traffic detected: POST /personal/kellieblack_thetti_com/_api/v2.1/graphql HTTP/1.1Host: thetti-my.sharepoint.comConnection: keep-aliveContent-Length: 507X-ServiceWorker-Strategy: CacheFirstsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36accept: application/json;odata=verbosesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/json;odata=verbosesec-ch-ua-mobile: ?0Origin: https://thetti-my.sharepoint.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkellieblack_thetti_com%2FDocuments%2FView%20OneDrive%20eFAX&ga=1Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: no-cache, no-storePragma: no-cacheContent-Length: 59Content-Type: application/jsonExpires: -1P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; path=/; SameSite=None; secure; HttpOnlyX-NetworkStatistics: 0,4194720,0,0,1264498,525568,525568,6996X-SharePointHealthScore: 2X-VroomVersion: 2.0IsOCDI: 0X-DataBoundary: NONEX-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/SPRequestGuid: 44168ea1-5091-8000-6a3d-a383fbbcc53erequest-id: 44168ea1-5091-8000-6a3d-a383fbbcc53eMS-CV: oY4WRJFQAIBqPaOD+7zFPg.0Alt-Svc: h3=":443";ma=86400Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=67bb197b-b9fb-4d1d-bdea-510c010d61e6&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=161.77.13.0"}]}NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}Strict-Transport-Security: max-age=31536000X-FRAME-OPTIONS: SAMEORIGINContent-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com;SPRequestDuration: 77SPIisLatency: 3X-Powered-By: ASP.NETMic
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: no-cache, no-storePragma: no-cacheContent-Length: 59Content-Type: application/jsonExpires: -1P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhjMGM4OTgyODZlYmJhYTE0YWE4ZmNlNGE1Y2ZiNjBmZjVhYTNiYzk2ZWZhOGYwYWUyZjNkMmEyZDA2NGI0YjIsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMiwxMzM4NzQxMjE2NTAwMDAwMDAsMCwxMzM4NzQ5ODI2NTM2MjYzNTQsMC4wLjAuMCwyNTgsNjdiYjE5N2ItYjlmYi00ZDFkLWJkZWEtNTEwYzAxMGQ2MWU2LCwsM2U2MDZjYjQtYmM4NS00ZjcwLWE3ODUtYThkOWZhZGYxNWM2LDNlNjA2Y2I0LWJjODUtNGY3MC1hNzg1LWE4ZDlmYWRmMTVjNixzKzV6NHgxMU9FU0xpQzkzOVJuYnZBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NjgsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLEd4cThZam5hRXZGZEkramd2NUlwNFlHQTNaUEkzdFU1NTJUZVN2SnJiK0drZHZWZXdNbnFQRkcxNUZSTXZ6SlNUKzNpUzI0NGdadkdSYU5vUGNYOWY4Y25oK3JBU2N1TFQ5U3V3Q1FhbXJ3d0U3c3Buc1MvQ1lOU2oxUzNWaUJSU0VOWURPSzdLQi9ybCt1YlJkV1pFYUtNTjZBNmJlMFlrWEhueWFST2N2ZlU4N3FhaXlhOEpMR0NjeWdLbDVnTERHeDlncHZnMGIzcytheXEvM1RFWjhoRENNMTZkTHNseHZHSXZqc0V3REk2RStCWHR3b1N5MkY5cC93WE9PUUM2dEl1cTlnci9XQzRVQmdBOWJBVHdJSkZrWktWUERqZDRpR3lqYVdENHpYVE9VQTBDNmdDUzFlNTVIaUJ0a1lvenVaUWxtZHhiRW1LNkx0YXZPTlZhdz09PC9TUD4=; path=/; SameSite=None; secure; HttpOnlyX-NetworkStatistics: 0,8389440,20,5,1968086,2102272,2102272,7423X-SharePointHealthScore: 3X-VroomVersion: 2.0IsOCDI: 0X-DataBoundary: NONEX-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/SPRequestGuid: 4b168ea1-60bb-8000-6a3d-a498ffee0dacrequest-id: 4b168ea1-60bb-8000-6a3d-a498ffee0dacMS-CV: oY4WS7tgAIBqPaSY/+4NrA.0Alt-Svc: h3=":443";ma=86400Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=67bb197b-b9fb-4d1d-bdea-510c010d61e6&destinationEndpoint=Edge-Prod-EWR31r5b&frontEnd=AFD&RemoteIP=161.77.13.0"}]}NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}Strict-Transport-Security: max-age=31536000X-FRAME-OPTIONS: SAMEORIGINContent-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com;SPRequestDuration: 71SPIisLatency: 3X-Powered-By: ASP.NET

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50851
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50625
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50627
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50620
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 50646 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50513
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50515
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50635
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50519
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50196
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50632
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50510
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 50601 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50523
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50528
Source: unknown	Network traffic detected: HTTP traffic on port 50555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50527
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50641
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50640
Source: unknown	Network traffic detected: HTTP traffic on port 50354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 50510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 50365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50373
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50372
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50375
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50374
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50495
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50497
Source: unknown	Network traffic detected: HTTP traffic on port 50353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50379
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50381
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50270
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 50497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 50329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50714
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 50842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 50307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50601
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50551 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50603
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50602
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50604
Source: unknown	Network traffic detected: HTTP traffic on port 50528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50848
Source: unknown	Network traffic detected: HTTP traffic on port 50375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50840
Source: unknown	Network traffic detected: HTTP traffic on port 50539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50290
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 50850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50211
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50353
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50354
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 50379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50367
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50250
Source: unknown	Network traffic detected: HTTP traffic on port 50218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50539
Source: unknown	Network traffic detected: HTTP traffic on port 50296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50533
Source: unknown	Network traffic detected: HTTP traffic on port 50338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50653
Source: unknown	Network traffic detected: HTTP traffic on port 50745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50668 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50668
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50549
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50663
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50543
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50664
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 50367 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 50663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 50250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50625 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50316
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50551
Source: unknown	Network traffic detected: HTTP traffic on port 50653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50555
Source: unknown	Network traffic detected: HTTP traffic on port 50519 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50328
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50329
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 50372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50602 -> 443

Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.100:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.136.13:443 -> 192.168.2.16:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.101.65.162:443 -> 192.168.2.16:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.101.65.210:443 -> 192.168.2.16:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.97.190.18:443 -> 192.168.2.16:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.96.157.114:443 -> 192.168.2.16:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.98.71.210:443 -> 192.168.2.16:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.96.111.82:443 -> 192.168.2.16:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.163:443 -> 192.168.2.16:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.138.10:443 -> 192.168.2.16:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.16:50176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.16:50177 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:50191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.16:50201 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.16:50203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.45.177.71:443 -> 192.168.2.16:50253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.45.177.71:443 -> 192.168.2.16:50263 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.45.177.71:443 -> 192.168.2.16:50264 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.45.177.71:443 -> 192.168.2.16:50265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.45.177.71:443 -> 192.168.2.16:50270 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.9.156:443 -> 192.168.2.16:50290 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.157.1:443 -> 192.168.2.16:50296 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.152.21:443 -> 192.168.2.16:50301 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.152.21:443 -> 192.168.2.16:50362 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.201.174:443 -> 192.168.2.16:50367 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.201.134:443 -> 192.168.2.16:50364 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.33.44.234:443 -> 192.168.2.16:50366 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.235.187:443 -> 192.168.2.16:50365 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.33.44.234:443 -> 192.168.2.16:50374 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.16:50704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.201.134:443 -> 192.168.2.16:50850 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6992_38579456

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6992_38579456

Source: classification engine

Classification label: mal68.phis.win@26/871@78/398

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,18348228627803180148,13274248836850029492,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://thetti-my.sharepoint.com/:f:/p/kellieblack/EtssBivICL5BgQEDfbETZP4BZsoHTOyxYMnSj46dgeiAiA?e=0t2fdm"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,18348228627803180148,13274248836850029492,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: Chrome Cache Entry: 2834

