Edit tour

Windows Analysis Report
nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml

Overview

General Information

Sample name:	nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml
Analysis ID:	1500047
MD5:	93746131540acda22bb477c576534fc1
SHA1:	6bd2ff1375841290067f92862159b0b2991840b8
SHA256:	ff9f025ecebad0108ca9e04c7ac9b34495cd29ff5dac4712ce2416805610946e
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Downloads suspicious files via Chrome

Phishing site or detected (based on various text indicators)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

OUTLOOK.EXE (PID: 2564 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 1288 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "4CC444FA-4817-4491-9D2F-98276EAE2933" "E21FBA3F-8218-4F2B-8FD4-DC2A9C419541" "2564" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 7660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://netorgft13995914-my.sharepoint.com/:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1956,i,4171209000397206722,2059583826206299065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

System Summary

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 2564, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 0.1	OCR Text: Download Sort v El Details My files > ConsultTrueNorth Name v Modified Modified By File Size Sharing X Josh Gooch - ACCESS HERE TO REVIEW DOCUMENT.url 3 hours ago 135 bytes o, Shared
Source: Chrome DOM: 0.2	OCR Text: Microsoft 365 Download Sort v El Details My files ConsultTrueNorth Name v Modified Modified By File Size Sharing X Josh Gooch - ACCESS HERE TO REVIEW DOCUMENT.url 3 hours ago 135 bytes o, Shared
Source: Chrome DOM: 0.3	OCR Text: OneDrive Download Sort v El Details My files > ConsultTrueNorth Name v Modified Modified By File Size Sharing X Josh Gooch - ACCESS HERE TO REVIEW DOCUMENT.url 3 hours ago 135 bytes o, Shared

Source: https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1	HTTP Parser: No favicon
Source: https://google.com/404/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.8:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.8:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.8:49890 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 13.107.136.10 13.107.136.10
Source: Joe Sandbox View	IP Address: 52.98.152.178 52.98.152.178
Source: Joe Sandbox View	IP Address: 40.99.150.50 40.99.150.50
Source: Joe Sandbox View	IP Address: 52.98.179.146 52.98.179.146
Source: Joe Sandbox View	IP Address: 52.98.242.242 52.98.242.242

