Play interactive tourEdit tour

Windows Analysis Report
https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8N

Overview

General Information

Sample URL:	https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5L
Analysis ID:	1649008
Infos:

Detection

Score:	52
Range:	0 - 100
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

AI detected landing page (webpage, office document or email)

Creates files inside the system directory

Deletes files inside the Windows folder

Form action URLs do not match main URL

HTML body contains low number of good links

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

HTML title does not match URL

Submit button contains javascript call

Yara signature match

Classification

×

Joe Sandbox Signatures

• • Phishing
• • Compliance
• • Networking
• • System Summary
• • Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: https://assets-gbr.mkt.dynamics.com/3aac1d8f-8009-f011-b016-0022481a23a2/digitalassets/standaloneforms/28ff0232-b509-f011-bae3-7c1e5265170a	Joe Sandbox AI: Page contains button: 'VIEW DOCUMENT' Source: '5.11.pages.csv'
Source: https://assets-gbr.mkt.dynamics.com/3aac1d8f-8009-f011-b016-0022481a23a2/digitalassets/standaloneforms/28ff0232-b509-f011-bae3-7c1e5265170a	Joe Sandbox AI: Page contains button: 'VIEW DOCUMENT' Source: '5.18.pages.csv'

Form action URLs do not match main URL

Source: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc={30912a94-68c6-4020-9e34-dd1becc36f1d}&action=edit&wd=target%28MW%20RELOCATION%20SERVICES.one%7Cf9b0d9e6-1265-477f-9981-5317eb80a568%2FMW%20RELOCATION%20SERVCIES%20has%20just%20granted%20you%20access%20to%20this%20%7C0186c75f-f763-4213-a343-1d2dbf35d6b9%2F%29&wdorigin=NavigationUrl

HTTP Parser: Form action: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=8958a833-1918-4778-947c-4517f9136646&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=p08NCEnYdbS2p0Z9o0T5TtSDkVbJD0Z-aObyVm9eslU&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-3a4a-783a-812e-02118b63febb&state=eyJpZCI6IjAxOTVkMjJjLTNhNDktNzNkOC1iMTI5LTRiNjcyZWJjNWMzYSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&sso_reload=true sharepoint microsoftonline

Source: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc={30912a94-68c6-4020-9e34-dd1becc36f1d}&action=edit&wd=target%28MW%20RELOCATION%20SERVICES.one%7Cf9b0d9e6-1265-477f-9981-5317eb80a568%2FMW%20RELOCATION%20SERVCIES%20has%20just%20granted%20you%20access%20to%20this%20%7C0186c75f-f763-4213-a343-1d2dbf35d6b9%2F%29&wdorigin=NavigationUrl

HTTP Parser: Form action: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=f10cb4bb-7d7a-44b4-8cae-b8f6c78da87b&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=WbgpZYwC5M8CrahKNONe6YeWEjIqeAnsfWHkT48agNE&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-4599-7b8a-871c-0b9704822e45&state=eyJpZCI6IjAxOTVkMjJjLTQ1OTktNzM4Yy1iODNlLTVjYjRlOTIyMTIwMyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&sso_reload=true sharepoint microsoftonline

HTML body contains low number of good links

Source: https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3d

HTTP Parser: Number of links: 0

Source: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc={30912a94-68c6-4020-9e34-dd1becc36f1d}&action=edit&wd=target%28MW%20RELOCATION%20SERVICES.one%7Cf9b0d9e6-1265-477f-9981-5317eb80a568%2FMW%20RELOCATION%20SERVCIES%20has%20just%20granted%20you%20access%20to%20this%20%7C0186c75f-f763-4213-a343-1d2dbf35d6b9%2F%29&wdorigin=NavigationUrl

HTTP Parser: Number of links: 0

HTML body with high number of embedded images detected

Source: https://mwrelocation-my.sharepoint.com/:o:/r/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc=%7B30912a94-68c6-4020-9e34-dd1becc36f1d%7D&action=default&CID=1a9d6951-de38-43ab-a0d7-e9f9e058686c&_SRM=2%3AS%3A47	HTTP Parser: Total embedded image size: 99515
Source: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc={30912a94-68c6-4020-9e34-dd1becc36f1d}&action=edit&wd=target%28MW%20RELOCATION%20SERVICES.one%7Cf9b0d9e6-1265-477f-9981-5317eb80a568%2FMW%20RELOCATION%20SERVCIES%20has%20just%20granted%20you%20access%20to%20this%20%7C0186c75f-f763-4213-a343-1d2dbf35d6b9%2F%29&wdorigin=NavigationUrl	HTTP Parser: Total embedded image size: 162038

HTML page contains hidden javascript code

Source: https://mwrelocation-my.sharepoint.com/:o:/r/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc=%7B30912a94-68c6-4020-9e34-dd1becc36f1d%7D&action=default&CID=1a9d6951-de38-43ab-a0d7-e9f9e058686c&_SRM=2%3AS%3A47

HTTP Parser: Base64 decoded: {"typ":"JWT","alg":"RS256","x5t":"NLHNoPzBec3jLlQsSYoL5Q1EgfE"}

HTML title does not match URL

Source: https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3d

HTTP Parser: Title: Sharing Link Validation does not match URL

Source: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc={30912a94-68c6-4020-9e34-dd1becc36f1d}&action=edit&wd=target%28MW%20RELOCATION%20SERVICES.one%7Cf9b0d9e6-1265-477f-9981-5317eb80a568%2FMW%20RELOCATION%20SERVCIES%20has%20just%20granted%20you%20access%20to%20this%20%7C0186c75f-f763-4213-a343-1d2dbf35d6b9%2F%29&wdorigin=NavigationUrl

HTTP Parser: Title: Redirecting does not match URL

Submit button contains javascript call

Source: https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3d

HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))

HTML page is missing a favicon

Source: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc={30912a94-68c6-4020-9e34-dd1becc36f1d}&action=edit&wd=target%28MW%20RELOCATION%20SERVICES.one%7Cf9b0d9e6-1265-477f-9981-5317eb80a568%2FMW%20RELOCATION%20SERVCIES%20has%20just%20granted%20you%20access%20to%20this%20%7C0186c75f-f763-4213-a343-1d2dbf35d6b9%2F%29&wdorigin=NavigationUrl	HTTP Parser: No favicon
Source: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc={30912a94-68c6-4020-9e34-dd1becc36f1d}&action=edit&wd=target%28MW%20RELOCATION%20SERVICES.one%7Cf9b0d9e6-1265-477f-9981-5317eb80a568%2FMW%20RELOCATION%20SERVCIES%20has%20just%20granted%20you%20access%20to%20this%20%7C0186c75f-f763-4213-a343-1d2dbf35d6b9%2F%29&wdorigin=NavigationUrl	HTTP Parser: No favicon
Source: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc={30912a94-68c6-4020-9e34-dd1becc36f1d}&action=edit&wd=target%28MW%20RELOCATION%20SERVICES.one%7Cf9b0d9e6-1265-477f-9981-5317eb80a568%2FMW%20RELOCATION%20SERVCIES%20has%20just%20granted%20you%20access%20to%20this%20%7C0186c75f-f763-4213-a343-1d2dbf35d6b9%2F%29&wdorigin=NavigationUrl	HTTP Parser: No favicon
Source: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc={30912a94-68c6-4020-9e34-dd1becc36f1d}&action=edit&wd=target%28MW%20RELOCATION%20SERVICES.one%7Cf9b0d9e6-1265-477f-9981-5317eb80a568%2FMW%20RELOCATION%20SERVCIES%20has%20just%20granted%20you%20access%20to%20this%20%7C0186c75f-f763-4213-a343-1d2dbf35d6b9%2F%29&wdorigin=NavigationUrl	HTTP Parser: No favicon
Source: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc={30912a94-68c6-4020-9e34-dd1becc36f1d}&action=edit&wd=target%28MW%20RELOCATION%20SERVICES.one%7Cf9b0d9e6-1265-477f-9981-5317eb80a568%2FMW%20RELOCATION%20SERVCIES%20has%20just%20granted%20you%20access%20to%20this%20%7C0186c75f-f763-4213-a343-1d2dbf35d6b9%2F%29&wdorigin=NavigationUrl	HTTP Parser: No favicon
Source: https://assets-gbr.mkt.dynamics.com/3aac1d8f-8009-f011-b016-0022481a23a2/digitalassets/standaloneforms/28ff0232-b509-f011-bae3-7c1e5265170a	HTTP Parser: No favicon
Source: https://assets-gbr.mkt.dynamics.com/3aac1d8f-8009-f011-b016-0022481a23a2/digitalassets/standaloneforms/28ff0232-b509-f011-bae3-7c1e5265170a	HTTP Parser: No favicon
Source: https://assets-gbr.mkt.dynamics.com/3aac1d8f-8009-f011-b016-0022481a23a2/digitalassets/standaloneforms/28ff0232-b509-f011-bae3-7c1e5265170a	HTTP Parser: No favicon
Source: https://assets-gbr.mkt.dynamics.com/3aac1d8f-8009-f011-b016-0022481a23a2/digitalassets/standaloneforms/28ff0232-b509-f011-bae3-7c1e5265170a	HTTP Parser: No favicon

META author tag missing

Source: https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3d	HTTP Parser: No <meta name="author".. found
Source: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc={30912a94-68c6-4020-9e34-dd1becc36f1d}&action=edit&wd=target%28MW%20RELOCATION%20SERVICES.one%7Cf9b0d9e6-1265-477f-9981-5317eb80a568%2FMW%20RELOCATION%20SERVCIES%20has%20just%20granted%20you%20access%20to%20this%20%7C0186c75f-f763-4213-a343-1d2dbf35d6b9%2F%29&wdorigin=NavigationUrl	HTTP Parser: No <meta name="author".. found
Source: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc={30912a94-68c6-4020-9e34-dd1becc36f1d}&action=edit&wd=target%28MW%20RELOCATION%20SERVICES.one%7Cf9b0d9e6-1265-477f-9981-5317eb80a568%2FMW%20RELOCATION%20SERVCIES%20has%20just%20granted%20you%20access%20to%20this%20%7C0186c75f-f763-4213-a343-1d2dbf35d6b9%2F%29&wdorigin=NavigationUrl	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3d	HTTP Parser: No <meta name="copyright".. found
Source: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc={30912a94-68c6-4020-9e34-dd1becc36f1d}&action=edit&wd=target%28MW%20RELOCATION%20SERVICES.one%7Cf9b0d9e6-1265-477f-9981-5317eb80a568%2FMW%20RELOCATION%20SERVCIES%20has%20just%20granted%20you%20access%20to%20this%20%7C0186c75f-f763-4213-a343-1d2dbf35d6b9%2F%29&wdorigin=NavigationUrl	HTTP Parser: No <meta name="copyright".. found
Source: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc={30912a94-68c6-4020-9e34-dd1becc36f1d}&action=edit&wd=target%28MW%20RELOCATION%20SERVICES.one%7Cf9b0d9e6-1265-477f-9981-5317eb80a568%2FMW%20RELOCATION%20SERVCIES%20has%20just%20granted%20you%20access%20to%20this%20%7C0186c75f-f763-4213-a343-1d2dbf35d6b9%2F%29&wdorigin=NavigationUrl	HTTP Parser: No <meta name="copyright".. found

Compliance

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.41.4:443 -> 192.168.2.17:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.243.74:443 -> 192.168.2.17:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.219.36.101:443 -> 192.168.2.17:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.90.133.97:443 -> 192.168.2.17:50161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.111.227.3:443 -> 192.168.2.17:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.235.250:443 -> 192.168.2.17:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.144.160:443 -> 192.168.2.17:50197 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.144.160:443 -> 192.168.2.17:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.51.149.65:443 -> 192.168.2.17:50222 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.118.9.29:443 -> 192.168.2.17:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.45.193.219:443 -> 192.168.2.17:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50227 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50240 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50242 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.45.193.219:443 -> 192.168.2.17:50243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50244 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.131.0:443 -> 192.168.2.17:50268 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.131.0:443 -> 192.168.2.17:50269 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.131.0:443 -> 192.168.2.17:50282 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.131.0:443 -> 192.168.2.17:50283 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.111.229.20:443 -> 192.168.2.17:50303 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.111.229.20:443 -> 192.168.2.17:50318 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.131.0:443 -> 192.168.2.17:50325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.235.187:443 -> 192.168.2.17:50360 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.57.90.112:443 -> 192.168.2.17:50361 version: TLS 1.2