Jump to dropped file

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://thetti-my.sharepoint.com/:f:/p/kellieblack/EtssBivICL5BgQEDfbETZP4BZsoHTOyxYMnSj46dgeiAiA?e=0t2fdm	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkellieblack_thetti_com%2FDocuments%2FView%20OneDrive%20eFAX&ga=1	0%	Avira URL Cloud	safe
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_api/v2.1/graphql	0%	Avira URL Cloud	safe
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_api/v2.0/sites/root/lists/%7B251f106c-7fed-4015-beb4-5d512f9d2933%7D/subscriptions/socketIo?listItemIds=	0%	Avira URL Cloud	safe
https://thetti-my.sharepoint.com/_layouts/15/images/BLANK.gif	0%	Avira URL Cloud	safe
https://thetti-my.sharepoint.com/_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D	0%	Avira URL Cloud	safe
https://thetti-my.sharepoint.com/_layouts/15/images/odbfavicon.ico?rev=47	0%	Avira URL Cloud	safe
https://thetti-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx	0%	Avira URL Cloud	safe
https://thetti-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&compWWFlow=true&atomic=true&g=0&l2=true	0%	Avira URL Cloud	safe
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_api/v2.0/sites/%7B27a899a8-7938-42bd-99eb-b0bab83aa62e%7D/lists/%7B251f106c-7fed-4015-beb4-5d512f9d2933%7D/items/delta?token=latest	0%	Avira URL Cloud	safe
https://outlook.office.com/apc/trans.gif?f6240cb4595a7b3f1b2e60524dbf5c6b	0%	Avira URL Cloud	safe
https://outlook.office.com/apc/trans.gif?c95f98c2620b57f9c74ccc331663749a	0%	Avira URL Cloud	safe
https://thetti-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx?odsp-web-prod_2025-03-14.003	0%	Avira URL Cloud	safe
https://577cf093c99335aac213bf037bd04ff3.fp.measure.office.com/apc/trans.gif?2cf1341cd8578a147a22f2e5ed268e48	0%	Avira URL Cloud	safe
https://577cf093c99335aac213bf037bd04ff3.fp.measure.office.com/apc/trans.gif?d6643879af4bbc192dd407eb3f326bb2	0%	Avira URL Cloud	safe
https://tr-ooc-atm.office.com/apc/trans.gif?207fbef8cf1419be89a5c7d66785703d	0%	Avira URL Cloud	safe
https://upload.fp.measure.office.com/r.gif?MonitorID=O365se&rid=0d1486cd1309b55df31c49718a177db6&w3c=true&prot=https:&v=20190214&tag=[{%22TenantId%22:%2267bb197b-b9fb-4d1d-bdea-510c010d61e6%22,%22AppId%22:%22Documents%22}]&DATA=[{%22RequestID%22:%22577cf093c99335aac213bf037bd04ff3%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1059,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22HEL%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22577cf093c99335aac213bf037bd04ff3%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:992,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22HEL%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22outlook.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:615,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22MNZ%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22outlook.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:506,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22MNZ%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22tr-ooc-atm.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1390,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22XSP%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22tr-ooc-atm.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:1289,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22XSP%22,%22Fe%22:%22cafe%22}]	0%	Avira URL Cloud	safe
https://tr-ooc-atm.office.com/apc/trans.gif?cde5938419387b82555cd0ce535ad7e1	0%	Avira URL Cloud	safe
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_api/SP.OAuth.Token/Acquire()	0%	Avira URL Cloud	safe
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_api/v2.0/sites/root/lists/251f106c-7fed-4015-beb4-5d512f9d2933/subscriptions/socketIo?listItemIds=	0%	Avira URL Cloud	safe
https://eastus1-mediap.svc.ms/transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fthetti-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!qJmoJzh5vUKZ67C6uDqmLttcl3WmwwJDi3S0jR8-POZsEB8l7X8VQL60XVEvnSkz%2Fitems%2F01LRXEEZPWYVH44HBFHRD3A5VPOQ4OHOZK%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiIyN2E4OTlhOC03OTM4LTQyYmQtOTllYi1iMGJhYjgzYWE2MmUiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvdGhldHRpLW15LnNoYXJlcG9pbnQuY29tQDY3YmIxOTdiLWI5ZmItNGQxZC1iZGVhLTUxMGMwMTBkNjFlNiIsImV4cCI6IjE3NDI5NTgwMDAifQ.CiMKCXNoYXJpbmdpZBIWcys1ejR4MTFPRVNMaUM5MzlSbmJ2QQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjqjDsQARoMMTYxLjc3LjEzLjIwIhRtaWNyb3NvZnQuc2hhcmVwb2ludCosMFltNXAyWTdwWXVneHAxUk4xb3loM01HL2VFSHVYNnpuUC9Ccmx3U01jTT0wdDgBShBoYXNoZWRwcm9vZnRva2VuYgR0cnVlcmEwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiM4YzBjODk4Mjg2ZWJiYWExNGFhOGZjZTRhNWNmYjYwZmY1YWEzYmM5NmVmYThmMGFlMmYzZDJhMmQwNjRiNGIyegEwwgFhMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMg.NxyFVvkpxZDVVvxCgD8gZs59G2b_eSsIvLBBeqT_qG4&cTag=%22c%3A%7BCE4FC5F6-251C-473C-B076-AF7438E3BB2A%7D%2C1%22	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/9261846f8cb01819/1742938310201/t9vKYmGlrHEaDQ8	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/aipxs/0x4AAAAAABB9-Qwz2OYAulMj/auto/fbE/new/normal/auto/	0%	Avira URL Cloud	safe
https://06ce4a55.a65b244135035fa567d4d337.workers.dev/favicon.ico	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/9261846f8cb01819/1742938310202/3fa0190395472dccb51714b4ba1003c5355923c5f11893ea31e79bc49baaffdf/miMwmXvjywmPqp7	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=9261846f8cb01819&lang=auto	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351224162088.MTM0ODA0YzktMzlkNy00ZTBhLWE3NmUtZjUyOGYwZjIwY2U1MjI3MzU4YzMtM2JmYy00M2VlLWIxZjktZDIwNTViMzllN2Yw&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=c95536ba-6816-4f2f-811d-f207c32911ea&state=Sx3DslR2sMvPEzFnislbOttKEKNq13VmFAWUT_jpZOiN8wWmSbP8RsyGj1CQVy5TbLvXTC8L-eF_iFhJ0ne7CWetjdaoa-ZjOu4OgFTAOpNwZQqf9N13C47EhTo5Xt4tqNBFllDGD9WN8Fte-JT4R4WVerYp0BeDvXnRmPsvCcxJOCJKR5X3cARnTCAU6z_5SateydS_G3aqgMzHEzvbXdfcKH4yAIBwXlVK-ockauTJuKNR-SRb1Hz4jYU49KYqdEuixJxocbUTTXG5-laYwE6qw8RNncq2uQqltRHkDPSCYM57DwnQ__OP8a393XdLTX4OiiaKLwzPCZN5N3VGSKCFxJm1zQe0yY-G2JxCV58&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351219094033.YTc0MzAyMDEtODEzMi00ZjcyLTk4MGYtM2IwMjM5NjQwZTI1NjZkZDk5MjQtNzdlYy00ZTMwLTkxMmEtMzNhMjE1Njc4ZDM0&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=03b1531c-b237-4731-933e-b8c01a6f1b85&state=rLzi6I99XMxH8mXU0NiaRy7Cx7qDAX9zhHtTlOs7u24JkdvrYVYtjxbLBwiNXqBffQidaH0S6oFHXX1fCzxaAZYMcb5anWia8fh-JyAwEzAC4prdOHVxVIHk0sdPO5z3i6GRXOGMhd3i21e2u_v88TQFksqfDqBo7u82JzZMbTTkkkfOnJJ6WVj2INPkkrythmp1EW3zE7xXabrDqxVCeQfWJ-jefla6m028sVwQI1eWsbsUU6I9F3aAdt1YAN7mLdhOK_ts9AV4xuFQD1hT6IO1JLqUbSNbyxk6m14Vrp7ddBWvfuQj-9d2LK6kGF-vUtKNsMHi5xXiqqOSzt7U5HhDXG48jXv-j9kZN_diRL8&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://m365cdn.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EDISON&ASN=20940&Country=US&Region=NJ&RequestIdentifier=0.e89d2e17.1742938326.1bec0dd6&TotalRTCDNTime=93&CompressionType=gzip&FileSize=1391	0%	Avira URL Cloud	safe
https://spo.nel.measure.office.net/api/report?tenantId=67bb197b-b9fb-4d1d-bdea-510c010d61e6&destinationEndpoint=Edge-Prod-EWR31r5b&frontEnd=AFD&RemoteIP=161.77.13.0	0%	Avira URL Cloud	safe