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.17
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=OgZdc5Cloe6YL3G&MD=UGykDFhF HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK HTTP/1.1Host: netorgft13995914-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1 HTTP/1.1Host: netorgft13995914-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQOXRsSHFUMEFiSWloM0g2QytPNFR1azdGYXlmSWN1MW5NRXo3NEdocGx6cEF0UG51RUhLR0JScExvVXFrWnZaUGZIVW9mZi9xbVU0L2l5SExaeGt4R2xnMGIvdVEvUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: netorgft13995914-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQOXRsSHFUMEFiSWloM0g2QytPNFR1azdGYXlmSWN1MW5NRXo3NEdocGx6cEF0UG51RUhLR0JScExvVXFrWnZaUGZIVW9mZi9xbVU0L2l5SExaeGt4R2xnMGIvdVEvUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: netorgft13995914-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQOXRsSHFUMEFiSWloM0g2QytPNFR1azdGYXlmSWN1MW5NRXo3NEdocGx6cEF0UG51RUhLR0JScExvVXFrWnZaUGZIVW9mZi9xbVU0L2l5SExaeGt4R2xnMGIvdVEvUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/joshg_tekton-builder_com1/_api/v2.1/graphql HTTP/1.1Host: netorgft13995914-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQOXRsSHFUMEFiSWloM0g2QytPNFR1azdGYXlmSWN1MW5NRXo3NEdocGx6cEF0UG51RUhLR0JScExvVXFrWnZaUGZIVW9mZi9xbVU0L2l5SExaeGt4R2xnMGIvdVEvUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: netorgft13995914-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQOXRsSHFUMEFiSWloM0g2QytPNFR1azdGYXlmSWN1MW5NRXo3NEdocGx6cEF0UG51RUhLR0JScExvVXFrWnZaUGZIVW9mZi9xbVU0L2l5SExaeGt4R2xnMGIvdVEvUT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/joshg_tekton-builder_com1/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: netorgft13995914-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQOXRsSHFUMEFiSWloM0g2QytPNFR1azdGYXlmSWN1MW5NRXo3NEdocGx6cEF0UG51RUhLR0JScExvVXFrWnZaUGZIVW9mZi9xbVU0L2l5SExaeGt4R2xnMGIvdVEvUT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&enableTheming=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&streamViewServerLoad=true&streamInlineScript=true HTTP/1.1Host: netorgft13995914-my.sharepoint.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQOXRsSHFUMEFiSWloM0g2QytPNFR1azdGYXlmSWN1MW5NRXo3NEdocGx6cEF0UG51RUhLR0JScExvVXFrWnZaUGZIVW9mZi9xbVU0L2l5SExaeGt4R2xnMGIvdVEvUT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/joshg_tekton-builder_com1/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%27&RootFolder=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&TryNewExperienceSingle=TRUE HTTP/1.1Host: netorgft13995914-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQOXRsSHFUMEFiSWloM0g2QytPNFR1azdGYXlmSWN1MW5NRXo3NEdocGx6cEF0UG51RUhLR0JScExvVXFrWnZaUGZIVW9mZi9xbVU0L2l5SExaeGt4R2xnMGIvdVEvUT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: netorgft13995914-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQOXRsSHFUMEFiSWloM0g2QytPNFR1azdGYXlmSWN1MW5NRXo3NEdocGx6cEF0UG51RUhLR0JScExvVXFrWnZaUGZIVW9mZi9xbVU0L2l5SExaeGt4R2xnMGIvdVEvUT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /personal/joshg_tekton-builder_com1/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: netorgft13995914-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQOXRsSHFUMEFiSWloM0g2QytPNFR1azdGYXlmSWN1MW5NRXo3NEdocGx6cEF0UG51RUhLR0JScExvVXFrWnZaUGZIVW9mZi9xbVU0L2l5SExaeGt4R2xnMGIvdVEvUT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_vti_bin/afdcache.ashx/_userprofile/userphoto.jpg?_oat_=1724806867_ac1f2e6c175bb0555ce7c3f9dfcda2ba64753d3b1b8c137b388f6d320b06fb94&P1=1724784807&P2=-149452251&P3=1&P4=GdjQ6b8g14Vmecg8Yzi%2BLwSuE%2BLsYlmrZpNuorOPLr21BC53LNLdrvW0yYgF2cbAmfgmrPxvQ4c9Gu%2B%2BAILAY1EguFZMMqQ1ZNarCTNyn0WfzrvtG3pv7hqzjOTzkhS%2B8PkahzdBNfz7m7wDocoqDeTg2YaYQdyIqpD4VSDbzAwESAFBQ3O1MgPpT12y8IV4UQ5QpPqgaOyKmNuNVVKXT%2BVryqPV%2BjENt8rNyzzuJOJ0iz0yd5bf4B1oFy4l7XrFQEO8lXpi2wmFhdrN85BAGIw5C%2B8m%2Fm2pz68Gtw0VUGvdjbT0x6uPdVuRHMyrUtI99XbsWFOvFaZzGiGCzwCwNQ%3D%3D&size=M&accountname=joshg%40tekton-builder.com HTTP/1.1Host: netorgft13995914.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://netorgft13995914-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=OgZdc5Cloe6YL3G&MD=UGykDFhF HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_layouts/15/SPComponentRegistry.ashx?projects=[%22STS%22]&languages=%5B%5D HTTP/1.1Host: netorgft13995914-my.sharepoint.comConnection: keep-aliveAccept: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://netorgft13995914-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&enableTheming=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&streamViewServerLoad=true&streamInlineScript=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQOXRsSHFUMEFiSWloM0g2QytPNFR1azdGYXlmSWN1MW5NRXo3NEdocGx6cEF0UG51RUhLR0JScExvVXFrWnZaUGZIVW9mZi9xbVU0L2l5SExaeGt4R2xnMGIvdVEvUT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_layouts/15/SPComponentRegistry.ashx?projects=[%22spfx%22]&languages=%5B%5D HTTP/1.1Host: netorgft13995914-my.sharepoint.comConnection: keep-aliveAccept: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://netorgft13995914-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&enableTheming=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&streamViewServerLoad=true&streamInlineScript=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQOXRsSHFUMEFiSWloM0g2QytPNFR1azdGYXlmSWN1MW5NRXo3NEdocGx6cEF0UG51RUhLR0JScExvVXFrWnZaUGZIVW9mZi9xbVU0L2l5SExaeGt4R2xnMGIvdVEvUT09PC9TUD4=; FeatureOverrides_experiments=[]
Source: global traffic	HTTP traffic detected: GET /_vti_bin/afdcache.ashx/_userprofile/userphoto.jpg?_oat_=1724806867_ac1f2e6c175bb0555ce7c3f9dfcda2ba64753d3b1b8c137b388f6d320b06fb94&P1=1724784807&P2=-149452251&P3=1&P4=GdjQ6b8g14Vmecg8Yzi%2BLwSuE%2BLsYlmrZpNuorOPLr21BC53LNLdrvW0yYgF2cbAmfgmrPxvQ4c9Gu%2B%2BAILAY1EguFZMMqQ1ZNarCTNyn0WfzrvtG3pv7hqzjOTzkhS%2B8PkahzdBNfz7m7wDocoqDeTg2YaYQdyIqpD4VSDbzAwESAFBQ3O1MgPpT12y8IV4UQ5QpPqgaOyKmNuNVVKXT%2BVryqPV%2BjENt8rNyzzuJOJ0iz0yd5bf4B1oFy4l7XrFQEO8lXpi2wmFhdrN85BAGIw5C%2B8m%2Fm2pz68Gtw0VUGvdjbT0x6uPdVuRHMyrUtI99XbsWFOvFaZzGiGCzwCwNQ%3D%3D&size=M&accountname=joshg%40tekton-builder.com HTTP/1.1Host: netorgft13995914.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /n/?c3Y9bzM2NV8xX25vbSZyYW5kPWRIZFFiVU09JnVpZD1VU0VSMTkwODIwMjRVMDAwODE5MTY=N0123N[EMail] HTTP/1.1Host: imosevero.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://netorgft13995914-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /404/ HTTP/1.1Host: google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://netorgft13995914-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_150x54dp.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/errors/robot.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/branding/googlelogo/1x/googlelogo_color_150x54dp.png HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/errors/robot.png HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?c14aed779e84dcfefcd608fc5d5363bd HTTP/1.1Host: tr-ooc-atm.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://netorgft13995914-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://netorgft13995914-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?97d59ca9a9f67daf4a7703d29ba141a8 HTTP/1.1Host: tr-ooc-atm.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://netorgft13995914-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://netorgft13995914-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?c14aed779e84dcfefcd608fc5d5363bd HTTP/1.1Host: tr-ooc-atm.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?97d59ca9a9f67daf4a7703d29ba141a8 HTTP/1.1Host: tr-ooc-atm.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?c92ddc14e5febb484d24848711b63f85 HTTP/1.1Host: outlook.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://netorgft13995914-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://netorgft13995914-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?cac44546b317890127a393861e223dab HTTP/1.1Host: outlook.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://netorgft13995914-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://netorgft13995914-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?c92ddc14e5febb484d24848711b63f85 HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /apc/trans.gif?cac44546b317890127a393861e223dab HTTP/1.1Host: outlook.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/joshg_tekton-builder_com1/_layouts/15/AccessDenied.aspx?correlation=96734aa1%2D3089%2D6000%2D2b60%2D259dfcffb5b3 HTTP/1.1Host: netorgft13995914-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQOXRsSHFUMEFiSWloM0g2QytPNFR1azdGYXlmSWN1MW5NRXo3NEdocGx6cEF0UG51RUhLR0JScExvVXFrWnZaUGZIVW9mZi9xbVU0L2l5SExaeGt4R2xnMGIvdVEvUT09PC9TUD4=; FeatureOverrides_experiments=[]