Binary contains paths to debug symbols

Source:	Binary string: this.vb[t.a.$4a]=B;u.rZb(this);this.ZIb()}MGa(){return r.b(this.Mb.CommandValueId)?this.Mb.MenuItemId:this.Mb.CommandValueId}YL(){return""}get id(){return this._id}get $ea(){return!1}get Hn(){return this.rXc}get A3(){return!!Ua.AFrameworkApplication.fa&&Ua.AFrameworkApplication.fa.Ea.qE}ZIb(){if(!this.behavior){var u=L.a.Pdb;u&&(this.behavior=u.ucf(this))}}get Mb(){return this.$a}get vb(){r.c(this.JTa)&&(this.JTa={});return this.JTa}get nFa(){r.c(this.gOa)&&(this.gOa={});return this.gOa}get iSb(){return m.a.Pf(this.Mb.IsDefinitive)}get Apb(){return m.a.Vy(this.Mb.ShouldSetTitle)}get fPc(){return this.Mb.TemplateAlias}get Iz(){return this.dK? source: chromecache_243.1.dr
Source:	Binary string: x=d(96012),z=d(60629),u=d(62280),B=d(73225),F=d(50625),D=d(13059),C=d(65097),I=d(72974),M=d(93168),K=d(48703),R=d(67590),T=d(79587),v=d(50952),N=d(44914);class Q{constructor(){this.MX=!1;this.EJe=this.PDb=0}ev(){return!0}iA(O){this.PDb=O.clientPoint.x;this.EJe=C.App.ha.oa.lg.container.clientWidth;return this.MX=!0}gt(O){this.MX&&C.App.ha.oa.lg.resize(this.EJe+r.a.V2f(O.clientPoint.x-this.PDb));return!0}gq(){this.cNb()}oB(){this.cNb()}cNb(){this.MX=!1;C.App.ha.cfa()}dispose(){}}(0,E.a)(Q,"NavigationPaneResizeAdapter", source: chromecache_374.1.dr
Source:	Binary string: null;this.pDb=this.AQa=!1;this.Opd=(x,z)=>{this.Kpa.insert(0,new L(z.commandId,z.controlId,z.time,z.commandSurface,z.inputMethod,z.contentType,z.w9));this.U5a(this.Kpa);this.AQa&&this.Xaa.MOd(z.controlId)&&this.Whd(z)}}init(){this.Xaa=new d;this.Kpa=new Ca.a;this.T$=new Ca.a;this.xBa=new Ca.a;this.jRa=k.AFrameworkApplication.J.tb("MaxCommandClickedEventQueueSize",20);l.a.ojd(this.Opd);r.a.instance.kjd((0,Ja.a)(this,this.T4d,"recordActionEvent"));this.AQa=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.UserMRUActionsCookieEnabled", source: chromecache_243.1.dr
Source:	Binary string: Jc._instance=null;(0,m.a)(Jc,"ControlBehaviorFactory",null,[784]);class Hd{get name(){return"CUI.Behavior"}configure(Sa){z.AFrameworkApplication.J&&z.AFrameworkApplication.J.Z("AccessibleMovingDialogsEnabled")&&Sa.tu($o,[pn.a]);Sa.tu(bu,[Fd.a])}async initializeAsync(){lc.a.Pdb=Jc.instance;const Sa=Qi.a.instance.AKc;for(let jb=0;jb<Sa.length;++jb){const zb=(0,C.a)(373,Sa[jb]);zb&&zb.MO()}Kh.a.get_instance().zr(6)}dispose(){}static main(){u.a.instance.hq(new Hd,5)}}(0,m.a)(Hd,"CuiBehaviorPackage",null, source: chromecache_243.1.dr
Source:	Binary string: this.Xaa.MOd(z.controlId)&&this.Whd(z)}}init(){this.Xaa=new d;this.Kpa=new Ca.a;this.T$=new Ca.a;this.xBa=new Ca.a;this.jRa=k.AFrameworkApplication.J.tb("MaxCommandClickedEventQueueSize",20);l.a.ojd(this.Opd);r.a.instance.kjd((0,Ja.a)(this,this.T4d,"recordActionEvent"));this.AQa=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.UserMRUActionsCookieEnabled",!1);this.pDb=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.ShouldPreferParentControls", source: chromecache_293.1.dr
Source:	Binary string: this.ga.resolve("Box4.Actors.StyleActor").ib()}dispose(){}static main(){u.a.instance.Rd(new QC)}}(0,m.a)(QC,"Box4ActorsPackage",null,[0,1]);class hl{constructor(Sa,jb,zb,Kb,Vb,pc){this.rpe=this.Epa=null;this.ia=Sa;this.UHg=jb;this.l7c=zb;this.Vm=Kb;this.mc=Vb;this.Ci=pc}get recentColors(){return hl.OBb||(hl.OBb=ff.a.instance.va("Box4.UI.RecentColorsSectionHandler"))}get Aae(){this.Epa||(this.Epa=new oF("Shading"),this.iRb(this.Epa));return this.Epa}iRb(Sa){Sa.CEa(2,jj.a.pdb);Sa.CEa(3,jj.a.gga);Sa.CEa(4, source: chromecache_243.1.dr
Source:	Binary string: null,[]);class h{constructor(x,z,u,B){this.CmdId=this.ParentTcid=this.Tcid=null;this.Time=0;this.Tcid=x;this.ParentTcid=z;this.CmdId=u;this.Time=B}}(0,Fa.a)(h,"MRUControl",null,[]);var k=J(51647),l=J(76327),r=J(50478),t=J(62733);class m{constructor(){this.Xaa=null;this.uzb=this.jRa=20;this.ora=this.yz=this.xBa=this.T$=this.Kpa=null;this.pDb=this.AQa=!1;this.Opd=(x,z)=>{this.Kpa.insert(0,new L(z.commandId,z.controlId,z.time,z.commandSurface,z.inputMethod,z.contentType,z.w9));this.U5a(this.Kpa);this.AQa&& source: chromecache_293.1.dr
Source:	Binary string: I.activeSection&&(I=I.activeSection.Yb(M))&&(C=I.label);m.a.xu(K,C)}static z1a(){m.a.eo(F.AppFrame.Yea)}}(0,E.a)(D,"ASectionListView",m.a,[])},56805:function(E,L,d){d.d(L,{a:function(){return M}});E=d(100);var h=d(77072),k=d(57531),l=d(96012),r=d(60629),t=d(73225),m=d(93651),x=d(65097),z=d(305),u=d(71987),B=d(79587),F=d(19655),D=d(50952),C=d(87478);class I{constructor(K){this.MX=!1;this.FJe=this.PDb=0;this.eF=K}ev(){return this.eF.eod()}iA(K){if(!this.ev(K))return this.MX=!1;this.PDb=K.clientPoint.x; source: chromecache_374.1.dr
Source:	Binary string: this.FJe=this.eF.container.clientWidth;return this.MX=!0}gt(K){this.MX&&this.eF.resize(this.FJe+C.a.V2f(K.clientPoint.x-this.PDb));return!0}gq(){this.cNb()}oB(){this.cNb()}cNb(){this.MX=!1;x.App.ha.cfa()}dispose(){}}(0,E.a)(I,"ListViewResizeAdapter",null,[431,44]);class M extends m.a{constructor(K){super(new F.a,m.a.Ywc,x.App.bX);this.Gba=this.aY=this.vaa=this.nU=this.FX=this.OBa=null;this.isa=4294967295;this.cCa=!1;this.JN=!0;this.zz=K}get resizeMinWidth(){return 0}get resizeMaxWidth(){return 350}get Wda(){return this.OBa}get QHa(){return this.vaa}get Sla(){return this.FX}get $Sb(){return!0}get isCollapsed(){return this.cCa}set isCollapsed(K){this.cCa= source: chromecache_374.1.dr
Source:	Binary string: 1028);this.ia.la(jj.a.pdb,Sl.a.view,rA.BNb);this.ia.la(jj.a.pdb,Sl.a.tableCell,(0,ye.a)(this,this.pdb,"clearCellShadingColor"));this.ia.Wb(jj.a.pdb,1028);this.ia.la(jj.a.a3a,Sl.a.view,(0,ye.a)(this,this.VSi,"queryCellShadingColorView"));this.ia.la(jj.a.a3a,Sl.a.tableCell,(0,ye.a)(this,this.a3a,"queryCellShadingColor"));this.ia.Wb(jj.a.a3a,1124);this.ia.la(jj.a.f0b,Sl.a.view,rA.BNb);this.ia.la(jj.a.f0b,Sl.a.tableCell,(0,ye.a)(this,this.S0g,"cellShadingCustomColor"));this.ia.Wb(jj.a.f0b,1028);this.ia.la(jj.a.hSf, source: chromecache_243.1.dr
Source:	Binary string: Ua.AFrameworkApplication.fa.Ea.qE}ZIb(){if(!this.behavior){var u=L.a.Pdb;u&&(this.behavior=u.ucf(this))}}get Mb(){return this.$a}get vb(){r.c(this.JTa)&&(this.JTa={});return this.JTa}get nFa(){r.c(this.gOa)&&(this.gOa={});return this.gOa}get iSb(){return m.a.Pf(this.Mb.IsDefinitive)}get Apb(){return m.a.Vy(this.Mb.ShouldSetTitle)}get fPc(){return this.Mb.TemplateAlias}get Iz(){return this.dK?E.a.bSe:E.a.BH}aYa(u){if(-1===this.daa.indexOf(","+u+","))throw Error.create("The display mode with name: "+ source: chromecache_293.1.dr
Source:	Binary string: 4034531111;h.Cta=319972657;h.VVa=1892407702;h.QHb=329522368;h.Hca=3386890908;h.WHb=70356481;h.bIb=1303135280;h.centerJustify=4284004393;h.eFa=3332601592;h.W0g=3523575366;h.fdb=1880533947;h.gdb=768894625;h.Y0g=3230325101;h.dIb=2981608035;h.Olc=3502060538;h.hdb=4291024442;h.Iod=1943062421;h.g1g=3246658478;h.EVe=3281315808;h.DVe=3968581736;h.cC=2858610352;h.pdb=3275596206;h.rdb=562361573;h.U1=3491966299;h.clearFormatting=2319895756;h.gpd=2449130731;h.iWa=1011300372;h.wXe=3589727007;h.uIb=3901727243; source: chromecache_374.1.dr
Source:	Binary string: !0);this.AQa&&(this.yz=new Ca.a,this.ora="UserRecentActions_"+this.bgb(),this.AQd())}bgb(){switch(k.AFrameworkApplication.fa.Ea.Ng){case 3:return"Word";case 1:return"Excel";case 2:return"PowerPoint";case 5:return"Visio";case 4:return"OneNote";default:return"Unknown"}}AQd(){var x=t.a.get(this.ora);if(!this.Xaa.isNullOrUndefined(x)&&0<x.length){let z=null;try{z=JSON.parse(decodeURIComponent(x))}catch(u){t.a.remove(this.ora);return}x=0;for(const u of z)this.yz.insert(x++,u)}}Whd(x){const z=this.pDb&& source: chromecache_293.1.dr
Source:	Binary string: return}x=0;for(const u of z)this.yz.insert(x++,u)}}Whd(x){const z=this.pDb&&!this.Xaa.isNullOrUndefined(x.w9)&&0<x.w9.length;if(0<this.yz.count){for(var u=0;u<this.yz.count&&3>u;u++){var B=this.yz.K(u);if(z&&B.ParentTcid===x.w9||B.Tcid===x.controlId)return}for(u=3;u<this.yz.count;u++)if(B=this.yz.K(u),z&&B.ParentTcid===x.w9||B.Tcid===x.controlId){this.yz.remove(B);break}}this.yz.insert(0,new h(x.controlId,x.w9,x.commandId,x.time));this.yz.count>this.uzb&&this.yz.removeAt(this.uzb);x=JSON.stringify(this.yz.toArray()); source: chromecache_243.1.dr
Source:	Binary string: !1);this.pDb=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.ShouldPreferParentControls",!0);this.AQa&&(this.yz=new Ca.a,this.ora="UserRecentActions_"+this.bgb(),this.AQd())}bgb(){switch(k.AFrameworkApplication.fa.Ea.Ng){case 3:return"Word";case 1:return"Excel";case 2:return"PowerPoint";case 5:return"Visio";case 4:return"OneNote";default:return"Unknown"}}AQd(){var x=t.a.get(this.ora);if(!this.Xaa.isNullOrUndefined(x)&&0<x.length){let z=null;try{z=JSON.parse(decodeURIComponent(x))}catch(u){t.a.remove(this.ora); source: chromecache_243.1.dr