https://prenniumofs.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3ByZW5uaXVtb2ZzLmNvbS8iLCJkb21haW4iOiJwcmVubml1bW9mcy5jb20iLCJrZXkiOiJoZU1rcE9uMU5KdnUiLCJxcmMiOm51bGwsImlhdCI6MTc0MjkzODMxNywiZXhwIjoxNzQyOTM4NDM3fQ.P_k4EmNZRTs0QHbG5vOvxBlkhgxdXjA9viXvzLI6NkY	0%	Avira URL Cloud	safe
https://prenniumofs.com/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351253578636.MDk2Mzg5ZDYtOGE2NS00NjM1LWEwZjctYjMyMDk2Zjg5N2Y0OTJjMWZiYjItMmU5OC00NjgyLThiNzMtZmQwOGQzNmRkMGM1&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=7b4b7266-ba70-4226-ad9a-85eee84800a6&state=Om3b_5lSL6riv4VkDpc0oaZ2co7HP_HE_f5jodEpPMnQv_0ozYea903iNgOq169-6yzRuGWjI72JQNb3y5EUA93yVk10sbxVYJeK2VvaxYMnnjEojyYoDAqCXZm_C492t5MEmeltKCc-j2bgKZU3cGn8Y1vrY8zuDDBk2H8Rb-tyLmTCne-Hw--o4AgT5pa08qbGrTfs5EDpwjs_dMojOc8WWbBxBK9HNB4oMe31IFP7BR0np7lWvWftMpgAuDkviLeXvRfqRuUK6euArTM25ODSMpwfcAAh1tn1Mb2BrAvmBnQsNdF5bjs1bgaxaF9se9jy9BjSSI-LvsTKHOJ353cUS414uv6OxMYFhTYm2RI&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351199053861.ZmQ1ZDUzMTAtMzczYy00ZmMwLThlYWItYjZlN2M3ZTFlNjg4NWJmMTMxOTItZmZjNy00MWU2LWJjODgtMTFiZGNiMTk4ZjYw&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=37046ea2-3090-45b4-ad52-31978ebdc059&state=hXwrK_BhecJREA86ynmf1r2ydkWe_W7hmsOTHQVhR7fVhW9aWAtstLB_OnoTQh4Tbgzge3_492sAHFD1IxEZj_wA1_RZKJqKgp0wiQtPDYvRTB7T1iAbQTsI91nmK4l_rlkF-TiUXiz9rqTN_-ewNeaEdnKmoEFjNl6q2wAtQz-dv9S1J0jiu1HpnKnFVGOAuvwWKPdRDOJ7dY9JE0ixEtdOYylShpkZM0_y-G_A-muFAmwVjNBc6FkkvyTHfRflkIFhzDiu5Jj6tnsh7xYD0KV7LjC8NZWrbS_eWlYPfbHQYty5eGl1mhALypVn2XlPcXvfVlnbFAB194C57PU56rv6w9-3TYg3ovKu-noQS2g&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351269733026.MTY1NjM4OWUtNWM2Ny00NmI5LWI4ZTItZWVjYTEzNDNkMTI2MTQzNmU4YjktMDg3MC00ZTQzLThlNWEtYjEwYmEyYmE2YWFh&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=cfe37ebe-2320-4cdc-b288-947cbe9ea5f5&state=XChcFws8fq9YwxARLEJsNy8obDW4rI2uNHAnvtctRHlJlratbr3XNBebhkGjM2UkAuee3iFHB5UVptf4KVw8Ry7XiurJtz5sjavkphi-4C2covM4lMdHeZw8l4H-QhrKWUiuHURsV2UCj5Mpixhehi42lTrz909FXN2Wwal9w7DMOl4Mp1-WLviSsmFu-vSNHv6wapS9YkUrifoxBzn4KsXCbX5NSTEqOmC2PaCilXvYgMiwkvcNRQAc7vUD17np4aJRrE_BZZKwkMG8SWkUuphcMVtLiVLoJJPoRRYF-aUt5PS_03YasXEZYlTwvZ_3N61JetCmdvunXdNNyHMTm4GK1NkYx3BG2qRtJwsRktA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://prenniumofs.com/aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js	0%	Avira URL Cloud	safe
https://prenniumofs.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3ByZW5uaXVtb2ZzLmNvbS8iLCJkb21haW4iOiJwcmVubml1bW9mcy5jb20iLCJrZXkiOiJuNWpkR0RydExTWEMiLCJxcmMiOm51bGwsImlhdCI6MTc0MjkzODMxNywiZXhwIjoxNzQyOTM4NDM3fQ.jgnFjEj-x9Zoa9s2rnAkKAKqs23qRnkw8J0M85LMsLo	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351241526609.YjM1NWM0ODUtYmU0MC00ZjA0LWE3YWMtZDQ5OWYwZGEwOGJhZDAzMmQxZTItMTI1My00MmE3LWI1YTMtNDI3ZTQ3M2JjNzU0&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=2c477191-574e-4827-9bf7-3d4e555f522d&state=LjTVfAY8vi8QuOp6KfI68XmQmZPi9HkPHiaC7g-3USUdMWeecyruBY8E2wbk_jpIMr8n6wtLz4-RS9WyjUR4iVbiD8boyx_k7gXui7GoZw3f1PTpG2vJavnQB_7EKX9CWE25-LsQmLv3eBGEoPoHQpmqoAxLvQbMSWr1aSCKfCv7DOQFhT-MQhqP42xvkbhUTyPr0ptLhjH8hj6ZmbDke1oDHo8iS_6A8vSnd9mN6bfsqIY50hm93sdTRtMknJu7dvQoqGvwtbis-Joryh8WLiaHfgNrn3WCF4I87tpv-aXyV8yNuziHV-XeJrRmVMAwvTAQCGHKrTR302rKxS5pyPjvt5zbCHeB8OepElrCrIE&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351232250708.ZDA5NjY1ZmQtZDhhZS00MmNlLWJjY2EtZDJhNmJhYzBiZTliY2RkZGI5ODQtNDc2OS00NzZjLWFlMTUtMGM4NTYzNWQ3MzQ5&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=c3c4ad46-09ee-4257-b167-3fd77bc112b9&state=bPX5QcjfmwU7gbU8aO13ZNVj1sIuV2XM1W7DvtPfoGXXBPEjy_RpNiacb3fGhiWkKoh1qOYIRw8HzAdIwEX0Wt1CjWRhai9-qZSBB3t9p9EtgwP0aNHJOLAoC-3s5a4OHvdXF_Ao51hrdPd1pWZkFBZlrhDYGmzlpwhv-IK7vfgz3WIAGK5eGQUjbpEr038IBi9G7KxiJSP-NVuI1seSz8HFcnSnIDaJS6VCOIwpCR-ryWLzjUnp3WgRx5wMPD6igcQPQ-HgU0wicXoI212_MeXKu663zNieYAOi_9tj9QrY1EMrlbaS6wFwl-t2osLpQUi7sle1hqez9sbHBNDKMkpsfjAWc37-Y-BYxImdniA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://prenniumofs.com/favicon.ico	0%	Avira URL Cloud	safe
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/AccessDenied.aspx?correlation=52168ea1%2D1031%2D8000%2D6a3d%2Da656b6c637d0	0%	Avira URL Cloud	safe
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/CSPReporting.aspx	0%	Avira URL Cloud	safe
https://prenniumofs.com/owa/	0%	Avira URL Cloud	safe
https://prenniumofs.com/common/handlers/watson	0%	Avira URL Cloud	safe
https://prenniumofs.com/	0%	Avira URL Cloud	safe
https://homeoillcompany.net/?dnygxoni	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351510414445.MzQ3MTI2ZjAtMDU4Mi00MzM1LTgzNGMtYmNmZDlkNzljZTMwMTFmNzc1ZDgtNTdiYi00NTg5LTgzODYtMjYxNWQ5YzJkNmVh&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=c904392d-a1a9-4480-ba3d-c890a8f93f53&state=peCnNKyjLVHuhEaLe3pETL5LF6Vjb9h2HcchYZ0S5wZ0e6OVm-wnFYL3qnyw4pdBZkda87qIIRkaRoNcNCNeF-OqDIzFvI40rgPl5NLs4vuBKuVkqK5Syv7wjXYmkYHTA8XmDvPhXF5xdxiZ0cgZONirHc92EDtf-3UB4jGMrNe0BezefhC8GTRpMbJcMsXcRMkmyX0RwL8kBcVSMTcPs3uw5n9ePArWyl6WkM-Vml22YQkZEudbFQT-FV_f-__aCmjlbNA5RvrVvHDBmaqjHD-8sJZtUbZN58XRBHTLxrhLN_a7lqDmfy44ne5j9Dr9QhaDcwSh1RqhDRJDWxUw5rm8QarUCy9KaeJhBpzzUqE&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351481116382.OWE5MGU0ODktZmZjYy00NTM2LTlmYTItZTY3M2I2NjM2OTMzZTRjN2JlNDItZDBhNy00OTE0LWJkNWYtZTIwOTIwZjkxZDQ3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=187674c7-24aa-4da0-8016-313301a1cf65&state=-J4laP7Nzg8tXHsSuObTf-92JyVLZaoKEEvisNKDsUNbIEMd1F2vNi_ETJglaObuA3Yvm6V7t1OG6wVDlmUog8l6HPV3a4kmv6KWO85q801Ge1lN5zmZW9j7niskKRNHhaYFDHRm-z-vCYK1dBfhdXlHmLC6mfdNd9ETSQpfq2KaD8CvT6RdDu07vZkj9oIx7ggAUemnhcmAAEWC7Ugdzuy5D-vZ1cSkUNO4-NdI2mccUCXlWzFxy4IQg2_Dsbhb80DnlOWMlGi5XEOiuBvNMr7NmNrjs3ktic9d3Rnr6nXFtHROI1paRhTljvJJ-d0ngjoJA1cOaiUbJssJEaIzTxtNCuzZACz0zjxxv26SW5o&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351469195374.ZDY0NDVlZDUtZDJmOS00ZDlmLWE2NTctYjFhNzlmN2RkYTY0NjQwYmQ5MmYtNDE0MS00YWRlLWJlOTQtNThmMjIwY2IyNzdk&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=f0f0b9d8-60e0-46ac-a7b3-8623b7187be6&state=dhUCWJ8pWMeG-mX4942_idIlM3GbUacw7Y1x3u2U7KooVT1i2eguD95yrUZWb0JGT432ewaUwInSjrsplSI2rC3fY9xzXOpf18QOlQLEsHqLJ1JHadqVbXh6F5orkOQbUVGGsFIz19dKldOHRdvzF85M8CRhzKl_QKy3Fo6cyemEwExYzhyMwh6wt5gAedVSbjMLgvU5nrp7iU7AAPXOxMAtQudWg-WTb81DNNo_YMX15Yb-qCWgZWX4iYSGV7PXghdt354N479_Y-84pJ38VEZKOrKG5-CRDbxgc-QiyPR5DdtNq3Q9n1GLJqYK6MxFQkLRHGcBtgCY3LN6IJ9_KWc1WbJnkDTj886LYKfynTg&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351486269514.ZDUwNDdjY2ItYzAyMC00MTgzLTllNmYtMWI0MzI4ZTIzMWIwODBlNmU5M2QtOWE1NC00Y2NkLWFjMjYtOTczMDk0ZjE0MGQ4&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=eaf16e0d-e18c-4017-b463-28fee0b644b7&state=aIKPwBPLkukyrtQTE4Sq9vo9ba9ht6TvTXk1jsmnZtXsoLYwPgcKILPxjuhOxlG3eVcYApF9BlFosXGu6kX8A4yX-JxX_XBWPh7HxzITC0MF2U4qxKKAKqgyYKXE3CMcJ2_82C_50lS-znoLkJZN9ToYdx-_m8YZPE0vnTv_W8Hs73A62wnfCPkiuQ_Yy7GvMtHshmtFRRu0nsmj0_DCEPrEqN1Q8344oDZNfYpR1N-mwnjj9mYPEiBANzU_JZ91vjVsk1HBPHva1to9b2QH0VBQekCKvc1e9muoc8PzgGvdz8z61n42XWTfyq9obKZa-Yu0wASVtLOewMLdvFck_e7H-JLZWWP41TzBY2e6b4U&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351595900207.NTIzMTg5NWUtZGU0NC00Yzg5LWE3N2EtM2NlYjgyNmViZTMwMjM0NWIzNzUtYmE3Ni00OGZhLTk5MjAtZTVlYzU5NjA1NjJm&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=671a2ffd-a4e2-4a3e-a893-557586f49757&state=txjKri5gpIX542wo57-3P5-slwKknpgT39l0SEAzBS3CvoZ2wfpUn2DdEgDfA2GmghXRTlTs1m1tVEfvchr6zGO-FceDZCvGwwNyJpYUMrYZL6KZq08w7TaKuPw8O55M9F5itBrgnbmPWdurXyd5uC1aUFvQSE-NhtGqjnOv3dXX85M085Lrk9BkuPK0Xbkt5LpU8c-6oz16gwtYDrNn67l_Mw3hn1UpNInYo6AGin8Z39Fhj88G2Cvo4Z-_sbsXZVw5VOlSL0bLXvy-B-w9Zh62UH782hu0Z6tm1CTewkc12nVHvCGEoeCVxWEKvJhycgP60jnyacjfl2QI3e80CNHE0-Fnm6UKJ_CHUFCSK3I&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351613640534.YmExYTViMWYtZjgyZi00MTJmLWExMzUtZTI1MmU0Y2Q5NGM1NzIxZTIxNjYtYTA3OS00MDdkLWE3YTgtNjRkYzEzZTgxOGU0&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=de310938-8e91-4d83-85ac-020d3bb5c75f&state=wkpjYZQl1xv65xb9_G-s8dAr7BENrOacn_KVqZHeii5G4M4Db3VvcADKYenx_Y10Uc2EukkItisI1RdsG16zXM4E3gu6-U4KH5tj1e7fG_9jNpQ6pQAAbiGftNP_0F5JCZ1QMbjGs9xbk2gmlwGZyJL9uJ-xEG2TQ6H7a0dLfpnozUOt2qmSIIHq1fKn2RBWkO8KcuL0IeAY_VLdw6tSAJrDLnAmI7etFe3PhJXelSeND-J9QDvrperfFvATmMlfZ0CYshlwSBKH_YDkkTVFSWeXNXNcyafYOLKvQRA8UWQfQduBcPxN0RuY3hTHj3vOZCthnRJE6C_V8AP9OawKjJCQQN085itQKj-PeLp6Uko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351586817305.OTBmMzkzM2ItYzNiZS00MTJjLWE5NWYtNjYzNTM3ODJmZjU1MDdhOGRmZmQtYTM1YS00YWUxLThlNjItNDkyMDkwNGQ4NjYy&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=6a7e5169-cd59-414b-adb5-58eafa7c6b6a&state=yz5d26wahpaYMgLF3eG0lRyw6tJhFrFtIlRj4Du0hU8f4JVWn50JDN2KK60G3cdEa9bVe6w31GVnScG0_JHApmbGoCSmvYfp54xkA_iaPUGj249RB5OAoHziYD7WWQQrj_shLJVJscd2VN7f45hf3aX9e6sQdeRJFxT-bbDf3qNL_YTBS5vZyYVhZGU8PqA-RAPTlCfAua4fHrf8IJPCvuwoqktAVbKS9gNs92KEWJk0u9NREh5D7mRI5Iathw_VQhXmeda-97ymMPMuqye5v7BNPrNx8-dP41PpdnKPHfgTd3KpG9oOXClpwqH3gPCRNx7Mv8XeQ_0zHmq9NN9EFBDp4zKDphRV8GXgead3GrE&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351625553706.ZjNlMzQ3OTAtYzllMy00M2NkLWI4ZDctMTVmMGY5NGMzMzczZjA4ZTk1ODgtNWZkZS00ODE4LTk3MWYtMDA0ZmRmNTVhMzA4&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=0d59b80d-bbf9-494c-be32-8c35b2669de5&state=RMBOGC-iTvST3xiO-CS3yV5PSG-lros_218xK8a5Z1JqZ3IOulcEyzcUwJCuzaWORqKvOr5ddFvoYkx7N9cGIc3Vue6OLKA20cW2_TtuSjOTQ2EIhGEQpjTvH2NlqKbA457wImmxKbDyLmqYVxlCamZEBlmpk2W3ESAqhNtwz1_ebPhTMkH8PrqFWwf3fjzdK-kveFgmcy8gk7Fal5qCZopd0WBo_zWDyBQT62t6giUNqmka3it2BuRGkaO5_0E3V0LXQcH1oOB_zvXs-2mnNHbKUnrUd5S19Vn97MbwDNzmcfDJklD_OS_CbZt_QxQ2dm8cnDpM1_hwVAnp6drFoQWJE65vrbqvAlRbIeORsbY&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351637172722.YjE3ZWI2NzQtOTg5Zi00ZjQ0LTg2NTYtMTcxNDc3NWZjNzRiMmU2ZmZiOGUtMDc4Yy00MmNmLTgyMDktNjA5ZDNhMzZhNTJh&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=5f274ece-d086-4613-ae04-d6a2c6d2e298&state=VEk34uaHatrLPjU-6upabpYhD3-1G6GWasjWH4OwRwBiEJnp6cpWABp8mKEWRyMx5VTLGaxYVO1tsIXxo6xDUGkY6gHatg2Crol2ZK4cKQBCDu3wEuHVK6LjH_TNfDWR3tCjoKIWUeCR8nR9I5jvJIc6fmqoeq0oqVIHP_auZw5zatYoznV8_ZsP4TDajGTVW3UTcZyCNpAF6evZzZ0JMefdA35gjPoFtlkzE_tQ7kuowM6981T9NO_QEI72QENptZ0ENOWzdr1FIBAVYydF0ve5hjXCK1RKgtlbvA61LE2eOznT1lzCftIm-t8YZWHeDWspv2GuRhBwBlwJnGGopwAtFJRn-G3TzMSg3rjFZgQ&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351600683312.ODhlM2ZlZTYtY2MzMy00YmUyLWE0ODItYmI0NGY0MGFmZWM4MTE5MTVlNjktYjY0OS00M2UyLWE1NTgtZjBmOGQwNWU2YzJi&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=57e9bbf8-37ce-4799-8046-c41ac062ef89&state=1GblaXw9RRkuaQna7sN1s1XygB012GUnyCazz98Yc4WiOPpVFbWw76Aw3k-5YegozZK9dxn05eetUWWx_B8C4WU6fOe-0ARAwg57hzF4f1xixtI1BkbePgH0UJPHNZBDaxEUyn_deOvuyN5hAncVukPi8zqM_nzhXrBWARH9gUJc_eWzXyFvKQZ6FFUNsASEdrc4Um3cyINWI4Kzbls5YY-s_cJlKU28h603ICs28AATM0lHtdZhojILT4rXzQezhttlLGfzszt9nupcS50-fg4HhzsS5NAkbq1-K-7COdeL64fIuZNZgBiBnWJy5CjGl9mSU4fIfLbJrj0UE2zdWs90EiDN2UV9ztHzmoofgLs&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	0%	Avira URL Cloud	safe
https://m365cdn.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=PISCATAWAY&ASN=20940&Country=US&Region=NJ&RequestIdentifier=0.a6872c17.1742938386.34a75a1&TotalRTCDNTime=91&CompressionType=gzip&FileSize=45259	0%	Avira URL Cloud	safe
https://spo.nel.measure.office.net/api/report?tenantId=67bb197b-b9fb-4d1d-bdea-510c010d61e6&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=161.77.13.0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
e40491.dscg.akamaiedge.net	23.44.136.13	true	false	high
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	high
s-part-0044.t-0009.t-msedge.net	13.107.246.72	true	false	high
b-0004.b-dc-msedge.net	13.107.9.156	true	false	high
b-0004.b-msedge.net	13.107.6.156	true	false	high
a1894.dscb.akamai.net	23.33.44.234	true	false	high
www.tm.a.prd.aadg.trafficmanager.net	20.190.157.1	true	false	high
ooc-g2.tm-4.office.com	40.97.190.18	true	false	high
prenniumofs.com	147.45.177.71	true	false	unknown
b-0008.b-msedge.net	13.107.6.163	true	false	high
a726.dscd.akamai.net	23.204.152.212	true	false	high
mira-ooc.tm-4.office.com	52.98.71.210	true	false	unknown
challenges.cloudflare.com	104.18.94.41	true	false	high
www.google.com	142.251.40.100	true	false	high
s-0005.dual-s-msedge.net	52.123.128.14	true	false	high
06ce4a55.a65b244135035fa567d4d337.workers.dev	104.21.32.1	true	true	unknown
homeoillcompany.net	147.45.177.71	true	false	unknown
hel-mvp.trafficmanager.net	40.101.65.162	true	false	unknown
www.office.com	unknown	unknown	false	high
r4.res.office365.com	unknown	unknown	false	high
outlook.office.com	unknown	unknown	false	high
tr-ooc-atm.office.com	unknown	unknown	false	high
m365cdn.nel.measure.office.net	unknown	unknown	false	high
577cf093c99335aac213bf037bd04ff3.fp.measure.office.com	unknown	unknown	false	unknown
spo.nel.measure.office.net	unknown	unknown	false	high
thetti-my.sharepoint.com	unknown	unknown	true	unknown
identity.nel.measure.office.net	unknown	unknown	false	high
upload.fp.measure.office.com	unknown	unknown	false	high
config.fp.measure.office.com	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
eastus1-mediap.svc.ms	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351595900207.NTIzMTg5NWUtZGU0NC00Yzg5LWE3N2EtM2NlYjgyNmViZTMwMjM0NWIzNzUtYmE3Ni00OGZhLTk5MjAtZTVlYzU5NjA1NjJm&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=671a2ffd-a4e2-4a3e-a893-557586f49757&state=txjKri5gpIX542wo57-3P5-slwKknpgT39l0SEAzBS3CvoZ2wfpUn2DdEgDfA2GmghXRTlTs1m1tVEfvchr6zGO-FceDZCvGwwNyJpYUMrYZL6KZq08w7TaKuPw8O55M9F5itBrgnbmPWdurXyd5uC1aUFvQSE-NhtGqjnOv3dXX85M085Lrk9BkuPK0Xbkt5LpU8c-6oz16gwtYDrNn67l_Mw3hn1UpNInYo6AGin8Z39Fhj88G2Cvo4Z-_sbsXZVw5VOlSL0bLXvy-B-w9Zh62UH782hu0Z6tm1CTewkc12nVHvCGEoeCVxWEKvJhycgP60jnyacjfl2QI3e80CNHE0-Fnm6UKJ_CHUFCSK3I&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_api/v2.0/sites/%7B27a899a8-7938-42bd-99eb-b0bab83aa62e%7D/lists/%7B251f106c-7fed-4015-beb4-5d512f9d2933%7D/items/delta?token=latest	false	Avira URL Cloud: safe	unknown
https://thetti-my.sharepoint.com/_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351613640534.YmExYTViMWYtZjgyZi00MTJmLWExMzUtZTI1MmU0Y2Q5NGM1NzIxZTIxNjYtYTA3OS00MDdkLWE3YTgtNjRkYzEzZTgxOGU0&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=de310938-8e91-4d83-85ac-020d3bb5c75f&state=wkpjYZQl1xv65xb9_G-s8dAr7BENrOacn_KVqZHeii5G4M4Db3VvcADKYenx_Y10Uc2EukkItisI1RdsG16zXM4E3gu6-U4KH5tj1e7fG_9jNpQ6pQAAbiGftNP_0F5JCZ1QMbjGs9xbk2gmlwGZyJL9uJ-xEG2TQ6H7a0dLfpnozUOt2qmSIIHq1fKn2RBWkO8KcuL0IeAY_VLdw6tSAJrDLnAmI7etFe3PhJXelSeND-J9QDvrperfFvATmMlfZ0CYshlwSBKH_YDkkTVFSWeXNXNcyafYOLKvQRA8UWQfQduBcPxN0RuY3hTHj3vOZCthnRJE6C_V8AP9OawKjJCQQN085itQKj-PeLp6Uko&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://06ce4a55.a65b244135035fa567d4d337.workers.dev/	false		unknown