Source: global traffic	DNS traffic detected: DNS query: netorgft13995914-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: southcentralus0-0.pushnp.svc.ms
Source: global traffic	DNS traffic detected: DNS query: netorgft13995914.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: config.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: southcentralus1-mediap.svc.ms
Source: global traffic	DNS traffic detected: DNS query: imosevero.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: 3e48341a82ff9cd91e0c9adb91a71e2f.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: tr-ooc-atm.office.com
Source: global traffic	DNS traffic detected: DNS query: outlook.office.com
Source: global traffic	DNS traffic detected: DNS query: upload.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4722Host: login.live.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1565Date: Tue, 27 Aug 2024 18:14:31 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: chromecache_840.6.dr, chromecache_710.6.dr, chromecache_737.6.dr, chromecache_708.6.dr, chromecache_697.6.dr, chromecache_583.6.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: chromecache_773.6.dr, chromecache_674.6.dr, chromecache_700.6.dr	String found in binary or memory: http://www.contoso.com
Source: chromecache_697.6.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_870.6.dr, chromecache_592.6.dr, chromecache_855.6.dr	String found in binary or memory: https://1drv.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.aadrm.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.aadrm.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.addins.omex.office.net/api/addins/search
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.addins.store.office.com/app/query
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.cortana.ai
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.diagnostics.office.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.microsoftstream.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.microsoftstream.com/api/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.office.net
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.officescripts.microsoftusercontent.com/api
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.onedrive.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://api.scheduler.
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://apis.live.net/v5.0/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://apis.mobile.m365.svc.cloud.microsoft
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://app.powerbi.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://augloop.office.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://augloop.office.com/v2
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://canary.designerapp.
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designer-mobile
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/fonts
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-assets
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-dynamic-strings
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://cdn.designerapp.osi.office.net/designerapp/mobile-home-screen
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://cdn.entity.
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://cdn.hubblecontent.osi.office.net/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://cdn.int.designerapp.osi.office.net/fonts
Source: chromecache_870.6.dr, chromecache_592.6.dr, chromecache_855.6.dr	String found in binary or memory: https://centralus1-mediad.svc.ms
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://clients.config.office.net
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://clients.config.office.net/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/DeltaAdvisory
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: chromecache_614.6.dr, chromecache_870.6.dr, chromecache_855.6.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/web/policies
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://config.edge.skype.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://cortana.ai
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://cortana.ai/api
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://cr.office.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://d.docs.live.net
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://dataservice.o365filtering.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://designerapp.azurewebsites.net
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://dev.cortana.ai
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://devnull.onenote.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://directory.services.
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://ecs.office.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://ecs.office.com/config/v1/Designer
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://edge.skype.com/registrar/prod
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://edge.skype.com/rps
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://enrichment.osi.office.net/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601652342626
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://entitlement.diagnostics.office.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: chromecache_844.6.dr, chromecache_585.6.dr	String found in binary or memory: https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://graph.ppe.windows.net
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://graph.ppe.windows.net/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://graph.windows.net
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://graph.windows.net/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/pivots/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://ic3.teams.office.com
Source: ConsultTrueNorth.zip.crdownload.5.dr, chromecache_703.6.dr	String found in binary or memory: https://imosevero.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPWRIZFFiVU09JnVpZD1VU0VSMTkwODIwMjRVMDAwODE5MTY=N01
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://incidents.diagnostics.office.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://invites.office.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://lifecycle.office.com
Source: chromecache_823.6.dr	String found in binary or memory: https://lists.live.com/
Source: chromecache_870.6.dr, chromecache_592.6.dr, chromecache_855.6.dr	String found in binary or memory: https://livefilestore.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://login.microsoftonline.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://login.microsoftonline.com/organizations
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://login.windows.local
Source: chromecache_852.6.dr	String found in binary or memory: https://login.windows.net
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://make.powerautomate.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://management.azure.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://management.azure.com/
Source: chromecache_759.6.dr, chromecache_749.6.dr, chromecache_870.6.dr, chromecache_592.6.dr, chromecache_855.6.dr	String found in binary or memory: https://media.cloudapp.net
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://messagebroker.mobile.m365.svc.cloud.microsoft
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://messaging.action.office.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://messaging.engagement.office.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://messaging.office.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://ncus.contentsync.
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://ncus.pagecontentsync.