Networking

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3d HTTP/1.1Host: mwrelocation-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=EngZ22kxN1amsNu1syGySAGO-SEFaQZY5KNnq09Xws9Wo8Bh5gXP-1xcbUCECi_UQ1r2S6vWdYNcAANb_vOSjmiXq0u-_V3XoLG2p_bhsmc1&t=638768124586963462 HTTP/1.1Host: mwrelocation-my.sharepoint.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3dAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=Qw2YfdyMo1iEo5cd-JpoFhpAI6K6f_yvmKfnrNz_xa1uWft9p0NBUImsGKWXyh6uaYXGqLLMYsdESPT46GW34ZeqxlavDZ7-DoqDqBScBiO1v9BxiMimBHVSSyh3bJ0ymZj6YTle5JcTCnfybvN59Fg3TgX1Qc5PeECXgD-1V541&t=ffffffffc7a8e318 HTTP/1.1Host: mwrelocation-my.sharepoint.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3dAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=XNwBCK5604SApw3-LHW5yB6E6NJZTPk_LpM9svBjwPXx0w4K7HgVZwTSJ9B7RL4nDxFXpPgANfYHFpzuDw1e5wCvEPZw9H3T_8LO6FT5a9VQXguyDYZpe-C9rywEKiL4e_7ku1x8-Mx8theU3mlBaUkvGfqDB-TPyT_JITfnp9hQUOrebhyABGB_ZxsdF_Fr0&t=2a9d95e3 HTTP/1.1Host: mwrelocation-my.sharepoint.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3dAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=r5G0kU5xycazIIoAaW6j1y6zveZLj_nvkjoK70EGTVNVxjBCiS_gDsEXSJK1OpoYzk6xVpfCbdA0HC8wpav8LyWkC8uz219R-kkMUtmHVronjCqnvqUCR9SOpsFllpz5ziTAGno_ZpJ5Mfjjfc7p6KeHBx0oUptaWbOq8Gz9zveSmHeOp4KSVKooM4yvO6mA0&t=2a9d95e3 HTTP/1.1Host: mwrelocation-my.sharepoint.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3dAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/microsoft-logo.png HTTP/1.1Host: mwrelocation-my.sharepoint.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3dAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/microsoft-logo.png HTTP/1.1Host: mwrelocation-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: mwrelocation-my.sharepoint.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3dAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: mwrelocation-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v5s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /personal/mark_muss_mwrelo_com/_layouts/15/Doc.aspx?sourcedoc=%7B30912a94-68c6-4020-9e34-dd1becc36f1d%7D&action=default&slrid=8e458ea1-f03d-c000-578a-13ccc21ad095&CID=1a9d6951-de38-43ab-a0d7-e9f9e058686c&_SRM=2:S:47 HTTP/1.1Host: mwrelocation-my.sharepoint.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/guestaccess.aspx?e=5%3ak0pMsO&at=9&share=EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2FndWVzdCNyb25uaWUuZHVuY2FuQGsyY29ycG9yYXRlbW9iaWxpdHkuY29tLDAjLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2FndWVzdCNyb25uaWUuZHVuY2FuQGsyY29ycG9yYXRlbW9iaWxpdHkuY29tLDEzMzg3NDYxNzU3MDAwMDAwMCwwLDEzMzg3NTQ3ODU3MzE2MjM3MCwwLjAuMC4wLDEwMjYsNzQ5ZjA3MzUtNmM2NC00YzBkLTg0ZDEtYTcxZDljMmU1NjlmLCwsOGU0NThlYTEtZjAzZC1jMDAwLTU3OGEtMTNjY2MyMWFkMDk1LDhlNDU4ZWExLWYwM2QtYzAwMC01NzhhLTEzY2NjMjFhZDA5NSxyK3IyVGJDaEpVS2pYWCtGM3RUSnFBLDEzMzg3NDYxNDU3MzE2MjQxMiwwLDAsLCwsMjY1MDQ2Nzc0Mzk5OTk5OTk5OSwwLCwsLCwsLDAsLDE5MDIyNCxOTEhOb1B6QmVjM2pMbFFzU1lvTDVRMUVnZkUseFBVeHd2bS9BRHVNQ1F6dERHRExjd3pxNytadGdIa1FGbC9XVElFa2VjSXMxaGFsRXpSV1pNS0pWY0pRVys1SEo4MG9Sb21WbkFJSUdSOHRNQ2lKQmVQZ0d0Q0FDVTMwVUlTKzJIcTlOY0VIZWtyQ1BFdG5kZlBzVzgvYUxVeTZleXplVm1wdlBHZ3c5MzloUWlld3dUQWhOZU5GYWJMMUVOamRBZVN0dytWTnFnT1RsdnlGVG9rZENiTkR0WE1Xamc1SjJyOXNoRVFBa2ZVVkdWOTNnMlNveWx1a2piQTR3NUtaTWFzVzl1MTlrSHFDeVJZUkw2STBubGRnTk8vdGl1R1lVS2l2WkFBNnVjR0tLNExEL1ZKWXQ0NVd2emdmaC9yei9VSDRrTWZvbTZjWERENW9pWng4RzFpSCtYek9xT1ozL0gweWxaaERzNnlOMW95SEVRPT08L1NQPg==
Source: global traffic	HTTP traffic detected: GET /files/fabric/assets/icons/fabricmdl2icons.woff HTTP/1.1Host: spoprod-a.akamaihd.netConnection: keep-aliveOrigin: https://chc-onenote.officeapps.live.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://chc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /officeaddins/learningtools/?et= HTTP/1.1Host: www.onenote.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://chc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mydata/myprofile/expressionprofile/profilephoto:UserTileStatic,UserTileSmall/MeControlMediumUserTile?ck=1&ex=24&fofoff=1&sc=1742987867396 HTTP/1.1Host: storage.live.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://chc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /me?partner=OneNoteOnline&version=latest&market=EN-US&wrapperId=suiteshell HTTP/1.1Host: amcdn.msftauth.netConnection: keep-aliveOrigin: https://chc-onenote.officeapps.live.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://chc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: augloop.office.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://chc-onenote.officeapps.live.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: ZmbN2WBG/erpqJdYBuu4gg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /ajax/jQuery/jquery-3.5.0.min.js HTTP/1.1Host: ajax.aspnetcdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.onenote.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=8958a833-1918-4778-947c-4517f9136646&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=p08NCEnYdbS2p0Z9o0T5TtSDkVbJD0Z-aObyVm9eslU&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-3a4a-783a-812e-02118b63febb&state=eyJpZCI6IjAxOTVkMjJjLTNhNDktNzNkOC1iMTI5LTRiNjcyZWJjNWMzYSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /3aac1d8f-8009-f011-b016-0022481a23a2/digitalassets/standaloneforms/28ff0232-b509-f011-bae3-7c1e5265170a HTTP/1.1Host: assets-gbr.mkt.dynamics.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveOrigin: https://login.microsoftonline.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.0.5/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000110.resources.office.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Origin: https://chc-onenote.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2404.23003/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000096.resources.office.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Origin: https://chc-onenote.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2502.18015/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000128.resources.office.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Origin: https://chc-onenote.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2409.12011/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000138.resources.office.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Origin: https://chc-onenote.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2503.17004/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000012.resources.office.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Origin: https://chc-onenote.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.0.5/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000111.resources.office.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Origin: https://chc-onenote.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /officeaddins/RemoteUls.ashx HTTP/1.1Host: www.onenote.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2502.18015/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000128.resources.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2409.12011/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000138.resources.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2404.23003/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000096.resources.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.0.5/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000110.resources.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.2503.17004/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000012.resources.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /033f92d3-bc6d-439a-858a-a17acf70360a/1.0.0.5/en-us_web/manifest_web.xml HTTP/1.1Host: fa000000111.resources.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=f10cb4bb-7d7a-44b4-8cae-b8f6c78da87b&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=WbgpZYwC5M8CrahKNONe6YeWEjIqeAnsfWHkT48agNE&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-4599-7b8a-871c-0b9704822e45&state=eyJpZCI6IjAxOTVkMjJjLTQ1OTktNzM4Yy1iODNlLTVjYjRlOTIyMTIwMyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-PnsS0WzCIqI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEinBo5rfnVUoZ8FVcxxXZsKM0vOnwugu9Cgb4ZwKSRdjeQ1TUD5TIo8wMZVxxkYlqaiBe5f6HN3oVGLJGA40KURfkDGWDwpa93VoXAM9_kyTHmULI1dsTznBAIUpoxQV6BcSjNnl2BCSBmtWP7CI5BiAA; fpc=AnIDoBaXdphFnn2Z1l4fJ8Y; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEfhiDSbpPUPWZFqaoFYQ-E0xJqtpxJPJVnrRcuIPigb9yS8sc-7ijXyFL9TK0ycchvQcy8MwMaussRDL5x2pvdQmIZc4Ys82GKEbUxi97xvnRYTkOT6vVtJfn0GSPHI1Ol0ZhuXL2KbwRd7euZ8a_z8NNddD3ebkrtvsXa3J0YvQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=8958a833-1918-4778-947c-4517f9136646&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=p08NCEnYdbS2p0Z9o0T5TtSDkVbJD0Z-aObyVm9eslU&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-3a4a-783a-812e-02118b63febb&state=eyJpZCI6IjAxOTVkMjJjLTNhNDktNzNkOC1iMTI5LTRiNjcyZWJjNWMzYSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&sso_reload=true HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=8958a833-1918-4778-947c-4517f9136646&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=p08NCEnYdbS2p0Z9o0T5TtSDkVbJD0Z-aObyVm9eslU&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-3a4a-783a-812e-02118b63febb&state=eyJpZCI6IjAxOTVkMjJjLTNhNDktNzNkOC1iMTI5LTRiNjcyZWJjNWMzYSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7DAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-PnsS0WzCIqI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEinBo5rfnVUoZ8FVcxxXZsKM0vOnwugu9Cgb4ZwKSRdjeQ1TUD5TIo8wMZVxxkYlqaiBe5f6HN3oVGLJGA40KURfkDGWDwpa93VoXAM9_kyTHmULI1dsTznBAIUpoxQV6BcSjNnl2BCSBmtWP7CI5B
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=62ce14de-c25c-4807-a0c0-ec77dd8a68ee&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=FRWHwoj4D6Elm309WlECH7mhPEh0XOKsHd3mrC5L0Uk&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-497f-73f3-8779-dc1b0e13a33b&state=eyJpZCI6IjAxOTVkMjJjLTQ5N2YtNzY5Yi1hZmViLTFjY2I3NDQxYTA2NiIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-PnsS0WzCIqI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEinBo5rfnVUoZ8FVcxxXZsKM0vOnwugu9Cgb4ZwKSRdjeQ1TUD5TIo8wMZVxxkYlqaiBe5f6HN3oVGLJGA40KURfkDGWDwpa93VoXAM9_kyTHmULI1dsTznBAIUpoxQV6BcSjNnl2BCSBmtWP7CI5BiAA; fpc=AnIDoBaXdphFnn2Z1l4fJ8Y; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEfhiDSbpPUPWZFqaoFYQ-E0xJqtpxJPJVnrRcuIPigb9yS8sc-7ijXyFL9TK0ycchvQcy8MwMaussRDL5x2pvdQmIZc4Ys82GKEbUxi97xvnRYTkOT6vVtJfn0GSPHI1Ol0ZhuXL2KbwRd7euZ8a_z8NNddD3ebkrtvsXa3J0YvQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /3aac1d8f-8009-f011-b016-0022481a23a2/digitalassets/forms/28ff0232-b509-f011-bae3-7c1e5265170a HTTP/1.1Host: assets-gbr.mkt.dynamics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/plainsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://assets-gbr.mkt.dynamics.com/3aac1d8f-8009-f011-b016-0022481a23a2/digitalassets/standaloneforms/28ff0232-b509-f011-bae3-7c1e5265170aAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: assets-gbr.mkt.dynamics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://assets-gbr.mkt.dynamics.com/3aac1d8f-8009-f011-b016-0022481a23a2/digitalassets/standaloneforms/28ff0232-b509-f011-bae3-7c1e5265170aAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=f10cb4bb-7d7a-44b4-8cae-b8f6c78da87b&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=WbgpZYwC5M8CrahKNONe6YeWEjIqeAnsfWHkT48agNE&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-4599-7b8a-871c-0b9704822e45&state=eyJpZCI6IjAxOTVkMjJjLTQ1OTktNzM4Yy1iODNlLTVjYjRlOTIyMTIwMyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&sso_reload=true HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=f10cb4bb-7d7a-44b4-8cae-b8f6c78da87b&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=WbgpZYwC5M8CrahKNONe6YeWEjIqeAnsfWHkT48agNE&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-4599-7b8a-871c-0b9704822e45&state=eyJpZCI6IjAxOTVkMjJjLTQ1OTktNzM4Yy1iODNlLTVjYjRlOTIyMTIwMyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7DAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-PnsS0WzCIqI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEinBo5rfnVUoZ8FVcxxXZsKM0vOnwugu9Cgb4ZwKSRdjeQ1TUD5TIo8wMZVxxkYlqaiBe5f6HN3oVGLJGA40KURfkDGWDwpa93VoXAM9_kyTHmULI1dsTznBAIUpoxQV6BcSjNnl2BCSBmtWP7CI5B
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/3aac1d8f-8009-f011-b016-0022481a23a2/landingpageforms/captcha/script?fid=2072b9e9-8a4b-4f5a-88ad-7d32612cf0d2&type=visual&rnd=bec17c30-2680-44ea-bd1a-4545825c18fd&mkt=en HTTP/1.1Host: public-gbr.mkt.dynamics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=275748c6-801e-4556-9200-0c4355dd074a&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=7D9z4JtxaCgAHKB5ivyuHdqJybYMjpqSnZltT8t_YY4&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-5212-7100-a42c-535c8d2795b7&state=eyJpZCI6IjAxOTVkMjJjLTUyMTItNzUzMS1iMjU0LTU0N2FjNjZjMDk0ZCIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-PnsS0WzCIqI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEinBo5rfnVUoZ8FVcxxXZsKM0vOnwugu9Cgb4ZwKSRdjeQ1TUD5TIo8wMZVxxkYlqaiBe5f6HN3oVGLJGA40KURfkDGWDwpa93VoXAM9_kyTHmULI1dsTznBAIUpoxQV6BcSjNnl2BCSBmtWP7CI5BiAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEfhiDSbpPUPWZFqaoFYQ-E0xJqtpxJPJVnrRcuIPigb9yS8sc-7ijXyFL9TK0ycchvQcy8MwMaussRDL5x2pvdQmIZc4Ys82GKEbUxi97xvnRYTkOT6vVtJfn0GSPHI1Ol0ZhuXL2KbwRd7euZ8a_z8NNddD3ebkrtvsXa3J0YvQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; esctx-Z7JljtpSiQ=AQABCQEAAABVrSpeuWamRam2jAF1XRQEj3tWSd_n1iBoIEa5I60rHD__XHlpDcASPSTyS9ocd-4lGsYZDB1mKhQGsXNrLeOkzWhkVbYWu1GIFJ6T5PpwvKW4E_DYiSPxQsln7EVF3dkComzIymnwftEUr_fItgdHdSh0PDZv3FoFW1IwS3tlkCAA; buid=1.AXoAMe_N-B6jSkuT5F9XHpElWqNjPCR9JMVBnYN3iMQ_HEMBAAB6AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE3SaSVyGz2ZhA7KwCOLO7YSnkOamDxWUkMiYh1cE-366PuWArR2nlalkmZ3xTilj2cgo6fUso2l8JEuV4kjRoZG42u2GdmZwCGefgH1iVbsogAA; fpc=AnIDoBaXdphFnn2Z1l4fJ8apydlJAQAAAGLZdd8OAAAA