https://m365cdn.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EDISON&ASN=20940&Country=US&Region=NJ&RequestIdentifier=0.e89d2e17.1742938326.1bec0dd6&TotalRTCDNTime=93&CompressionType=gzip&FileSize=1391	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351586817305.OTBmMzkzM2ItYzNiZS00MTJjLWE5NWYtNjYzNTM3ODJmZjU1MDdhOGRmZmQtYTM1YS00YWUxLThlNjItNDkyMDkwNGQ4NjYy&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=6a7e5169-cd59-414b-adb5-58eafa7c6b6a&state=yz5d26wahpaYMgLF3eG0lRyw6tJhFrFtIlRj4Du0hU8f4JVWn50JDN2KK60G3cdEa9bVe6w31GVnScG0_JHApmbGoCSmvYfp54xkA_iaPUGj249RB5OAoHziYD7WWQQrj_shLJVJscd2VN7f45hf3aX9e6sQdeRJFxT-bbDf3qNL_YTBS5vZyYVhZGU8PqA-RAPTlCfAua4fHrf8IJPCvuwoqktAVbKS9gNs92KEWJk0u9NREh5D7mRI5Iathw_VQhXmeda-97ymMPMuqye5v7BNPrNx8-dP41PpdnKPHfgTd3KpG9oOXClpwqH3gPCRNx7Mv8XeQ_0zHmq9NN9EFBDp4zKDphRV8GXgead3GrE&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://577cf093c99335aac213bf037bd04ff3.fp.measure.office.com/apc/trans.gif?d6643879af4bbc192dd407eb3f326bb2	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/b/708f7a809116/api.js	false		high
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351224162088.MTM0ODA0YzktMzlkNy00ZTBhLWE3NmUtZjUyOGYwZjIwY2U1MjI3MzU4YzMtM2JmYy00M2VlLWIxZjktZDIwNTViMzllN2Yw&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=c95536ba-6816-4f2f-811d-f207c32911ea&state=Sx3DslR2sMvPEzFnislbOttKEKNq13VmFAWUT_jpZOiN8wWmSbP8RsyGj1CQVy5TbLvXTC8L-eF_iFhJ0ne7CWetjdaoa-ZjOu4OgFTAOpNwZQqf9N13C47EhTo5Xt4tqNBFllDGD9WN8Fte-JT4R4WVerYp0BeDvXnRmPsvCcxJOCJKR5X3cARnTCAU6z_5SateydS_G3aqgMzHEzvbXdfcKH4yAIBwXlVK-ockauTJuKNR-SRb1Hz4jYU49KYqdEuixJxocbUTTXG5-laYwE6qw8RNncq2uQqltRHkDPSCYM57DwnQ__OP8a393XdLTX4OiiaKLwzPCZN5N3VGSKCFxJm1zQe0yY-G2JxCV58&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351269733026.MTY1NjM4OWUtNWM2Ny00NmI5LWI4ZTItZWVjYTEzNDNkMTI2MTQzNmU4YjktMDg3MC00ZTQzLThlNWEtYjEwYmEyYmE2YWFh&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=cfe37ebe-2320-4cdc-b288-947cbe9ea5f5&state=XChcFws8fq9YwxARLEJsNy8obDW4rI2uNHAnvtctRHlJlratbr3XNBebhkGjM2UkAuee3iFHB5UVptf4KVw8Ry7XiurJtz5sjavkphi-4C2covM4lMdHeZw8l4H-QhrKWUiuHURsV2UCj5Mpixhehi42lTrz909FXN2Wwal9w7DMOl4Mp1-WLviSsmFu-vSNHv6wapS9YkUrifoxBzn4KsXCbX5NSTEqOmC2PaCilXvYgMiwkvcNRQAc7vUD17np4aJRrE_BZZKwkMG8SWkUuphcMVtLiVLoJJPoRRYF-aUt5PS_03YasXEZYlTwvZ_3N61JetCmdvunXdNNyHMTm4GK1NkYx3BG2qRtJwsRktA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX%2FThe%20Team%20Training%20Institute&ga=1	false		unknown
https://tr-ooc-atm.office.com/apc/trans.gif?207fbef8cf1419be89a5c7d66785703d	false	Avira URL Cloud: safe	unknown
https://m365cdn.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=PISCATAWAY&ASN=20940&Country=US&Region=NJ&RequestIdentifier=0.a6872c17.1742938386.34a75a1&TotalRTCDNTime=91&CompressionType=gzip&FileSize=45259	false	Avira URL Cloud: safe	unknown
https://577cf093c99335aac213bf037bd04ff3.fp.measure.office.com/apc/trans.gif?2cf1341cd8578a147a22f2e5ed268e48	false	Avira URL Cloud: safe	unknown
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/onedrive.aspx?ga=1&id=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX%2FThe%20Team%20Training%20Institute%2FThe%20Team%20Training%20Institute%2Epdf&parent=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX%2FThe%20Team%20Training%20Institute	true		unknown
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351253578636.MDk2Mzg5ZDYtOGE2NS00NjM1LWEwZjctYjMyMDk2Zjg5N2Y0OTJjMWZiYjItMmU5OC00NjgyLThiNzMtZmQwOGQzNmRkMGM1&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=7b4b7266-ba70-4226-ad9a-85eee84800a6&state=Om3b_5lSL6riv4VkDpc0oaZ2co7HP_HE_f5jodEpPMnQv_0ozYea903iNgOq169-6yzRuGWjI72JQNb3y5EUA93yVk10sbxVYJeK2VvaxYMnnjEojyYoDAqCXZm_C492t5MEmeltKCc-j2bgKZU3cGn8Y1vrY8zuDDBk2H8Rb-tyLmTCne-Hw--o4AgT5pa08qbGrTfs5EDpwjs_dMojOc8WWbBxBK9HNB4oMe31IFP7BR0np7lWvWftMpgAuDkviLeXvRfqRuUK6euArTM25ODSMpwfcAAh1tn1Mb2BrAvmBnQsNdF5bjs1bgaxaF9se9jy9BjSSI-LvsTKHOJ353cUS414uv6OxMYFhTYm2RI&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351600683312.ODhlM2ZlZTYtY2MzMy00YmUyLWE0ODItYmI0NGY0MGFmZWM4MTE5MTVlNjktYjY0OS00M2UyLWE1NTgtZjBmOGQwNWU2YzJi&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=57e9bbf8-37ce-4799-8046-c41ac062ef89&state=1GblaXw9RRkuaQna7sN1s1XygB012GUnyCazz98Yc4WiOPpVFbWw76Aw3k-5YegozZK9dxn05eetUWWx_B8C4WU6fOe-0ARAwg57hzF4f1xixtI1BkbePgH0UJPHNZBDaxEUyn_deOvuyN5hAncVukPi8zqM_nzhXrBWARH9gUJc_eWzXyFvKQZ6FFUNsASEdrc4Um3cyINWI4Kzbls5YY-s_cJlKU28h603ICs28AATM0lHtdZhojILT4rXzQezhttlLGfzszt9nupcS50-fg4HhzsS5NAkbq1-K-7COdeL64fIuZNZgBiBnWJy5CjGl9mSU4fIfLbJrj0UE2zdWs90EiDN2UV9ztHzmoofgLs&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false		high
https://thetti-my.sharepoint.com/:f:/p/kellieblack/EtssBivICL5BgQEDfbETZP4BZsoHTOyxYMnSj46dgeiAiA?e=0t2fdm	false		unknown
https://thetti-my.sharepoint.com/_layouts/15/images/BLANK.gif	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351486269514.ZDUwNDdjY2ItYzAyMC00MTgzLTllNmYtMWI0MzI4ZTIzMWIwODBlNmU5M2QtOWE1NC00Y2NkLWFjMjYtOTczMDk0ZjE0MGQ4&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=eaf16e0d-e18c-4017-b463-28fee0b644b7&state=aIKPwBPLkukyrtQTE4Sq9vo9ba9ht6TvTXk1jsmnZtXsoLYwPgcKILPxjuhOxlG3eVcYApF9BlFosXGu6kX8A4yX-JxX_XBWPh7HxzITC0MF2U4qxKKAKqgyYKXE3CMcJ2_82C_50lS-znoLkJZN9ToYdx-_m8YZPE0vnTv_W8Hs73A62wnfCPkiuQ_Yy7GvMtHshmtFRRu0nsmj0_DCEPrEqN1Q8344oDZNfYpR1N-mwnjj9mYPEiBANzU_JZ91vjVsk1HBPHva1to9b2QH0VBQekCKvc1e9muoc8PzgGvdz8z61n42XWTfyq9obKZa-Yu0wASVtLOewMLdvFck_e7H-JLZWWP41TzBY2e6b4U&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://outlook.office.com/apc/trans.gif?f6240cb4595a7b3f1b2e60524dbf5c6b	false	Avira URL Cloud: safe	unknown
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_api/SP.OAuth.Token/Acquire()	false	Avira URL Cloud: safe	unknown
https://prenniumofs.com/aadcdn.msftauth.net/~/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js	false	Avira URL Cloud: safe	unknown
https://prenniumofs.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3ByZW5uaXVtb2ZzLmNvbS8iLCJkb21haW4iOiJwcmVubml1bW9mcy5jb20iLCJrZXkiOiJoZU1rcE9uMU5KdnUiLCJxcmMiOm51bGwsImlhdCI6MTc0MjkzODMxNywiZXhwIjoxNzQyOTM4NDM3fQ.P_k4EmNZRTs0QHbG5vOvxBlkhgxdXjA9viXvzLI6NkY	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351199053861.ZmQ1ZDUzMTAtMzczYy00ZmMwLThlYWItYjZlN2M3ZTFlNjg4NWJmMTMxOTItZmZjNy00MWU2LWJjODgtMTFiZGNiMTk4ZjYw&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=37046ea2-3090-45b4-ad52-31978ebdc059&state=hXwrK_BhecJREA86ynmf1r2ydkWe_W7hmsOTHQVhR7fVhW9aWAtstLB_OnoTQh4Tbgzge3_492sAHFD1IxEZj_wA1_RZKJqKgp0wiQtPDYvRTB7T1iAbQTsI91nmK4l_rlkF-TiUXiz9rqTN_-ewNeaEdnKmoEFjNl6q2wAtQz-dv9S1J0jiu1HpnKnFVGOAuvwWKPdRDOJ7dY9JE0ixEtdOYylShpkZM0_y-G_A-muFAmwVjNBc6FkkvyTHfRflkIFhzDiu5Jj6tnsh7xYD0KV7LjC8NZWrbS_eWlYPfbHQYty5eGl1mhALypVn2XlPcXvfVlnbFAB194C57PU56rv6w9-3TYg3ovKu-noQS2g&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351625553706.ZjNlMzQ3OTAtYzllMy00M2NkLWI4ZDctMTVmMGY5NGMzMzczZjA4ZTk1ODgtNWZkZS00ODE4LTk3MWYtMDA0ZmRmNTVhMzA4&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=0d59b80d-bbf9-494c-be32-8c35b2669de5&state=RMBOGC-iTvST3xiO-CS3yV5PSG-lros_218xK8a5Z1JqZ3IOulcEyzcUwJCuzaWORqKvOr5ddFvoYkx7N9cGIc3Vue6OLKA20cW2_TtuSjOTQ2EIhGEQpjTvH2NlqKbA457wImmxKbDyLmqYVxlCamZEBlmpk2W3ESAqhNtwz1_ebPhTMkH8PrqFWwf3fjzdK-kveFgmcy8gk7Fal5qCZopd0WBo_zWDyBQT62t6giUNqmka3it2BuRGkaO5_0E3V0LXQcH1oOB_zvXs-2mnNHbKUnrUd5S19Vn97MbwDNzmcfDJklD_OS_CbZt_QxQ2dm8cnDpM1_hwVAnp6drFoQWJE65vrbqvAlRbIeORsbY&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://prenniumofs.com/aadcdn.msftauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js	false	Avira URL Cloud: safe	unknown