Source: nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml, ~WRS{4CD5F857-B678-4B72-A25D-99B4F64BD354}.tmp.0.dr	String found in binary or memory: https://netorgft13995914-my.sharepoint.com/:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_
Source: chromecache_759.6.dr, chromecache_749.6.dr, chromecache_870.6.dr, chromecache_592.6.dr, chromecache_855.6.dr	String found in binary or memory: https://northcentralus1-medias.svc.ms
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://officeapps.live.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://officepyservice.office.net/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://officepyservice.office.net/service.functionality
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://onedrive.live.com
Source: chromecache_658.6.dr, chromecache_731.6.dr	String found in binary or memory: https://onedrive.live.com/?gologin=1
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://onedrive.live.com/embed?
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://otelrules.azureedge.net
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://otelrules.svc.static.microsoft
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://outlook.office.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://outlook.office.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: chromecache_634.6.dr, chromecache_600.6.dr, chromecache_873.6.dr, chromecache_884.6.dr	String found in binary or memory: https://outlook.office.com/search
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://outlook.office365.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://outlook.office365.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://outlook.office365.com/connectors
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://pages.store.office.com/review/query
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: chromecache_870.6.dr, chromecache_592.6.dr, chromecache_855.6.dr	String found in binary or memory: https://portal.office.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://powerlift.acompli.net
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://pushchannel.1drv.ms
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: chromecache_583.6.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_870.6.dr, chromecache_855.6.dr	String found in binary or memory: https://res-1-sdf.cdn.office.net
Source: chromecache_731.6.dr, chromecache_870.6.dr, chromecache_855.6.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_852.6.dr, chromecache_782.6.dr, chromecache_778.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/fabric-cdn-prod_20230815.002/assets
Source: chromecache_731.6.dr, chromecache_719.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-08-16.003/
Source: chromecache_719.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-08-16.003/stsserviceworkerprefetch/stsservicew
Source: chromecache_860.6.dr, chromecache_622.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-08-16.004/
Source: chromecache_860.6.dr, chromecache_622.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-08-16.004/spwebworker.js
Source: chromecache_719.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-08-16.005/
Source: chromecache_719.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-08-16.005/spserviceworker.js
Source: chromecache_731.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp-media-d3ce1c23
Source: chromecache_731.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.1ds/odsp.1ds.lib-f4331117
Source: chromecache_731.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.aria/odsp.aria.lib-2306eec9
Source: chromecache_731.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.core/fui.core-9f1598dd
Source: chromecache_731.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.utilities/fui.util-153996e1
Source: chromecache_731.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.knockout/odsp.knockout.lib-da617bab
Source: chromecache_731.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.react/odsp.react.lib-361c9c69
Source: chromecache_731.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.tslib/tslib-e9cf7774
Source: chromecache_731.6.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.utilities/odsp.util-2d58ae90
Source: chromecache_731.6.dr	String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2024-08-16.003/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://res.cdn.office.net
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://res.cdn.office.net/mro1cdnstorage/fonts/prod/4.40
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://safelinks.protection.outlook.com/api/GetPolicy
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://service.officepy.microsoftusercontent.com/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://service.powerapps.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://settings.outlook.com
Source: chromecache_731.6.dr	String found in binary or memory: https://shell.cdn.office.net
Source: chromecache_731.6.dr, chromecache_719.6.dr	String found in binary or memory: https://shell.cdn.office.net/api/ShellBootstrapper/business/OneShell
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://shell.suite.office.com:1443
Source: chromecache_870.6.dr, chromecache_855.6.dr	String found in binary or memory: https://shellppe.msocdn.com
Source: chromecache_870.6.dr, chromecache_855.6.dr	String found in binary or memory: https://shellprod.msocdn.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://skyapi.live.net/Activity/
Source: chromecache_731.6.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://staging.cortana.ai
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold
Source: chromecache_752.6.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semiligh
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://store.office.cn/addinstemplate
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://store.office.de/addinstemplate
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr, chromecache_870.6.dr, chromecache_592.6.dr, chromecache_855.6.dr	String found in binary or memory: https://substrate.office.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: chromecache_565.6.dr, chromecache_681.6.dr, chromecache_682.6.dr, chromecache_669.6.dr	String found in binary or memory: https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://tasks.office.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://templatesmetadata.office.net/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://useraudit.o365auditrealtimeingestion.manage.office.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://web.microsoftstream.com/video/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://webshell.suite.office.com
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://word-edit.officeapps.live.com/we/rrdiscovery.ashx
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://wus2.contentsync.
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://wus2.pagecontentsync.
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://www.odwebp.svc.ms
Source: chromecache_658.6.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$
Source: chromecache_731.6.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive
Source: chromecache_658.6.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2F$
Source: chromecache_731.6.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2Fonedrive
Source: B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	String found in binary or memory: https://www.yammer.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.8:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.8:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.8:49890 version: TLS 1.2