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/3aac1d8f-8009-f011-b016-0022481a23a2/landingpageforms/captcha/challenge/visual?flowId=2072b9e9-8a4b-4f5a-88ad-7d32612cf0d2&rnd=9272f716d2ed4f0e824d75d6adcb2f63&market=en HTTP/1.1Host: public-gbr.mkt.dynamics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=c978c231-20f0-4b3f-bd3f-53af6860b1a0&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=4KexUO_uSTFCXKcz2Mf-v2ZstgItrwi7UfUYxVFyOHo&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-5521-7f3e-b4ae-5d0d46f48a79&state=eyJpZCI6IjAxOTVkMjJjLTU1MjEtNzNiOS1hYTk5LTY0ZGU3YmIyZmVmMiIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-PnsS0WzCIqI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEinBo5rfnVUoZ8FVcxxXZsKM0vOnwugu9Cgb4ZwKSRdjeQ1TUD5TIo8wMZVxxkYlqaiBe5f6HN3oVGLJGA40KURfkDGWDwpa93VoXAM9_kyTHmULI1dsTznBAIUpoxQV6BcSjNnl2BCSBmtWP7CI5BiAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEfhiDSbpPUPWZFqaoFYQ-E0xJqtpxJPJVnrRcuIPigb9yS8sc-7ijXyFL9TK0ycchvQcy8MwMaussRDL5x2pvdQmIZc4Ys82GKEbUxi97xvnRYTkOT6vVtJfn0GSPHI1Ol0ZhuXL2KbwRd7euZ8a_z8NNddD3ebkrtvsXa3J0YvQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; esctx-Z7JljtpSiQ=AQABCQEAAABVrSpeuWamRam2jAF1XRQEj3tWSd_n1iBoIEa5I60rHD__XHlpDcASPSTyS9ocd-4lGsYZDB1mKhQGsXNrLeOkzWhkVbYWu1GIFJ6T5PpwvKW4E_DYiSPxQsln7EVF3dkComzIymnwftEUr_fItgdHdSh0PDZv3FoFW1IwS3tlkCAA; buid=1.AXoAMe_N-B6jSkuT5F9XHpElWqNjPCR9JMVBnYN3iMQ_HEMBAAB6AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQE3SaSVyGz2ZhA7KwCOLO7YSnkOamDxWUkMiYh1cE-366PuWArR2nlalkmZ3xTilj2cgo6fUso2l8JEuV4kjRoZG42u2GdmZwCGefgH1iVbsogAA; fpc=AnIDoBaXdphFnn2Z1l4fJ8apydlJAQAAAGLZdd8OAAAA
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/3aac1d8f-8009-f011-b016-0022481a23a2/landingpageforms/captcha/challenge/visual?flowId=2072b9e9-8a4b-4f5a-88ad-7d32612cf0d2&rnd=9272f716d2ed4f0e824d75d6adcb2f63&market=en HTTP/1.1Host: public-gbr.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/3aac1d8f-8009-f011-b016-0022481a23a2/landingpageforms/forms/28ff0232-b509-f011-bae3-7c1e5265170a/visits HTTP/1.1Host: public-gbr.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=fe74cae5-6065-4c49-9eee-f6953cda57e5&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=IgLeXnSs0Pm1FiF6LYfSO5WnaBVasmlW19N2P-CLyxk&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-61b0-721e-8def-67f2fe97ad72&state=eyJpZCI6IjAxOTVkMjJjLTYxYWYtNzYzMS1iZjZmLWM0ZjkyY2ZmZmYzNiIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-PnsS0WzCIqI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEinBo5rfnVUoZ8FVcxxXZsKM0vOnwugu9Cgb4ZwKSRdjeQ1TUD5TIo8wMZVxxkYlqaiBe5f6HN3oVGLJGA40KURfkDGWDwpa93VoXAM9_kyTHmULI1dsTznBAIUpoxQV6BcSjNnl2BCSBmtWP7CI5BiAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEfhiDSbpPUPWZFqaoFYQ-E0xJqtpxJPJVnrRcuIPigb9yS8sc-7ijXyFL9TK0ycchvQcy8MwMaussRDL5x2pvdQmIZc4Ys82GKEbUxi97xvnRYTkOT6vVtJfn0GSPHI1Ol0ZhuXL2KbwRd7euZ8a_z8NNddD3ebkrtvsXa3J0YvQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; esctx-Z7JljtpSiQ=AQABCQEAAABVrSpeuWamRam2jAF1XRQEj3tWSd_n1iBoIEa5I60rHD__XHlpDcASPSTyS9ocd-4lGsYZDB1mKhQGsXNrLeOkzWhkVbYWu1GIFJ6T5PpwvKW4E_DYiSPxQsln7EVF3dkComzIymnwftEUr_fItgdHdSh0PDZv3FoFW1IwS3tlkCAA; fpc=AnIDoBaXdphFnn2Z1l4fJ8apydlJAgAAAGLZdd8OAAAA; buid=1.AXoAMe_N-B6jSkuT5F9XHpElWqNjPCR9JMVBnYN3iMQ_HEMBAAB6AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEMxxWeYMU2a8E5dA84ovtnMC4qSpeD9bLdnBL55HkNMOUCl8FXkoiwM7vSiOygmCh26czhptq9H_vjOo0EEAlx-MrjGn4fgRAp_SRh_RJuHMgAA
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=d231e8a7-83c5-4823-8098-11a454b0620c&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=s-x2xYeWw8SQYMPdA3tm4819oDDL63wTyiAWI85-brs&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-6249-7ea6-b7f0-4ecec5e7aaef&state=eyJpZCI6IjAxOTVkMjJjLTYyNDktNzkzNi04ZWM5LWJmNGFhZDNjZDQ2NiIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-PnsS0WzCIqI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEinBo5rfnVUoZ8FVcxxXZsKM0vOnwugu9Cgb4ZwKSRdjeQ1TUD5TIo8wMZVxxkYlqaiBe5f6HN3oVGLJGA40KURfkDGWDwpa93VoXAM9_kyTHmULI1dsTznBAIUpoxQV6BcSjNnl2BCSBmtWP7CI5BiAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEfhiDSbpPUPWZFqaoFYQ-E0xJqtpxJPJVnrRcuIPigb9yS8sc-7ijXyFL9TK0ycchvQcy8MwMaussRDL5x2pvdQmIZc4Ys82GKEbUxi97xvnRYTkOT6vVtJfn0GSPHI1Ol0ZhuXL2KbwRd7euZ8a_z8NNddD3ebkrtvsXa3J0YvQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; esctx-Z7JljtpSiQ=AQABCQEAAABVrSpeuWamRam2jAF1XRQEj3tWSd_n1iBoIEa5I60rHD__XHlpDcASPSTyS9ocd-4lGsYZDB1mKhQGsXNrLeOkzWhkVbYWu1GIFJ6T5PpwvKW4E_DYiSPxQsln7EVF3dkComzIymnwftEUr_fItgdHdSh0PDZv3FoFW1IwS3tlkCAA; fpc=AnIDoBaXdphFnn2Z1l4fJ8apydlJAgAAAGLZdd8OAAAA; buid=1.AXoAMe_N-B6jSkuT5F9XHpElWqNjPCR9JMVBnYN3iMQ_HEMBAAB6AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEMxxWeYMU2a8E5dA84ovtnMC4qSpeD9bLdnBL55HkNMOUCl8FXkoiwM7vSiOygmCh26czhptq9H_vjOo0EEAlx-MrjGn4fgRAp_SRh_RJuHMgAA
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=c4af773e-c20e-4a9d-9781-05b63fc1306b&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=czAQ4xSGU_YPXPWDRn_xnkJGWQEYnYPRUfabE3OzrIY&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-6522-7dd9-bad2-ecd987b5c9d9&state=eyJpZCI6IjAxOTVkMjJjLTY1MjItNzQ2My04MjljLTE1MzkyZWM1Mjg0MyIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-PnsS0WzCIqI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEinBo5rfnVUoZ8FVcxxXZsKM0vOnwugu9Cgb4ZwKSRdjeQ1TUD5TIo8wMZVxxkYlqaiBe5f6HN3oVGLJGA40KURfkDGWDwpa93VoXAM9_kyTHmULI1dsTznBAIUpoxQV6BcSjNnl2BCSBmtWP7CI5BiAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEfhiDSbpPUPWZFqaoFYQ-E0xJqtpxJPJVnrRcuIPigb9yS8sc-7ijXyFL9TK0ycchvQcy8MwMaussRDL5x2pvdQmIZc4Ys82GKEbUxi97xvnRYTkOT6vVtJfn0GSPHI1Ol0ZhuXL2KbwRd7euZ8a_z8NNddD3ebkrtvsXa3J0YvQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; esctx-Z7JljtpSiQ=AQABCQEAAABVrSpeuWamRam2jAF1XRQEj3tWSd_n1iBoIEa5I60rHD__XHlpDcASPSTyS9ocd-4lGsYZDB1mKhQGsXNrLeOkzWhkVbYWu1GIFJ6T5PpwvKW4E_DYiSPxQsln7EVF3dkComzIymnwftEUr_fItgdHdSh0PDZv3FoFW1IwS3tlkCAA; fpc=AnIDoBaXdphFnn2Z1l4fJ8apydlJAgAAAGLZdd8OAAAA; buid=1.AXoAMe_N-B6jSkuT5F9XHpElWqNjPCR9JMVBnYN3iMQ_HEMBAAB6AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEMxxWeYMU2a8E5dA84ovtnMC4qSpeD9bLdnBL55HkNMOUCl8FXkoiwM7vSiOygmCh26czhptq9H_vjOo0EEAlx-MrjGn4fgRAp_SRh_RJuHMgAA
Source: global traffic	HTTP traffic detected: GET /campaignmetadataaggregator?country=US&locale=en-US&app=2158&platform=Web&version=16.0.18718.41003&campaignParams=pageWidth%3D1280%26pageHeight%3D897%26screenWidth%3D1280%26screenHeight%3D1024%26colorDepth%3D24%26more%3Dtrue%26OFC_Audience%3DProduction%26Datacenter%3DCH3%26TenantId%3D749f0735-6c64-4c0d-84d1-a71d9c2e569f%26SelfTriggerActivity%3D%26&contentType=CampaignContent%3BDynamicSettings&puid=&OFC_FLIGHTS=&ageGroup=0&sessionUserType=1 HTTP/1.1Host: messaging.engagement.office.comConnection: keep-alivex-clientsessionid: 9a7f5c87-4786-4509-ee3b-953fea6baf4fsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0x-correlationid: ca938151-d4d1-44b2-e509-8728e83efde4Accept: */*Origin: https://chc-onenote.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://chc-onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=fb890c31-7795-4ecd-9f99-03d2772ed150&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=F2sVQSpyfecZf9RZuRilfrIjWOfXCCkiR0ln5KZMjcw&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-7116-7235-bdc8-d822140a0a74&state=eyJpZCI6IjAxOTVkMjJjLTcxMTYtNzI2Ni05NTg0LWIyNGUxZmMxNDVjYSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-PnsS0WzCIqI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEinBo5rfnVUoZ8FVcxxXZsKM0vOnwugu9Cgb4ZwKSRdjeQ1TUD5TIo8wMZVxxkYlqaiBe5f6HN3oVGLJGA40KURfkDGWDwpa93VoXAM9_kyTHmULI1dsTznBAIUpoxQV6BcSjNnl2BCSBmtWP7CI5BiAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEfhiDSbpPUPWZFqaoFYQ-E0xJqtpxJPJVnrRcuIPigb9yS8sc-7ijXyFL9TK0ycchvQcy8MwMaussRDL5x2pvdQmIZc4Ys82GKEbUxi97xvnRYTkOT6vVtJfn0GSPHI1Ol0ZhuXL2KbwRd7euZ8a_z8NNddD3ebkrtvsXa3J0YvQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; esctx-Z7JljtpSiQ=AQABCQEAAABVrSpeuWamRam2jAF1XRQEj3tWSd_n1iBoIEa5I60rHD__XHlpDcASPSTyS9ocd-4lGsYZDB1mKhQGsXNrLeOkzWhkVbYWu1GIFJ6T5PpwvKW4E_DYiSPxQsln7EVF3dkComzIymnwftEUr_fItgdHdSh0PDZv3FoFW1IwS3tlkCAA; fpc=AnIDoBaXdphFnn2Z1l4fJ8apydlJAwAAAGLZdd8OAAAA; buid=1.AXoAMe_N-B6jSkuT5F9XHpElWqNjPCR9JMVBnYN3iMQ_HEMBAAB6AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEQMaAyDq9G4oCqdTf0As1evHOrHAEUDZJEMv-DJwafQ7UvHswiRZ7TGnzWMALAIlqQQ82LO1B9SyLK6f0lSBK7h84HlnltL309qtpQUGV26sgAA
Source: global traffic	HTTP traffic detected: GET /campaignmetadataaggregator?country=US&locale=en-US&app=2158&platform=Web&version=16.0.18718.41003&campaignParams=pageWidth%3D1280%26pageHeight%3D897%26screenWidth%3D1280%26screenHeight%3D1024%26colorDepth%3D24%26more%3Dtrue%26OFC_Audience%3DProduction%26Datacenter%3DCH3%26TenantId%3D749f0735-6c64-4c0d-84d1-a71d9c2e569f%26SelfTriggerActivity%3D%26&contentType=CampaignContent%3BDynamicSettings&puid=&OFC_FLIGHTS=&ageGroup=0&sessionUserType=1 HTTP/1.1Host: messaging.engagement.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/3aac1d8f-8009-f011-b016-0022481a23a2/landingpageforms/captcha/script?dc=EastUS&mkt=en&fid=2072b9e9-8a4b-4f5a-88ad-7d32612cf0d2&type=visual&c=1&rnd=0.5217301446428955 HTTP/1.1Host: public-gbr.mkt.dynamics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/3aac1d8f-8009-f011-b016-0022481a23a2/landingpageforms/captcha/challenge/visual?flowId=2072b9e9-8a4b-4f5a-88ad-7d32612cf0d2&rnd=92c5df5ec4d44ff3930156df5e1a11b2&market=en HTTP/1.1Host: public-gbr.mkt.dynamics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/3aac1d8f-8009-f011-b016-0022481a23a2/landingpageforms/captcha/challenge/visual?flowId=2072b9e9-8a4b-4f5a-88ad-7d32612cf0d2&rnd=92c5df5ec4d44ff3930156df5e1a11b2&market=en HTTP/1.1Host: public-gbr.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=e4443f5c-3bce-4a7b-bced-998fb2c4167a&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=o2Pr9y90j36iOmmlAUThvqCDl9m25ZlZLFZ2FHE-6XU&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-84a6-7bf0-b394-9552cc268812&state=eyJpZCI6IjAxOTVkMjJjLTg0YTYtN2VmZC04ZDYzLWM4NDc4YjJiYTY3NSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-PnsS0WzCIqI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEinBo5rfnVUoZ8FVcxxXZsKM0vOnwugu9Cgb4ZwKSRdjeQ1TUD5TIo8wMZVxxkYlqaiBe5f6HN3oVGLJGA40KURfkDGWDwpa93VoXAM9_kyTHmULI1dsTznBAIUpoxQV6BcSjNnl2BCSBmtWP7CI5BiAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEfhiDSbpPUPWZFqaoFYQ-E0xJqtpxJPJVnrRcuIPigb9yS8sc-7ijXyFL9TK0ycchvQcy8MwMaussRDL5x2pvdQmIZc4Ys82GKEbUxi97xvnRYTkOT6vVtJfn0GSPHI1Ol0ZhuXL2KbwRd7euZ8a_z8NNddD3ebkrtvsXa3J0YvQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; esctx-Z7JljtpSiQ=AQABCQEAAABVrSpeuWamRam2jAF1XRQEj3tWSd_n1iBoIEa5I60rHD__XHlpDcASPSTyS9ocd-4lGsYZDB1mKhQGsXNrLeOkzWhkVbYWu1GIFJ6T5PpwvKW4E_DYiSPxQsln7EVF3dkComzIymnwftEUr_fItgdHdSh0PDZv3FoFW1IwS3tlkCAA; buid=1.AXoAMe_N-B6jSkuT5F9XHpElWqNjPCR9JMVBnYN3iMQ_HEMBAAB6AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEieTOJYHj7YygScQ4Wvlr6EODT2MccIj8qI98Y3VXpV9oALReITWySlYbC4VtP-cSPpMP9EohFI54d-X_R-GEe3OshqQL5IDvQRTzvoHTNZsgAA; fpc=AnIDoBaXdphFnn2Z1l4fJ8apydlJBAAAAGLZdd8OAAAA
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/3aac1d8f-8009-f011-b016-0022481a23a2/landingpageforms/captcha/script?dc=EastUS&mkt=en&fid=2072b9e9-8a4b-4f5a-88ad-7d32612cf0d2&type=visual&c=2&rnd=0.20058684733542997 HTTP/1.1Host: public-gbr.mkt.dynamics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/3aac1d8f-8009-f011-b016-0022481a23a2/landingpageforms/captcha/challenge/visual?flowId=2072b9e9-8a4b-4f5a-88ad-7d32612cf0d2&rnd=88589a35ed63493cad0837ee1f76997d&market=en HTTP/1.1Host: public-gbr.mkt.dynamics.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1.0/orgs/3aac1d8f-8009-f011-b016-0022481a23a2/landingpageforms/captcha/challenge/visual?flowId=2072b9e9-8a4b-4f5a-88ad-7d32612cf0d2&rnd=88589a35ed63493cad0837ee1f76997d&market=en HTTP/1.1Host: public-gbr.mkt.dynamics.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /organizations/oauth2/v2.0/authorize?client_id=243c63a3-247d-41c5-9d83-7788c43f1c43&scope=e03a13ee-9730-4cae-8525-47559c8cf18a%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foauth.officeapps.live.com%2Foa%2FOAuth.html&client-request-id=fa91dddd-2d97-4e88-94d7-e3a670034450&response_mode=fragment&response_type=code&x-client-SKU=msal.js.browser&x-client-VER=4.7.0&x-app-name=OfficeOnline&x-app-ver=PRODUCTION.100:%2020250320.5%20V3&client_info=1&code_challenge=tfte8cD0fWkzoTWN3BMSp_8hZnqQgIaup_x5XEyNo3w&code_challenge_method=S256&prompt=none&domain_hint=749f0735-6c64-4c0d-84d1-a71d9c2e569f&login_hint=urn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&X-AnchorMailbox=UPN%3Aurn%3Aspo%3Aguest%23ronnie.duncan%40k2corporatemobility.com&nonce=0195d22c-b2e7-79cb-9c22-430e0db71fc1&state=eyJpZCI6IjAxOTVkMjJjLWIyZTctN2U1MC04ZTNlLTY2ODY1MmQ3MzczOCIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://oauth.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-PnsS0WzCIqI=AQABCQEAAABVrSpeuWamRam2jAF1XRQEinBo5rfnVUoZ8FVcxxXZsKM0vOnwugu9Cgb4ZwKSRdjeQ1TUD5TIo8wMZVxxkYlqaiBe5f6HN3oVGLJGA40KURfkDGWDwpa93VoXAM9_kyTHmULI1dsTznBAIUpoxQV6BcSjNnl2BCSBmtWP7CI5BiAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEfhiDSbpPUPWZFqaoFYQ-E0xJqtpxJPJVnrRcuIPigb9yS8sc-7ijXyFL9TK0ycchvQcy8MwMaussRDL5x2pvdQmIZc4Ys82GKEbUxi97xvnRYTkOT6vVtJfn0GSPHI1Ol0ZhuXL2KbwRd7euZ8a_z8NNddD3ebkrtvsXa3J0YvQgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; esctx-Z7JljtpSiQ=AQABCQEAAABVrSpeuWamRam2jAF1XRQEj3tWSd_n1iBoIEa5I60rHD__XHlpDcASPSTyS9ocd-4lGsYZDB1mKhQGsXNrLeOkzWhkVbYWu1GIFJ6T5PpwvKW4E_DYiSPxQsln7EVF3dkComzIymnwftEUr_fItgdHdSh0PDZv3FoFW1IwS3tlkCAA; buid=1.AXoAMe_N-B6jSkuT5F9XHpElWqNjPCR9JMVBnYN3iMQ_HEMBAAB6AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEkP697cjTfJc5jNohhdQp3tfAOAVg0L9ppFvunLTmvgqzGd7QAHmTMKDXFUpp5XMKiyIFB6etjQ1f51XfR8zGs1xRd_mXFEmPOuQSZMf-etMgAA; fpc=AnIDoBaXdphFnn2Z1l4fJ8apydlJBQAAAGLZdd8OAAAA