https://spo.nel.measure.office.net/api/report?tenantId=67bb197b-b9fb-4d1d-bdea-510c010d61e6&destinationEndpoint=Edge-Prod-EWR31r5b&frontEnd=AFD&RemoteIP=161.77.13.0	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351219094033.YTc0MzAyMDEtODEzMi00ZjcyLTk4MGYtM2IwMjM5NjQwZTI1NjZkZDk5MjQtNzdlYy00ZTMwLTkxMmEtMzNhMjE1Njc4ZDM0&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=03b1531c-b237-4731-933e-b8c01a6f1b85&state=rLzi6I99XMxH8mXU0NiaRy7Cx7qDAX9zhHtTlOs7u24JkdvrYVYtjxbLBwiNXqBffQidaH0S6oFHXX1fCzxaAZYMcb5anWia8fh-JyAwEzAC4prdOHVxVIHk0sdPO5z3i6GRXOGMhd3i21e2u_v88TQFksqfDqBo7u82JzZMbTTkkkfOnJJ6WVj2INPkkrythmp1EW3zE7xXabrDqxVCeQfWJ-jefla6m028sVwQI1eWsbsUU6I9F3aAdt1YAN7mLdhOK_ts9AV4xuFQD1hT6IO1JLqUbSNbyxk6m14Vrp7ddBWvfuQj-9d2LK6kGF-vUtKNsMHi5xXiqqOSzt7U5HhDXG48jXv-j9kZN_diRL8&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://config.fp.measure.office.com/conf/v2/o365se/fpconfig.min.json?monitorId=O365se	false		high
https://outlook.office.com/apc/trans.gif?c95f98c2620b57f9c74ccc331663749a	false	Avira URL Cloud: safe	unknown
https://thetti-my.sharepoint.com/_layouts/15/images/odbfavicon.ico?rev=47	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351637172722.YjE3ZWI2NzQtOTg5Zi00ZjQ0LTg2NTYtMTcxNDc3NWZjNzRiMmU2ZmZiOGUtMDc4Yy00MmNmLTgyMDktNjA5ZDNhMzZhNTJh&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=5f274ece-d086-4613-ae04-d6a2c6d2e298&state=VEk34uaHatrLPjU-6upabpYhD3-1G6GWasjWH4OwRwBiEJnp6cpWABp8mKEWRyMx5VTLGaxYVO1tsIXxo6xDUGkY6gHatg2Crol2ZK4cKQBCDu3wEuHVK6LjH_TNfDWR3tCjoKIWUeCR8nR9I5jvJIc6fmqoeq0oqVIHP_auZw5zatYoznV8_ZsP4TDajGTVW3UTcZyCNpAF6evZzZ0JMefdA35gjPoFtlkzE_tQ7kuowM6981T9NO_QEI72QENptZ0ENOWzdr1FIBAVYydF0ve5hjXCK1RKgtlbvA61LE2eOznT1lzCftIm-t8YZWHeDWspv2GuRhBwBlwJnGGopwAtFJRn-G3TzMSg3rjFZgQ&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkellieblack%5Fthetti%5Fcom%2FDocuments%2FView%20OneDrive%20eFAX&ga=1	false		unknown
https://prenniumofs.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3ByZW5uaXVtb2ZzLmNvbS8iLCJkb21haW4iOiJwcmVubml1bW9mcy5jb20iLCJrZXkiOiJuNWpkR0RydExTWEMiLCJxcmMiOm51bGwsImlhdCI6MTc0MjkzODMxNywiZXhwIjoxNzQyOTM4NDM3fQ.jgnFjEj-x9Zoa9s2rnAkKAKqs23qRnkw8J0M85LMsLo	false	Avira URL Cloud: safe	unknown
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fkellieblack_thetti_com%2FDocuments%2FView%20OneDrive%20eFAX&ga=1	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/aipxs/0x4AAAAAABB9-Qwz2OYAulMj/auto/fbE/new/normal/auto/	false	Avira URL Cloud: safe	unknown
https://tr-ooc-atm.office.com/apc/trans.gif?cde5938419387b82555cd0ce535ad7e1	false	Avira URL Cloud: safe	unknown
https://prenniumofs.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://r4.res.office365.com/footprint/v3.2/scripts/fp-min.js	false		high
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351232250708.ZDA5NjY1ZmQtZDhhZS00MmNlLWJjY2EtZDJhNmJhYzBiZTliY2RkZGI5ODQtNDc2OS00NzZjLWFlMTUtMGM4NTYzNWQ3MzQ5&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=c3c4ad46-09ee-4257-b167-3fd77bc112b9&state=bPX5QcjfmwU7gbU8aO13ZNVj1sIuV2XM1W7DvtPfoGXXBPEjy_RpNiacb3fGhiWkKoh1qOYIRw8HzAdIwEX0Wt1CjWRhai9-qZSBB3t9p9EtgwP0aNHJOLAoC-3s5a4OHvdXF_Ao51hrdPd1pWZkFBZlrhDYGmzlpwhv-IK7vfgz3WIAGK5eGQUjbpEr038IBi9G7KxiJSP-NVuI1seSz8HFcnSnIDaJS6VCOIwpCR-ryWLzjUnp3WgRx5wMPD6igcQPQ-HgU0wicXoI212_MeXKu663zNieYAOi_9tj9QrY1EMrlbaS6wFwl-t2osLpQUi7sle1hqez9sbHBNDKMkpsfjAWc37-Y-BYxImdniA&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://eastus1-mediap.svc.ms/transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fthetti-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!qJmoJzh5vUKZ67C6uDqmLttcl3WmwwJDi3S0jR8-POZsEB8l7X8VQL60XVEvnSkz%2Fitems%2F01LRXEEZPWYVH44HBFHRD3A5VPOQ4OHOZK%3Fversion%3DPublished&access_token=v1.eyJzaXRlaWQiOiIyN2E4OTlhOC03OTM4LTQyYmQtOTllYi1iMGJhYjgzYWE2MmUiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvdGhldHRpLW15LnNoYXJlcG9pbnQuY29tQDY3YmIxOTdiLWI5ZmItNGQxZC1iZGVhLTUxMGMwMTBkNjFlNiIsImV4cCI6IjE3NDI5NTgwMDAifQ.CiMKCXNoYXJpbmdpZBIWcys1ejR4MTFPRVNMaUM5MzlSbmJ2QQoICgNzdHASAXQKCgoEc25pZBICMzMSBgjqjDsQARoMMTYxLjc3LjEzLjIwIhRtaWNyb3NvZnQuc2hhcmVwb2ludCosMFltNXAyWTdwWXVneHAxUk4xb3loM01HL2VFSHVYNnpuUC9Ccmx3U01jTT0wdDgBShBoYXNoZWRwcm9vZnRva2VuYgR0cnVlcmEwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiM4YzBjODk4Mjg2ZWJiYWExNGFhOGZjZTRhNWNmYjYwZmY1YWEzYmM5NmVmYThmMGFlMmYzZDJhMmQwNjRiNGIyegEwwgFhMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGMwYzg5ODI4NmViYmFhMTRhYThmY2U0YTVjZmI2MGZmNWFhM2JjOTZlZmE4ZjBhZTJmM2QyYTJkMDY0YjRiMg.NxyFVvkpxZDVVvxCgD8gZs59G2b_eSsIvLBBeqT_qG4&cTag=%22c%3A%7BCE4FC5F6-251C-473C-B076-AF7438E3BB2A%7D%2C1%22	false	Avira URL Cloud: safe	unknown
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_api/v2.0/sites/root/lists/%7B251f106c-7fed-4015-beb4-5d512f9d2933%7D/subscriptions/socketIo?listItemIds=	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_api/v2.0/sites/root/lists/251f106c-7fed-4015-beb4-5d512f9d2933/subscriptions/socketIo?listItemIds=	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/9261846f8cb01819/1742938310202/3fa0190395472dccb51714b4ba1003c5355923c5f11893ea31e79bc49baaffdf/miMwmXvjywmPqp7	false	Avira URL Cloud: safe	unknown
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/CSPReporting.aspx	false	Avira URL Cloud: safe	unknown
https://www.office.com/?auth=2	false		high
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351241526609.YjM1NWM0ODUtYmU0MC00ZjA0LWE3YWMtZDQ5OWYwZGEwOGJhZDAzMmQxZTItMTI1My00MmE3LWI1YTMtNDI3ZTQ3M2JjNzU0&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=2c477191-574e-4827-9bf7-3d4e555f522d&state=LjTVfAY8vi8QuOp6KfI68XmQmZPi9HkPHiaC7g-3USUdMWeecyruBY8E2wbk_jpIMr8n6wtLz4-RS9WyjUR4iVbiD8boyx_k7gXui7GoZw3f1PTpG2vJavnQB_7EKX9CWE25-LsQmLv3eBGEoPoHQpmqoAxLvQbMSWr1aSCKfCv7DOQFhT-MQhqP42xvkbhUTyPr0ptLhjH8hj6ZmbDke1oDHo8iS_6A8vSnd9mN6bfsqIY50hm93sdTRtMknJu7dvQoqGvwtbis-Joryh8WLiaHfgNrn3WCF4I87tpv-aXyV8yNuziHV-XeJrRmVMAwvTAQCGHKrTR302rKxS5pyPjvt5zbCHeB8OepElrCrIE&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://prenniumofs.com/owa/	false	Avira URL Cloud: safe	unknown
https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+bno	false		high
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_layouts/15/AccessDenied.aspx?correlation=52168ea1%2D1031%2D8000%2D6a3d%2Da656b6c637d0	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351481116382.OWE5MGU0ODktZmZjYy00NTM2LTlmYTItZTY3M2I2NjM2OTMzZTRjN2JlNDItZDBhNy00OTE0LWJkNWYtZTIwOTIwZjkxZDQ3&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=187674c7-24aa-4da0-8016-313301a1cf65&state=-J4laP7Nzg8tXHsSuObTf-92JyVLZaoKEEvisNKDsUNbIEMd1F2vNi_ETJglaObuA3Yvm6V7t1OG6wVDlmUog8l6HPV3a4kmv6KWO85q801Ge1lN5zmZW9j7niskKRNHhaYFDHRm-z-vCYK1dBfhdXlHmLC6mfdNd9ETSQpfq2KaD8CvT6RdDu07vZkj9oIx7ggAUemnhcmAAEWC7Ugdzuy5D-vZ1cSkUNO4-NdI2mccUCXlWzFxy4IQg2_Dsbhb80DnlOWMlGi5XEOiuBvNMr7NmNrjs3ktic9d3Rnr6nXFtHROI1paRhTljvJJ-d0ngjoJA1cOaiUbJssJEaIzTxtNCuzZACz0zjxxv26SW5o&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://prenniumofs.com/common/handlers/watson	false	Avira URL Cloud: safe	unknown