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\ConsultTrueNorth.zip (copy)

Jump to dropped file

Source: classification engine

Classification label: mal48.phis.winEML@21/588@54/12

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240827T1413340143-2564.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "4CC444FA-4817-4491-9D2F-98276EAE2933" "E21FBA3F-8218-4F2B-8FD4-DC2A9C419541" "2564" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://netorgft13995914-my.sharepoint.com/:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1956,i,4171209000397206722,2059583826206299065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "4CC444FA-4817-4491-9D2F-98276EAE2933" "E21FBA3F-8218-4F2B-8FD4-DC2A9C419541" "2564" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://netorgft13995914-my.sharepoint.com/:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1956,i,4171209000397206722,2059583826206299065,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Source: Google Drive.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: chromecache_894.6.dr, chromecache_767.6.dr, chromecache_655.6.dr, chromecache_851.6.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_894.6.dr, chromecache_767.6.dr, chromecache_655.6.dr, chromecache_851.6.dr	Binary or memory string: ",DisconnectVirtualMachine:"

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://shell.suite.office.com:1443	0%	URL Reputation	safe
https://designerapp.azurewebsites.net	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/	0%	URL Reputation	safe
https://useraudit.o365auditrealtimeingestion.manage.office.com	0%	URL Reputation	safe
https://outlook.office365.com/connectors	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	0%	URL Reputation	safe
https://cdn.entity.	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	0%	URL Reputation	safe
https://rpsticket.partnerservices.getmicrosoftkey.com	0%	URL Reputation	safe
https://lookup.onenote.com/lookup/geolocation/v1	0%	URL Reputation	safe
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	0%	URL Reputation	safe
https://api.aadrm.com/	0%	URL Reputation	safe
https://canary.designerapp.	0%	URL Reputation	safe
http://www.opensource.org/licenses/mit-license.php	0%	URL Reputation	safe
https://www.yammer.com	0%	URL Reputation	safe
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	0%	URL Reputation	safe
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	0%	URL Reputation	safe
https://cr.office.com	0%	URL Reputation	safe
https://messagebroker.mobile.m365.svc.cloud.microsoft	0%	URL Reputation	safe
https://otelrules.svc.static.microsoft	0%	URL Reputation	safe
https://edge.skype.com/registrar/prod	0%	URL Reputation	safe
https://res.getmicrosoftkey.com/api/redemptionevents	0%	URL Reputation	safe
https://tasks.office.com	0%	URL Reputation	safe
https://officeci.azurewebsites.net/api/	0%	URL Reputation	safe
https://store.office.cn/addinstemplate	0%	URL Reputation	safe
https://edge.skype.com/rps	0%	URL Reputation	safe
https://messaging.engagement.office.com/	0%	URL Reputation	safe
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	0%	URL Reputation	safe
https://www.odwebp.svc.ms	0%	URL Reputation	safe
https://api.powerbi.com/v1.0/myorg/groups	0%	URL Reputation	safe
https://web.microsoftstream.com/video/	0%	URL Reputation	safe
https://api.addins.store.officeppe.com/addinstemplate	0%	URL Reputation	safe
https://graph.windows.net	0%	URL Reputation	safe
https://consent.config.office.com/consentcheckin/v1.0/consents	0%	URL Reputation	safe
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	0%	URL Reputation	safe
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	0%	URL Reputation	safe
https://safelinks.protection.outlook.com/api/GetPolicy	0%	URL Reputation	safe
https://ncus.contentsync.	0%	URL Reputation	safe
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	0%	URL Reputation	safe
http://weather.service.msn.com/data.aspx	0%	URL Reputation	safe
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	0%	URL Reputation	safe
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	0%	URL Reputation	safe
https://pushchannel.1drv.ms	0%	URL Reputation	safe
https://wus2.contentsync.	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/ios	0%	URL Reputation	safe
https://api.addins.omex.office.net/api/addins/search	0%	URL Reputation	safe
https://outlook.office365.com/api/v1.0/me/Activities	0%	URL Reputation	safe
https://clients.config.office.net/user/v1.0/android/policies	0%	URL Reputation	safe
https://entitlement.diagnostics.office.com	0%	URL Reputation	safe
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	0%	URL Reputation	safe
https://reactjs.org/link/react-polyfills	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
https://substrate.office.com/search/api/v1/SearchHistory	0%	URL Reputation	safe
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation	0%	URL Reputation	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff	0%	Avira URL Cloud	safe
https://service.powerapps.com	0%	URL Reputation	safe
https://outlook.office.com/apc/trans.gif?c92ddc14e5febb484d24848711b63f85	0%	Avira URL Cloud	safe
https://graph.windows.net/	0%	URL Reputation	safe
https://devnull.onenote.com	0%	URL Reputation	safe
https://tr-ooc-atm.office.com/apc/trans.gif?c14aed779e84dcfefcd608fc5d5363bd	0%	Avira URL Cloud	safe
https://messaging.office.com/	0%	URL Reputation	safe
https://netorgft13995914-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
https://api.microsoftstream.com/api/	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w	0%	Avira URL Cloud	safe
https://northcentralus1-medias.svc.ms	0%	Avira URL Cloud	safe
https://onedrive.live.com/?gologin=1	0%	Avira URL Cloud	safe
https://imosevero.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPWRIZFFiVU09JnVpZD1VU0VSMTkwODIwMjRVMDAwODE5MTY=N01	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://my.microsoftpersonalcontent.com	0%	Avira URL Cloud	safe
https://d.docs.live.net	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2	0%	Avira URL Cloud	safe
https://tr-ooc-atm.office.com/apc/trans.gif?97d59ca9a9f67daf4a7703d29ba141a8	0%	Avira URL Cloud	safe
https://outlook.office.com/search	0%	Avira URL Cloud	safe
https://shellppe.msocdn.com	0%	Avira URL Cloud	safe
https://www.office.com/login?ru=%2Flaunch%2F$	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh	0%	Avira URL Cloud	safe
https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_api/v2.1/graphql	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w	0%	Avira URL Cloud	safe
https://outlook.office.com/	0%	Avira URL Cloud	safe
https://imosevero.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPWRIZFFiVU09JnVpZD1VU0VSMTkwODIwMjRVMDAwODE5MTY=N0123N[EMail]	0%	Avira URL Cloud	safe
https://storage.live.com/clientlogs/uploadlocation	0%	Avira URL Cloud	safe
https://netorgft13995914-my.sharepoint.com/:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK	0%	Avira URL Cloud	safe
https://shellprod.msocdn.com	0%	Avira URL Cloud	safe
https://centralus1-mediad.svc.ms	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2	0%	Avira URL Cloud	safe
https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
ooc-g2.tm-4.office.com	52.98.242.242	true	false	unknown
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	unknown
google.com	142.250.185.206	true	false	unknown
mira-ooc.tm-4.office.com	52.98.152.178	true	false	unknown
www.google.com	172.217.18.4	true	false	unknown
FRA-efz.ms-acdc.office.com	52.98.179.146	true	false	unknown