Performs DNS lookups

Source: global traffic	DNS traffic detected: DNS query: mwrelocation-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: common.online.office.com
Source: global traffic	DNS traffic detected: DNS query: spoprod-a.akamaihd.net
Source: global traffic	DNS traffic detected: DNS query: storage.live.com
Source: global traffic	DNS traffic detected: DNS query: www.onenote.com
Source: global traffic	DNS traffic detected: DNS query: augloop.office.com
Source: global traffic	DNS traffic detected: DNS query: amcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: assets-gbr.mkt.dynamics.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: fa000000012.resources.office.net
Source: global traffic	DNS traffic detected: DNS query: fa000000096.resources.office.net
Source: global traffic	DNS traffic detected: DNS query: fa000000110.resources.office.net
Source: global traffic	DNS traffic detected: DNS query: fa000000111.resources.office.net
Source: global traffic	DNS traffic detected: DNS query: fa000000128.resources.office.net
Source: global traffic	DNS traffic detected: DNS query: fa000000138.resources.office.net
Source: global traffic	DNS traffic detected: DNS query: public-gbr.mkt.dynamics.com
Source: global traffic	DNS traffic detected: DNS query: messaging.engagement.office.com
Source: global traffic	DNS traffic detected: DNS query: euc-common.online.office.com
Source: global traffic	DNS traffic detected: DNS query: onenoteonline.nel.measure.office.net