https://spo.nel.measure.office.net/api/report?tenantId=67bb197b-b9fb-4d1d-bdea-510c010d61e6&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=161.77.13.0	false	Avira URL Cloud: safe	unknown
https://upload.fp.measure.office.com/r.gif?MonitorID=O365se&rid=0d1486cd1309b55df31c49718a177db6&w3c=true&prot=https:&v=20190214&tag=[{%22TenantId%22:%2267bb197b-b9fb-4d1d-bdea-510c010d61e6%22,%22AppId%22:%22Documents%22}]&DATA=[{%22RequestID%22:%22577cf093c99335aac213bf037bd04ff3%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1059,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22HEL%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22577cf093c99335aac213bf037bd04ff3%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:992,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22HEL%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22outlook.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:615,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22MNZ%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22outlook.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:506,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22MNZ%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22tr-ooc-atm.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22cold%22,%22Result%22:1390,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22XSP%22,%22Fe%22:%22cafe%22},{%22RequestID%22:%22tr-ooc-atm.office.com%22,%22Object%22:%22trans.gif%22,%22Conn%22:%22warm%22,%22Result%22:1289,%22T%22:128,%22Rip%22:%22161.77.13.0%22,%22Ep%22:%22XSP%22,%22Fe%22:%22cafe%22}]	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/d/9261846f8cb01819/1742938310201/t9vKYmGlrHEaDQ8	false	Avira URL Cloud: safe	unknown
https://prenniumofs.com/	false	Avira URL Cloud: safe	unknown
https://thetti-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=9261846f8cb01819&lang=auto	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351510414445.MzQ3MTI2ZjAtMDU4Mi00MzM1LTgzNGMtYmNmZDlkNzljZTMwMTFmNzc1ZDgtNTdiYi00NTg5LTgzODYtMjYxNWQ5YzJkNmVh&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=c904392d-a1a9-4480-ba3d-c890a8f93f53&state=peCnNKyjLVHuhEaLe3pETL5LF6Vjb9h2HcchYZ0S5wZ0e6OVm-wnFYL3qnyw4pdBZkda87qIIRkaRoNcNCNeF-OqDIzFvI40rgPl5NLs4vuBKuVkqK5Syv7wjXYmkYHTA8XmDvPhXF5xdxiZ0cgZONirHc92EDtf-3UB4jGMrNe0BezefhC8GTRpMbJcMsXcRMkmyX0RwL8kBcVSMTcPs3uw5n9ePArWyl6WkM-Vml22YQkZEudbFQT-FV_f-__aCmjlbNA5RvrVvHDBmaqjHD-8sJZtUbZN58XRBHTLxrhLN_a7lqDmfy44ne5j9Dr9QhaDcwSh1RqhDRJDWxUw5rm8QarUCy9KaeJhBpzzUqE&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown
https://thetti-my.sharepoint.com/personal/kellieblack_thetti_com/_api/v2.1/graphql	false	Avira URL Cloud: safe	unknown
https://thetti-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&spartanOneDriveWireframe=true&streamViewServerLoad=true&streamInlineScript=true&compWWFlow=true&atomic=true&g=0&l2=true	false	Avira URL Cloud: safe	unknown
https://thetti-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx?odsp-web-prod_2025-03-14.003	false	Avira URL Cloud: safe	unknown
https://06ce4a55.a65b244135035fa567d4d337.workers.dev/favicon.ico	true	Avira URL Cloud: safe	unknown
https://homeoillcompany.net/?dnygxoni	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638785351469195374.ZDY0NDVlZDUtZDJmOS00ZDlmLWE2NTctYjFhNzlmN2RkYTY0NjQwYmQ5MmYtNDE0MS00YWRlLWJlOTQtNThmMjIwY2IyNzdk&ui_locales=en-US&mkt=en-US&msafed=0&client-request-id=f0f0b9d8-60e0-46ac-a7b3-8623b7187be6&state=dhUCWJ8pWMeG-mX4942_idIlM3GbUacw7Y1x3u2U7KooVT1i2eguD95yrUZWb0JGT432ewaUwInSjrsplSI2rC3fY9xzXOpf18QOlQLEsHqLJ1JHadqVbXh6F5orkOQbUVGGsFIz19dKldOHRdvzF85M8CRhzKl_QKy3Fo6cyemEwExYzhyMwh6wt5gAedVSbjMLgvU5nrp7iU7AAPXOxMAtQudWg-WTb81DNNo_YMX15Yb-qCWgZWX4iYSGV7PXghdt354N479_Y-84pJ38VEZKOrKG5-CRDbxgc-QiyPR5DdtNq3Q9n1GLJqYK6MxFQkLRHGcBtgCY3LN6IJ9_KWc1WbJnkDTj886LYKfynTg&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.6.156	b-0004.b-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.138.10	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.7	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
147.45.177.71	prenniumofs.com	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
23.204.152.206	unknown	United States	20940	AKAMAI-ASN1EU	false
52.96.157.114	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.32.1	06ce4a55.a65b244135035fa567d4d337.workers.dev	United States	13335	CLOUDFLARENETUS	true
13.89.179.11	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.101.65.162	hel-mvp.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.80.74	unknown	United States	15169	GOOGLEUS	false
13.107.6.163	b-0008.b-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.72	s-part-0044.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.42.16	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.204.152.199	unknown	United States	20940	AKAMAI-ASN1EU	false
142.251.40.100	www.google.com	United States	15169	GOOGLEUS	false
184.50.215.61	unknown	United States	16625	AKAMAI-ASUS	false
172.217.165.142	unknown	United States	15169	GOOGLEUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.136.13	e40491.dscg.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
52.123.129.14	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.42.65.85	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.182.141.63	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.182.143.215	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.112.1	unknown	United States	13335	CLOUDFLARENETUS	true
142.251.41.14	unknown	United States	15169	GOOGLEUS	false
40.101.65.210	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.40.195	unknown	United States	15169	GOOGLEUS	false
40.97.190.18	ooc-g2.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.204.152.220	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.136.154	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.9.156	b-0004.b-dc-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.42.73.27	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.89.178.26	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.208.16.95	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.179.84	unknown	United States	15169	GOOGLEUS	false
52.123.128.14	s-0005.dual-s-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.81.227	unknown	United States	15169	GOOGLEUS	false
52.96.111.82	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.201.174	unknown	United States	20940	AKAMAI-ASN1EU	false
23.204.152.212	a726.dscd.akamai.net	United States	20940	AKAMAI-ASN1EU	false
23.44.201.172	unknown	United States	20940	AKAMAI-ASN1EU	false
20.190.152.21	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.201.134	unknown	United States	20940	AKAMAI-ASN1EU	false
20.190.157.1	www.tm.a.prd.aadg.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.33.44.234	a1894.dscb.akamai.net	United States	20940	AKAMAI-ASN1EU	false
23.33.44.233	unknown	United States	20940	AKAMAI-ASN1EU	false
23.55.235.187	unknown	United States	20940	AKAMAI-ASN1EU	false
52.98.71.210	mira-ooc.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.35.163	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.5
192.168.2.16