imosevero.com	94.46.22.222	true	false	unknown
3e48341a82ff9cd91e0c9adb91a71e2f.fp.measure.office.com	unknown	unknown	false	unknown
netorgft13995914-my.sharepoint.com	unknown	unknown	false	unknown
netorgft13995914.sharepoint.com	unknown	unknown	false	unknown
r4.res.office365.com	unknown	unknown	false	unknown
outlook.office.com	unknown	unknown	false	unknown
southcentralus0-0.pushnp.svc.ms	unknown	unknown	false	unknown
southcentralus1-mediap.svc.ms	unknown	unknown	false	unknown
tr-ooc-atm.office.com	unknown	unknown	false	unknown
m365cdn.nel.measure.office.net	unknown	unknown	false	unknown
spo.nel.measure.office.net	unknown	unknown	false	unknown
upload.fp.measure.office.com	unknown	unknown	false	unknown
config.fp.measure.office.com	unknown	unknown	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://shell.suite.office.com:1443	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://designerapp.azurewebsites.net	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://useraudit.o365auditrealtimeingestion.manage.office.com	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://outlook.office365.com/connectors	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://cdn.entity.	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://rpsticket.partnerservices.getmicrosoftkey.com	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://lookup.onenote.com/lookup/geolocation/v1	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://api.aadrm.com/	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://canary.designerapp.	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
http://www.opensource.org/licenses/mit-license.php	chromecache_697.6.dr	false	URL Reputation: safe	unknown
https://www.yammer.com	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://imosevero.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPWRIZFFiVU09JnVpZD1VU0VSMTkwODIwMjRVMDAwODE5MTY=N01	ConsultTrueNorth.zip.crdownload.5.dr, chromecache_703.6.dr	false	Avira URL Cloud: safe	unknown
https://api.microsoftstream.com/api/	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	Avira URL Cloud: safe	unknown
https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://northcentralus1-medias.svc.ms	chromecache_759.6.dr, chromecache_749.6.dr, chromecache_870.6.dr, chromecache_592.6.dr, chromecache_855.6.dr	false	Avira URL Cloud: safe	unknown
https://cr.office.com	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/?gologin=1	chromecache_658.6.dr, chromecache_731.6.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://messagebroker.mobile.m365.svc.cloud.microsoft	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://otelrules.svc.static.microsoft	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute	chromecache_844.6.dr, chromecache_585.6.dr	false	Avira URL Cloud: safe	unknown
https://edge.skype.com/registrar/prod	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://res.getmicrosoftkey.com/api/redemptionevents	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://tasks.office.com	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://officeci.azurewebsites.net/api/	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://my.microsoftpersonalcontent.com	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	Avira URL Cloud: safe	unknown
https://store.office.cn/addinstemplate	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://edge.skype.com/rps	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://messaging.engagement.office.com/	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://www.odwebp.svc.ms	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://api.powerbi.com/v1.0/myorg/groups	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://web.microsoftstream.com/video/	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://api.addins.store.officeppe.com/addinstemplate	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://consent.config.office.com/consentcheckin/v1.0/consents	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://d.docs.live.net	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	Avira URL Cloud: safe	unknown
https://safelinks.protection.outlook.com/api/GetPolicy	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://ncus.contentsync.	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
http://weather.service.msn.com/data.aspx	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://pushchannel.1drv.ms	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://wus2.contentsync.	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/search	chromecache_634.6.dr, chromecache_600.6.dr, chromecache_873.6.dr, chromecache_884.6.dr	false	Avira URL Cloud: safe	unknown
https://www.office.com/login?ru=%2Flaunch%2F$	chromecache_658.6.dr	false	Avira URL Cloud: safe	unknown
https://clients.config.office.net/user/v1.0/ios	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://shellppe.msocdn.com	chromecache_870.6.dr, chromecache_855.6.dr	false	Avira URL Cloud: safe	unknown
https://api.addins.omex.office.net/api/addins/search	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://outlook.office365.com/api/v1.0/me/Activities	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://clients.config.office.net/user/v1.0/android/policies	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://entitlement.diagnostics.office.com	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://outlook.office.com/	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://storage.live.com/clientlogs/uploadlocation	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	Avira URL Cloud: safe	unknown
https://reactjs.org/link/react-polyfills	chromecache_583.6.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://substrate.office.com/search/api/v1/SearchHistory	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://shellprod.msocdn.com	chromecache_870.6.dr, chromecache_855.6.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$	chromecache_658.6.dr	false	Avira URL Cloud: safe	unknown
https://centralus1-mediad.svc.ms	chromecache_870.6.dr, chromecache_592.6.dr, chromecache_855.6.dr	false	Avira URL Cloud: safe	unknown
https://clients.config.office.net/c2r/v1.0/InteractiveInstallation	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown
https://service.powerapps.com	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://graph.windows.net/	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://devnull.onenote.com	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://messaging.office.com/	B888F789-B398-426F-B9A3-07E0FBE3EC98.0.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2	chromecache_752.6.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.206	google.com	United States	15169	GOOGLEUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.98.152.178	mira-ooc.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.99.150.50	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.98.179.146	FRA-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
52.98.242.242	ooc-g2.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.132	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
94.46.22.222	imosevero.com	Portugal	24768	ALMOUROLTECPT	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500047
Start date and time:	2024-08-27 20:12:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml
Detection:	MAL
Classification:	mal48.phis.winEML@21/588@54/12
Cookbook Comments:	Found application associated with file extension: .eml