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /personal/mark_muss_mwrelo_com/_layouts/15/guestaccess.aspx?e=5%3ak0pMsO&at=9&share=EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ HTTP/1.1Host: mwrelocation-my.sharepoint.comConnection: keep-aliveContent-Length: 1653Cache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Origin: https://mwrelocation-my.sharepoint.comContent-Type: application/x-www-form-urlencodedUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3dAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 26 Mar 2025 11:17:58 GMTContent-Length: 0Connection: closex-ms-trace-id: 59b9d8771a693401d727c5db01264ab8Strict-Transport-Security: max-age=2592000; preload

URLs found in memory or binary data

Source: chromecache_396.1.dr, chromecache_310.1.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_300.1.dr	String found in binary or memory: http://github.com/jrburke/requirejs
Source: chromecache_376.1.dr	String found in binary or memory: http://hammerjs.github.io/
Source: chromecache_348.1.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_241.1.dr, chromecache_367.1.dr, chromecache_297.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_374.1.dr	String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml
Source: chromecache_310.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_348.1.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_374.1.dr	String found in binary or memory: https://1drv.ms
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://Office.net
Source: chromecache_215.1.dr, chromecache_352.1.dr	String found in binary or memory: https://OneNotes.secureappdeveloper.de/nQoy3
Source: chromecache_246.1.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.5.0.min.js
Source: chromecache_293.1.dr	String found in binary or memory: https://aka.ms/MathAssistantSupport?client_id=onenote_wac&platform_id=web&correlation_id=
Source: chromecache_293.1.dr	String found in binary or memory: https://api.addins.omex.office.net/
Source: chromecache_243.1.dr	String found in binary or memory: https://apps.apple.com/in/app/microsoft-onenote/id410395246
Source: chromecache_295.1.dr	String found in binary or memory: https://assets-gbr.mkt.dynamics.com/3aac1d8f-8009-f011-b016-0022481a23a2/digitalassets/forms/28ff023
Source: chromecache_374.1.dr	String found in binary or memory: https://attributes.engagement.office-int.com
Source: chromecache_374.1.dr	String found in binary or memory: https://attributes.engagement.office.com
Source: chromecache_374.1.dr	String found in binary or memory: https://attributes.engagement.officeppe.com
Source: chromecache_375.1.dr	String found in binary or memory: https://augloop.office.com/v2;394866fc-eedb-4f01-8536-3ff84b16be2a;liveprofilecard.access;https://sh
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://c3web.trafficmanager.net
Source: chromecache_374.1.dr	String found in binary or memory: https://cdn.dev.fluidpreview.office.net
Source: chromecache_374.1.dr	String found in binary or memory: https://cdn.dev.fluidpreview.office.net/fluid/dev
Source: chromecache_374.1.dr	String found in binary or memory: https://cdn.dev.fluidpreview.office.net/fluid/stg
Source: chromecache_374.1.dr	String found in binary or memory: https://cdn.fluidpreview.office.net
Source: chromecache_374.1.dr	String found in binary or memory: https://cdn.fluidpreview.office.net/fluid/df
Source: chromecache_374.1.dr	String found in binary or memory: https://cdn.fluidpreview.office.net/fluid/gcc
Source: chromecache_374.1.dr	String found in binary or memory: https://cdn.fluidpreview.office.net/fluid/prod
Source: chromecache_243.1.dr	String found in binary or memory: https://cdn.hubblecontent.msit.osi.office.net
Source: chromecache_243.1.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net
Source: chromecache_246.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161872540452_Scripts/BrowserUls.js
Source: chromecache_246.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161872540452_Scripts/CommonDiagnostics.js
Source: chromecache_246.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161872540452_Scripts/ExternalResources/js-cookie.js
Source: chromecache_246.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161872540452_Scripts/Instrumentation.js
Source: chromecache_246.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161872540452_Scripts/LearningTools/LearningTools.js
Source: chromecache_246.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161872540452_Scripts/aria-web-telemetry-2.9.0.min.js
Source: chromecache_246.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/161872540452_Scripts/pickadate.min.js
Source: chromecache_356.1.dr, chromecache_336.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/images/meetings/insert_outlook_meeting_details16x16.png
Source: chromecache_356.1.dr, chromecache_336.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/images/meetings/insert_outlook_meeting_details32x32.png
Source: chromecache_356.1.dr, chromecache_336.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/images/meetings/insert_outlook_meeting_details48x48.png
Source: chromecache_356.1.dr, chromecache_336.1.dr	String found in binary or memory: https://cdn.onenote.net/officeaddins/images/meetings/insert_outlook_meeting_details80x80.png
Source: chromecache_375.1.dr	String found in binary or memory: https://chc-onenote.officeapps.live.com
Source: chromecache_240.1.dr	String found in binary or memory: https://chc-onenote.officeapps.live.com/o/RemoteUls.ashx
Source: chromecache_293.1.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: chromecache_374.1.dr	String found in binary or memory: https://content.lifecycle.officeppe.net/
Source: chromecache_374.1.dr	String found in binary or memory: https://contentstorage.osi.office.net/images/2f4febe2cca96f7f.gif
Source: chromecache_374.1.dr	String found in binary or memory: https://contentstorage.osi.office.net/images/eb14b3fe6a1e1671.png
Source: chromecache_295.1.dr	String found in binary or memory: https://cxppusa1formui01cdnsa01-endpoint.azureedge.net/gbr/FormLoader/FormLoader.bundle.js
Source: chromecache_374.1.dr	String found in binary or memory: https://ecs.office.com
Source: chromecache_243.1.dr	String found in binary or memory: https://edog.onenote.com
Source: chromecache_374.1.dr	String found in binary or memory: https://eurppc-word-edit.officeapps.live.com
Source: chromecache_374.1.dr	String found in binary or memory: https://fa000000096.resources.office.net
Source: chromecache_374.1.dr	String found in binary or memory: https://fa000000096.resources.office.net/f7024bdc-7caf-4ca8-807d-2908f09640d6/1.0.2210.23001/en-us_w
Source: chromecache_374.1.dr	String found in binary or memory: https://fa000000096.resources.office.net/f7024bdc-7caf-4ca8-807d-2908f09640d6/1.0.2401.26003/en-us_w
Source: chromecache_272.1.dr, chromecache_392.1.dr	String found in binary or memory: https://fa000000128.resources.office.net
Source: chromecache_272.1.dr, chromecache_392.1.dr	String found in binary or memory: https://fa000000128.resources.office.net:3000/index_onenotejs.html
Source: chromecache_374.1.dr, chromecache_381.1.dr	String found in binary or memory: https://feross.org
Source: chromecache_374.1.dr, chromecache_381.1.dr	String found in binary or memory: https://feross.org/opensource
Source: chromecache_374.1.dr	String found in binary or memory: https://ffc-word-edit.officeapps.live.com
Source: chromecache_374.1.dr	String found in binary or memory: https://ffc-word-view.officeapps.live.com
Source: chromecache_374.1.dr	String found in binary or memory: https://fil1-word-edit.officeapps.live.com
Source: chromecache_374.1.dr	String found in binary or memory: https://fin1-word-edit.officeapps.live.com
Source: chromecache_293.1.dr	String found in binary or memory: https://forms.office.com
Source: chromecache_293.1.dr	String found in binary or memory: https://forms.office.com/Pages/OneNoteMathAddinFunctionPage.aspx
Source: chromecache_236.1.dr, chromecache_293.1.dr, chromecache_291.1.dr	String found in binary or memory: https://forms.officeppe.com
Source: chromecache_374.1.dr	String found in binary or memory: https://fus1-word-edit.officeapps.live.com
Source: chromecache_265.1.dr, chromecache_395.1.dr	String found in binary or memory: https://github.com/OfficeDev/office-js/blob/release/LICENSE.md
Source: chromecache_348.1.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_373.1.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_374.1.dr	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: chromecache_310.1.dr	String found in binary or memory: https://github.com/webpack-contrib/style-loader#insertat)
Source: chromecache_243.1.dr	String found in binary or memory: https://hedwigtestserver.blob.core.windows.net/builds/
Source: chromecache_243.1.dr	String found in binary or memory: https://hubblecontent.azureedge.eaglex.ic.gov
Source: chromecache_243.1.dr	String found in binary or memory: https://hubblecontent.azureedge.microsoft.scloud
Source: chromecache_293.1.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore/flyoutdetails/
Source: chromecache_381.1.dr	String found in binary or memory: https://localcdn.centro-dev.com:5555/floodgate.bundle.js.map
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://login.live-int.com
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://login.live.com
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://login.microsoftonline-int.com
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://login.windows.net
Source: chromecache_339.1.dr	String found in binary or memory: https://mwrelocation-my.sharepoint.com/personal/mark_muss_mwrelo_com/_layouts/15/images/256_icone.pn
Source: chromecache_374.1.dr, chromecache_280.1.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: chromecache_293.1.dr	String found in binary or memory: https://office.visualstudio.com/DefaultCollection/OC/_wiki/wikis/OC.wiki/22688/Using-Dictation-on-yo
Source: chromecache_272.1.dr, chromecache_392.1.dr	String found in binary or memory: https://officeapps.live.com
Source: chromecache_293.1.dr	String found in binary or memory: https://onedrive.live.com
Source: chromecache_243.1.dr	String found in binary or memory: https://osizewuspersimmon001.blob.core.windows.net
Source: chromecache_243.1.dr	String found in binary or memory: https://osiziwuspersimmon002.blob.core.windows.net
Source: chromecache_243.1.dr	String found in binary or memory: https://osizpscuspersimmon000.blob.core.windows.net
Source: chromecache_374.1.dr	String found in binary or memory: https://outlook-1-cdn.azureedge.eaglex.ic.gov
Source: chromecache_374.1.dr	String found in binary or memory: https://outlook-1-cdn.azureedge.microsoft.scloud
Source: chromecache_301.1.dr	String found in binary or memory: https://pf.events.data.cloudapp.onecollector.akadns.net/OneCollector/1.0/
Source: chromecache_248.1.dr	String found in binary or memory: https://pfr2-onenote.officeapps.live.com/o/RemoteUls.ashx
Source: chromecache_280.1.dr	String found in binary or memory: https://portal.office.com/
Source: chromecache_374.1.dr	String found in binary or memory: https://ppc-word-edit.officeapps.live.com
Source: chromecache_374.1.dr	String found in binary or memory: https://ppc-word-view.officeapps.live.com
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://prod.support.office.com
Source: chromecache_295.1.dr	String found in binary or memory: https://public-gbr.mkt.dynamics.com/api/v1.0/orgs/3aac1d8f-8009-f011-b016-0022481a23a2/landingpagefo
Source: chromecache_265.1.dr, chromecache_395.1.dr, chromecache_332.1.dr	String found in binary or memory: https://raw.githubusercontent.com/jakearchibald/es6-promise/master/LICENSE
Source: chromecache_226.1.dr	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: chromecache_396.1.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_374.1.dr, chromecache_250.1.dr, chromecache_339.1.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_250.1.dr, chromecache_339.1.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25905.12013/require.js
Source: chromecache_250.1.dr, chromecache_339.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-14.006/
Source: chromecache_250.1.dr, chromecache_339.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-03-14.006/spoguestaccesswebpack/spoguestaccess
Source: chromecache_374.1.dr	String found in binary or memory: https://res-1.cdn.partner.office365.cn
Source: chromecache_374.1.dr	String found in binary or memory: https://res-2-dev.cdn.officeppe.net
Source: chromecache_374.1.dr	String found in binary or memory: https://res-2-sdf.cdn.office.net
Source: chromecache_374.1.dr	String found in binary or memory: https://res-2.cdn.office.net
Source: chromecache_250.1.dr, chromecache_339.1.dr	String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2025-03-14.006/
Source: chromecache_243.1.dr	String found in binary or memory: https://res-dev.cdn.officeppe.net
Source: chromecache_243.1.dr	String found in binary or memory: https://res-dev.cdn.officeppe.net/mirrored/smartlookup/
Source: chromecache_374.1.dr	String found in binary or memory: https://res-dod.cdn.office.net
Source: chromecache_374.1.dr	String found in binary or memory: https://res-dod.cdn.office.net/fluid/dod
Source: chromecache_374.1.dr	String found in binary or memory: https://res-gcch.cdn.office.net
Source: chromecache_374.1.dr	String found in binary or memory: https://res-gcch.cdn.office.net/fluid/gcch
Source: chromecache_374.1.dr	String found in binary or memory: https://res-h1.cdn.office.net
Source: chromecache_272.1.dr, chromecache_392.1.dr	String found in binary or memory: https://res-h3.public.cdn.office.net
Source: chromecache_272.1.dr, chromecache_392.1.dr	String found in binary or memory: https://res-h3.sdf.cdn.office.net
Source: chromecache_374.1.dr	String found in binary or memory: https://res-sdf.cdn.office.net
Source: chromecache_374.1.dr	String found in binary or memory: https://res-v-sdf.cdn.office.net
Source: chromecache_374.1.dr, chromecache_272.1.dr, chromecache_392.1.dr	String found in binary or memory: https://res.cdn.office.net
Source: chromecache_204.1.dr	String found in binary or memory: https://res.cdn.office.net/admincenter/admin-main/2025.3.20.2/
Source: chromecache_204.1.dr	String found in binary or memory: https://res.cdn.office.net/admincenter/admin-main/2025.3.20.2/floodgate.en.bundle.js
Source: chromecache_272.1.dr, chromecache_392.1.dr	String found in binary or memory: https://res.sdf.cdn.office.net
Source: chromecache_374.1.dr	String found in binary or memory: https://roaming.edog.officeapps.live.com/rs/v1/settings
Source: chromecache_374.1.dr	String found in binary or memory: https://roaming.officeapps.live.com/rs/v1/settings
Source: chromecache_374.1.dr	String found in binary or memory: https://roaming.officeapps.partner.office365.cn/rs/v1/settings
Source: chromecache_374.1.dr	String found in binary or memory: https://roaming.osi.apps.mil/rs/v1/settings
Source: chromecache_374.1.dr	String found in binary or memory: https://roaming.osi.office.de/rs/v1/settings
Source: chromecache_374.1.dr	String found in binary or memory: https://roaming.osi.office365.us/rs/v1/settings
Source: chromecache_250.1.dr, chromecache_339.1.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js
Source: chromecache_293.1.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/suggestions
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://support.office.com
Source: chromecache_374.1.dr	String found in binary or memory: https://support.office.com/article/7afcb4f3-4aa2-443a-9b08-125a5d692576
Source: chromecache_243.1.dr	String found in binary or memory: https://support.office.com/article/ec43ed03-eb3c-4a10-8d9d-e9e5433c9ed2
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://support.office.com/f1/SDX/drawing
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://support.office.com/f1/SDX/excel
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://support.office.com/f1/SDX/onenote
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://support.office.com/f1/SDX/outlook
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://support.office.com/f1/SDX/powerpoint
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://support.office.com/f1/SDX/project
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://support.office.com/f1/SDX/word
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://support.office.com/f1/home/isAgave=true&helpid=126385
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://support.office.com/f1/home?isAgave=true
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://support.office.com/f1/home?isAgave=true&helpid=161255
Source: chromecache_244.1.dr	String found in binary or memory: https://support.office.com/icon32.png
Source: chromecache_303.1.dr, chromecache_244.1.dr	String found in binary or memory: https://support.office.com/icon80.png
Source: chromecache_301.1.dr	String found in binary or memory: https://tb.events.data.cloudapp.onecollector.akadns.net/OneCollector/1.0/
Source: chromecache_243.1.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/
Source: chromecache_243.1.dr	String found in binary or memory: https://uci.edog.cdn.office.net/mirrored/smartlookup/
Source: chromecache_374.1.dr	String found in binary or memory: https://whiteboard.apps.mil
Source: chromecache_374.1.dr	String found in binary or memory: https://whiteboard.eaglex.ic.gov
Source: chromecache_374.1.dr	String found in binary or memory: https://whiteboard.microsoft.scloud
Source: chromecache_374.1.dr	String found in binary or memory: https://whiteboard.office.com/root/index.fluid.js
Source: chromecache_374.1.dr	String found in binary or memory: https://whiteboard.office365.us
Source: chromecache_375.1.dr	String found in binary or memory: https://wise-m-backup.public.onecdn.static.microsoft/wise/owl/sharedauthclientmsal.6b11c4094d365aa3e
Source: chromecache_375.1.dr	String found in binary or memory: https://wise.public.cdn.office.net/wise/owl/sharedauthclientmsal.6b11c4094d365aa3ee90.js
Source: chromecache_374.1.dr	String found in binary or memory: https://word-edit.officeapps.live.com
Source: chromecache_374.1.dr	String found in binary or memory: https://wordwebclientbuilds.blob.core.windows.net
Source: chromecache_301.1.dr	String found in binary or memory: https://www.office.com/launch
Source: chromecache_243.1.dr	String found in binary or memory: https://www.onenote.com
Source: chromecache_293.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/mathassistant
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=af-ZA&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=am-ET&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ar-SA&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=as-IN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=az-Latn-AZ&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=be-BY&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=bg-BG&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=bn-BD&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=bn-IN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=bs-Latn-BA&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ca-ES&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ca-ES-valencia&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=cs-CZ&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=cy-GB&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=da-DK&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=de-DE&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=el-GR&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=en-US&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=es-ES&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=et-EE&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=eu-ES&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=fa-IR&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=fi-FI&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=fil-PH&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=fr-FR&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ga-IE&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=gd-GB&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=gl-ES&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=gu-IN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ha-Latn-NG&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=he-IL&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=hi-IN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=hr-HR&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=hu-HU&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=hy-AM&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=id-ID&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ig-NG&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=is-IS&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=it-IT&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ja-JP&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ka-GE&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=kk-KZ&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=km-KH&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=kn-IN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ko-KR&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=kok-IN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ku-Arab-IQ&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ky-KG&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=lb-LU&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=lt-LT&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=lv-LV&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mi-NZ&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mk-MK&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ml-IN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mn-MN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mr-IN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ms-MY&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=mt-MT&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=nb-NO&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ne-NP&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=nl-NL&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=nn-NO&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=nso-ZA&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=or-IN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pa-Arab-PK&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pa-IN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pl-PL&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=prs-AF&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pt-BR&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=pt-PT&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=quz-PE&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ro-RO&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ru-RU&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=rw-RW&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sd-Arab-PK&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=si-LK&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sk-SK&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sl-SI&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sq-AL&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sr-Cyrl-BA&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sr-Cyrl-RS&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sr-Latn-RS&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sv-SE&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=sw-KE&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ta-IN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=te-IN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tg-Cyrl-TJ&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=th-TH&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ti-ET&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tk-TM&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tn-ZA&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tr-TR&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=tt-RU&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ug-CN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=uk-UA&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=ur-PK&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=uz-Latn-UZ&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=vi-VN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=wo-SN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=xh-ZA&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=yo-NG&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=zh-CN&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=zh-TW&temporaryLocalization=true
Source: chromecache_336.1.dr	String found in binary or memory: https://www.onenote.com/officeaddins/meetings?ui=zu-ZA&temporaryLocalization=true