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1648544
Start date and time:	2025-03-25 22:30:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://thetti-my.sharepoint.com/:f:/p/kellieblack/EtssBivICL5BgQEDfbETZP4BZsoHTOyxYMnSj46dgeiAiA?e=0t2fdm
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.phis.win@26/871@78/398

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded IPs from analysis (whitelisted): 142.250.80.110, 142.251.40.195, 142.251.179.84, 172.217.165.142
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, clientservices.googleapis.com, clients.l.google.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://thetti-my.sharepoint.com/:f:/p/kellieblack/EtssBivICL5BgQEDfbETZP4BZsoHTOyxYMnSj46dgeiAiA?e=0t2fdm

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unknown
Category:	downloaded
Size (bytes):	9039
Entropy (8bit):	5.584619662520499
Encrypted:	false
SSDEEP:
MD5:	74E87B62BA9EC123996760F445260FE7
SHA1:	01093091C4FC62DA596B1B58FDFAED7A940F2096
SHA-256:	AE793BF9FE0F91D889EC56477D8EA7A5CC84CFADBC1493852F17848D73F8BB05
SHA-512:	E2A156FD9476F61867799BA44E65560A6FEEEECE5ACFF825346F00ACB9766855181B541E092620EA6ED7B20140AD6DE1CC2F7AAF6EF03B04AA71FD12C8934966
Malicious:	false
Reputation:	unknown
URL:	https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-07.002/@ms/stream-bundle/chunks/52443.js
Preview:	"use strict";(self.webpackChunk_ms_stream_bundle=self.webpackChunk_ms_stream_bundle\|\|[]).push([[52443],{252443:(e,t,n)=>{n.d(t,{m:()=>A});var a=n(539155),i=n(912397),r=n(105003),o=n(811547),s=n(89310),c=n(382592),d=n(392756),l=n(41709),u=n(516426),f=n(386979),p=n(676514),m=n(379578),_=n(772305),h=n(344537),b=n(510941),g=n(80354),v=n(823140),y=n(636036),S=n(926136),D=n(548642),I=n(596409),x=n(136851),C=n(433548),O=n(695799),w=n(288820);const E=(0,O.X)({root:{mc9l5x:"fjseox",B7ck84d:"f1ewtqcl",B2u0y6b:"f132xexn",Bceei9c:"f158kwzp",Bahqtrf:"fk6fouc",Be2twd7:"fy9rknc",Bg96gwp:"fwrc4pm",Btd35i7:"fokg9q4",Beyfa6y:0,Bbmb7ep:0,Btl43ni:0,B7oj6ja:0,Dimara:"ft85np5",Bgfg5da:0,B9xav0g:0,oivjwe:0,Bn0qgzm:0,B4g9neb:0,zhjwy3:0,wvpqe5:0,ibv6hh:0,u1mtju:0,h3c5rm:0,vrafjx:0,Bekrc4i:0,i8vvqc:0,g2u3we:0,icvyot:0,B4j52fo:0,irswps:"f9ggezi",Byoj8tv:0,uwmqm3:0,z189sj:0,z8tnut:0,B0ocmuz:"f1bzqsji",De3pzq:"fxugw4r",sj55zd:"f19n0e5",Bhu2qc9:"fxeb0a7"},visible:{mc9l5x:"ftgm304"},inverted:{De3pzq:"fg3r6xk",sj55zd

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://thetti-my.sharepoint.com/:f:/p/kellieblack/EtssBivICL5BgQEDfbETZP4BZsoHTOyxYMnSj46dgeiAiA?e=0t2fdm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

Chrome Cache Entry: 2025

Chrome Cache Entry: 2026

Chrome Cache Entry: 2027

Chrome Cache Entry: 2028

Chrome Cache Entry: 2029

Chrome Cache Entry: 2030

Chrome Cache Entry: 2031

Chrome Cache Entry: 2032

Chrome Cache Entry: 2033

Chrome Cache Entry: 2034

Chrome Cache Entry: 2035

Chrome Cache Entry: 2037

Chrome Cache Entry: 2038

Chrome Cache Entry: 2040

Chrome Cache Entry: 2041

Chrome Cache Entry: 2042

Chrome Cache Entry: 2043

Chrome Cache Entry: 2044

Chrome Cache Entry: 2045

Chrome Cache Entry: 2046

Chrome Cache Entry: 2047

Chrome Cache Entry: 2048

Chrome Cache Entry: 2049

Chrome Cache Entry: 2050

Chrome Cache Entry: 2052

Chrome Cache Entry: 2053

Chrome Cache Entry: 2055

Chrome Cache Entry: 2056

Chrome Cache Entry: 2057

Chrome Cache Entry: 2058

Chrome Cache Entry: 2059

Chrome Cache Entry: 2060

Chrome Cache Entry: 2061

Chrome Cache Entry: 2062

Chrome Cache Entry: 2063

Chrome Cache Entry: 2065

Chrome Cache Entry: 2066

Windows Analysis Report
https://thetti-my.sharepoint.com/:f:/p/kellieblack/EtssBivICL5BgQEDfbETZP4BZsoHTOyxYMnSj46dgeiAiA?e=0t2fdm