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 50277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 50360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50228
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 50346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50363 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50238
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50358
Source: unknown	Network traffic detected: HTTP traffic on port 50275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50350
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50354
Source: unknown	Network traffic detected: HTTP traffic on port 50303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50360
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50240
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50365
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 50244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 50318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 50342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50315
Source: unknown	Network traffic detected: HTTP traffic on port 50361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50282
Source: unknown	Network traffic detected: HTTP traffic on port 50307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 50333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50293
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.17:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.41.4:443 -> 192.168.2.17:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.243.74:443 -> 192.168.2.17:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.219.36.101:443 -> 192.168.2.17:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.90.133.97:443 -> 192.168.2.17:50161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.111.227.3:443 -> 192.168.2.17:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.235.250:443 -> 192.168.2.17:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.144.160:443 -> 192.168.2.17:50197 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.144.160:443 -> 192.168.2.17:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.51.149.65:443 -> 192.168.2.17:50222 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.118.9.29:443 -> 192.168.2.17:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.45.193.219:443 -> 192.168.2.17:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50227 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50240 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50242 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.45.193.219:443 -> 192.168.2.17:50243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50244 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.57.212:443 -> 192.168.2.17:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.131.0:443 -> 192.168.2.17:50268 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.131.0:443 -> 192.168.2.17:50269 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.131.0:443 -> 192.168.2.17:50282 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.131.0:443 -> 192.168.2.17:50283 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.111.229.20:443 -> 192.168.2.17:50303 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.111.229.20:443 -> 192.168.2.17:50318 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.90.131.0:443 -> 192.168.2.17:50325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.235.187:443 -> 192.168.2.17:50360 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.57.90.112:443 -> 192.168.2.17:50361 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: sslproxydump.pcap, type: PCAP

Matched rule: Detect payload of EvilNum Author: Sekoia.io

Creates files inside the system directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir4808_1018670303

Jump to behavior

Deletes files inside the Windows folder

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir4808_1018670303

Jump to behavior

Yara signature match

Source: sslproxydump.pcap, type: PCAP

Matched rule: evilnumpayload_fmtstr author = Sekoia.io, description = Detect payload of EvilNum, creation_date = 2022-07-25, classification = TLP:CLEAR, version = 1.1, id = 980c58e4-e04d-4076-a92e-2c04ced19ece

Binary contains paths to development resources

Source: chromecache_374.1.dr

Binary or memory string: new r.a(t.a.Ad());const C=".3gp .aa .aac .aax .act .aiff .amr .ape .au .awb .dct .dss .dvf .flac .gsm .iklax .ivs .m4a .m4b .m4p .mmf .mp3 .mpc .msv .ogg .oga .mogg .opus .ra .rm .raw .sln .tta .vox .wav .webm .wma .wv".split(" ");for(const I of C)D.pbc.add(I)}return D.pbc}static C9h(C){return D.JRh().contains(C)}static zdi(C){C=x.uCh(C);return""!==document.createElement("audio").canPlayType(C)}}D.pbc=null;(0,E.a)(D,"EmbeddedFileReaderUtils",null,[])},61068:function(E,L,d){d.d(L,{a:function(){return k}});

Classification label

Source: classification engine

Classification label: mal52.win@33/351@81/19

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1980,i,2131695329818223060,15302450142898022920,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3d"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1980,i,2131695329818223060,15302450142898022920,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:3			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mwrelocation-my.sharepoint.com/:o:/g/personal/mark_muss_mwrelo_com/EpQqkTDGaCBAnjTdG-zDbx0BUBQDo-hUhmePP1xfEWwUaQ?e=5%3ak0pMsO&at=9&xsdata=MDV8MDJ8cm9ubmllLmR1bmNhbkBrMmNvcnBvcmF0ZW1vYmlsaXR5LmNvbXw2NzI0MTRlN2FkNzk0ZTIwNTc0ZjA4ZGQ2YzU1ZjVkMXwzZTg3NTEyOTZjNjU0MmE1OTMxNjQ3ZTQzNDA2NWI1YnwwfDB8NjM4Nzg1ODM4OTIzNDgzODQ3fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwyMDAwMHx8fA%3d%3d&sdata=eEQ4emMvM2xjQmFCdG5tT1Y0VjVjVlJoUWltV3l0aGdNTXNyaElXWGY4az0%3d"			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Binary contains paths to debug symbols

Source:	Binary string: this.vb[t.a.$4a]=B;u.rZb(this);this.ZIb()}MGa(){return r.b(this.Mb.CommandValueId)?this.Mb.MenuItemId:this.Mb.CommandValueId}YL(){return""}get id(){return this._id}get $ea(){return!1}get Hn(){return this.rXc}get A3(){return!!Ua.AFrameworkApplication.fa&&Ua.AFrameworkApplication.fa.Ea.qE}ZIb(){if(!this.behavior){var u=L.a.Pdb;u&&(this.behavior=u.ucf(this))}}get Mb(){return this.$a}get vb(){r.c(this.JTa)&&(this.JTa={});return this.JTa}get nFa(){r.c(this.gOa)&&(this.gOa={});return this.gOa}get iSb(){return m.a.Pf(this.Mb.IsDefinitive)}get Apb(){return m.a.Vy(this.Mb.ShouldSetTitle)}get fPc(){return this.Mb.TemplateAlias}get Iz(){return this.dK? source: chromecache_243.1.dr
Source:	Binary string: x=d(96012),z=d(60629),u=d(62280),B=d(73225),F=d(50625),D=d(13059),C=d(65097),I=d(72974),M=d(93168),K=d(48703),R=d(67590),T=d(79587),v=d(50952),N=d(44914);class Q{constructor(){this.MX=!1;this.EJe=this.PDb=0}ev(){return!0}iA(O){this.PDb=O.clientPoint.x;this.EJe=C.App.ha.oa.lg.container.clientWidth;return this.MX=!0}gt(O){this.MX&&C.App.ha.oa.lg.resize(this.EJe+r.a.V2f(O.clientPoint.x-this.PDb));return!0}gq(){this.cNb()}oB(){this.cNb()}cNb(){this.MX=!1;C.App.ha.cfa()}dispose(){}}(0,E.a)(Q,"NavigationPaneResizeAdapter", source: chromecache_374.1.dr
Source:	Binary string: null;this.pDb=this.AQa=!1;this.Opd=(x,z)=>{this.Kpa.insert(0,new L(z.commandId,z.controlId,z.time,z.commandSurface,z.inputMethod,z.contentType,z.w9));this.U5a(this.Kpa);this.AQa&&this.Xaa.MOd(z.controlId)&&this.Whd(z)}}init(){this.Xaa=new d;this.Kpa=new Ca.a;this.T$=new Ca.a;this.xBa=new Ca.a;this.jRa=k.AFrameworkApplication.J.tb("MaxCommandClickedEventQueueSize",20);l.a.ojd(this.Opd);r.a.instance.kjd((0,Ja.a)(this,this.T4d,"recordActionEvent"));this.AQa=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.UserMRUActionsCookieEnabled", source: chromecache_243.1.dr
Source:	Binary string: Jc._instance=null;(0,m.a)(Jc,"ControlBehaviorFactory",null,[784]);class Hd{get name(){return"CUI.Behavior"}configure(Sa){z.AFrameworkApplication.J&&z.AFrameworkApplication.J.Z("AccessibleMovingDialogsEnabled")&&Sa.tu($o,[pn.a]);Sa.tu(bu,[Fd.a])}async initializeAsync(){lc.a.Pdb=Jc.instance;const Sa=Qi.a.instance.AKc;for(let jb=0;jb<Sa.length;++jb){const zb=(0,C.a)(373,Sa[jb]);zb&&zb.MO()}Kh.a.get_instance().zr(6)}dispose(){}static main(){u.a.instance.hq(new Hd,5)}}(0,m.a)(Hd,"CuiBehaviorPackage",null, source: chromecache_243.1.dr
Source:	Binary string: this.Xaa.MOd(z.controlId)&&this.Whd(z)}}init(){this.Xaa=new d;this.Kpa=new Ca.a;this.T$=new Ca.a;this.xBa=new Ca.a;this.jRa=k.AFrameworkApplication.J.tb("MaxCommandClickedEventQueueSize",20);l.a.ojd(this.Opd);r.a.instance.kjd((0,Ja.a)(this,this.T4d,"recordActionEvent"));this.AQa=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.UserMRUActionsCookieEnabled",!1);this.pDb=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.ShouldPreferParentControls", source: chromecache_293.1.dr
Source:	Binary string: this.ga.resolve("Box4.Actors.StyleActor").ib()}dispose(){}static main(){u.a.instance.Rd(new QC)}}(0,m.a)(QC,"Box4ActorsPackage",null,[0,1]);class hl{constructor(Sa,jb,zb,Kb,Vb,pc){this.rpe=this.Epa=null;this.ia=Sa;this.UHg=jb;this.l7c=zb;this.Vm=Kb;this.mc=Vb;this.Ci=pc}get recentColors(){return hl.OBb||(hl.OBb=ff.a.instance.va("Box4.UI.RecentColorsSectionHandler"))}get Aae(){this.Epa||(this.Epa=new oF("Shading"),this.iRb(this.Epa));return this.Epa}iRb(Sa){Sa.CEa(2,jj.a.pdb);Sa.CEa(3,jj.a.gga);Sa.CEa(4, source: chromecache_243.1.dr
Source:	Binary string: null,[]);class h{constructor(x,z,u,B){this.CmdId=this.ParentTcid=this.Tcid=null;this.Time=0;this.Tcid=x;this.ParentTcid=z;this.CmdId=u;this.Time=B}}(0,Fa.a)(h,"MRUControl",null,[]);var k=J(51647),l=J(76327),r=J(50478),t=J(62733);class m{constructor(){this.Xaa=null;this.uzb=this.jRa=20;this.ora=this.yz=this.xBa=this.T$=this.Kpa=null;this.pDb=this.AQa=!1;this.Opd=(x,z)=>{this.Kpa.insert(0,new L(z.commandId,z.controlId,z.time,z.commandSurface,z.inputMethod,z.contentType,z.w9));this.U5a(this.Kpa);this.AQa&& source: chromecache_293.1.dr
Source:	Binary string: I.activeSection&&(I=I.activeSection.Yb(M))&&(C=I.label);m.a.xu(K,C)}static z1a(){m.a.eo(F.AppFrame.Yea)}}(0,E.a)(D,"ASectionListView",m.a,[])},56805:function(E,L,d){d.d(L,{a:function(){return M}});E=d(100);var h=d(77072),k=d(57531),l=d(96012),r=d(60629),t=d(73225),m=d(93651),x=d(65097),z=d(305),u=d(71987),B=d(79587),F=d(19655),D=d(50952),C=d(87478);class I{constructor(K){this.MX=!1;this.FJe=this.PDb=0;this.eF=K}ev(){return this.eF.eod()}iA(K){if(!this.ev(K))return this.MX=!1;this.PDb=K.clientPoint.x; source: chromecache_374.1.dr
Source:	Binary string: this.FJe=this.eF.container.clientWidth;return this.MX=!0}gt(K){this.MX&&this.eF.resize(this.FJe+C.a.V2f(K.clientPoint.x-this.PDb));return!0}gq(){this.cNb()}oB(){this.cNb()}cNb(){this.MX=!1;x.App.ha.cfa()}dispose(){}}(0,E.a)(I,"ListViewResizeAdapter",null,[431,44]);class M extends m.a{constructor(K){super(new F.a,m.a.Ywc,x.App.bX);this.Gba=this.aY=this.vaa=this.nU=this.FX=this.OBa=null;this.isa=4294967295;this.cCa=!1;this.JN=!0;this.zz=K}get resizeMinWidth(){return 0}get resizeMaxWidth(){return 350}get Wda(){return this.OBa}get QHa(){return this.vaa}get Sla(){return this.FX}get $Sb(){return!0}get isCollapsed(){return this.cCa}set isCollapsed(K){this.cCa= source: chromecache_374.1.dr
Source:	Binary string: 1028);this.ia.la(jj.a.pdb,Sl.a.view,rA.BNb);this.ia.la(jj.a.pdb,Sl.a.tableCell,(0,ye.a)(this,this.pdb,"clearCellShadingColor"));this.ia.Wb(jj.a.pdb,1028);this.ia.la(jj.a.a3a,Sl.a.view,(0,ye.a)(this,this.VSi,"queryCellShadingColorView"));this.ia.la(jj.a.a3a,Sl.a.tableCell,(0,ye.a)(this,this.a3a,"queryCellShadingColor"));this.ia.Wb(jj.a.a3a,1124);this.ia.la(jj.a.f0b,Sl.a.view,rA.BNb);this.ia.la(jj.a.f0b,Sl.a.tableCell,(0,ye.a)(this,this.S0g,"cellShadingCustomColor"));this.ia.Wb(jj.a.f0b,1028);this.ia.la(jj.a.hSf, source: chromecache_243.1.dr
Source:	Binary string: Ua.AFrameworkApplication.fa.Ea.qE}ZIb(){if(!this.behavior){var u=L.a.Pdb;u&&(this.behavior=u.ucf(this))}}get Mb(){return this.$a}get vb(){r.c(this.JTa)&&(this.JTa={});return this.JTa}get nFa(){r.c(this.gOa)&&(this.gOa={});return this.gOa}get iSb(){return m.a.Pf(this.Mb.IsDefinitive)}get Apb(){return m.a.Vy(this.Mb.ShouldSetTitle)}get fPc(){return this.Mb.TemplateAlias}get Iz(){return this.dK?E.a.bSe:E.a.BH}aYa(u){if(-1===this.daa.indexOf(","+u+","))throw Error.create("The display mode with name: "+ source: chromecache_293.1.dr
Source:	Binary string: 4034531111;h.Cta=319972657;h.VVa=1892407702;h.QHb=329522368;h.Hca=3386890908;h.WHb=70356481;h.bIb=1303135280;h.centerJustify=4284004393;h.eFa=3332601592;h.W0g=3523575366;h.fdb=1880533947;h.gdb=768894625;h.Y0g=3230325101;h.dIb=2981608035;h.Olc=3502060538;h.hdb=4291024442;h.Iod=1943062421;h.g1g=3246658478;h.EVe=3281315808;h.DVe=3968581736;h.cC=2858610352;h.pdb=3275596206;h.rdb=562361573;h.U1=3491966299;h.clearFormatting=2319895756;h.gpd=2449130731;h.iWa=1011300372;h.wXe=3589727007;h.uIb=3901727243; source: chromecache_374.1.dr
Source:	Binary string: !0);this.AQa&&(this.yz=new Ca.a,this.ora="UserRecentActions_"+this.bgb(),this.AQd())}bgb(){switch(k.AFrameworkApplication.fa.Ea.Ng){case 3:return"Word";case 1:return"Excel";case 2:return"PowerPoint";case 5:return"Visio";case 4:return"OneNote";default:return"Unknown"}}AQd(){var x=t.a.get(this.ora);if(!this.Xaa.isNullOrUndefined(x)&&0<x.length){let z=null;try{z=JSON.parse(decodeURIComponent(x))}catch(u){t.a.remove(this.ora);return}x=0;for(const u of z)this.yz.insert(x++,u)}}Whd(x){const z=this.pDb&& source: chromecache_293.1.dr
Source:	Binary string: return}x=0;for(const u of z)this.yz.insert(x++,u)}}Whd(x){const z=this.pDb&&!this.Xaa.isNullOrUndefined(x.w9)&&0<x.w9.length;if(0<this.yz.count){for(var u=0;u<this.yz.count&&3>u;u++){var B=this.yz.K(u);if(z&&B.ParentTcid===x.w9||B.Tcid===x.controlId)return}for(u=3;u<this.yz.count;u++)if(B=this.yz.K(u),z&&B.ParentTcid===x.w9||B.Tcid===x.controlId){this.yz.remove(B);break}}this.yz.insert(0,new h(x.controlId,x.w9,x.commandId,x.time));this.yz.count>this.uzb&&this.yz.removeAt(this.uzb);x=JSON.stringify(this.yz.toArray()); source: chromecache_243.1.dr
Source:	Binary string: !1);this.pDb=k.AFrameworkApplication.J.getBooleanFeatureGate("Microsoft.Office.SharedOnline.ShouldPreferParentControls",!0);this.AQa&&(this.yz=new Ca.a,this.ora="UserRecentActions_"+this.bgb(),this.AQd())}bgb(){switch(k.AFrameworkApplication.fa.Ea.Ng){case 3:return"Word";case 1:return"Excel";case 2:return"PowerPoint";case 5:return"Visio";case 4:return"OneNote";default:return"Unknown"}}AQd(){var x=t.a.get(this.ora);if(!this.Xaa.isNullOrUndefined(x)&&0<x.length){let z=null;try{z=JSON.parse(decodeURIComponent(x))}catch(u){t.a.remove(this.ora); source: chromecache_243.1.dr

Malware Analysis System Evasion

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: chromecache_389.1.dr, chromecache_381.1.dr, chromecache_280.1.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_389.1.dr, chromecache_381.1.dr, chromecache_280.1.dr	Binary or memory string: ",DisconnectVirtualMachine:"