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
52.98.179.146	July2024.eml	Get hash	malicious	HTMLPhisher	Browse
	https://shoutout.wix.com/so/8dP2NQVHe/c?w=U1fBcW2O5dQTdsvx_upoqEYpm3E6io4L0nMWoaLOZlM.eyJ1IjoiaHR0cHM6Ly9waXlhd2F0Y2xpbmljLmNvbS9nYWhic2hiZ2ZiaG4vc2pkaGZ5am1pZGJoIiwiciI6ImRkN2FjYTYwLTE4MmUtNGRmNC1iOTA2LTFiODg1NDkyOTc4MyIsIm0iOiJtYWlsIiwiYyI6ImVkNDlmZGQwLTZiNzEtNDUyOC04MDRkLWUzNzQ3YzgyNmI2ZCJ9	Get hash	malicious	HTMLPhisher	Browse
	https://www.linkedin.com/redir/redirect?url=https%3A%2F%2Fassets-usa%2Emkt%2Edynamics%2Ecom%2F5513f990-d232-ef11-8e4b-000d3a98a01a%2Fdigitalassets%2Fstandaloneforms%2F12aaa575-c233-ef11-8409-000d3a4effc3&urlhash=z-cH&trk=public_profile-settings_topcard-website	Get hash	malicious	HTMLPhisher	Browse
	https://bauhausfurnituregroup-my.sharepoint.com/:f:/p/jcaviness/EuxDBQEPKl5GgFKsZtlqM6cBIeG-xo_6Y_SwA6y5sPoclQ?e=5%3ach0wDN&at=9&xsdata=MDV8MDJ8aGVscEB2Y2YuY29tfGViYjRlM2VmYWMxZjRjODhiZmIyMDhkYzkxMzRjYzAzfDVjMDJlODlhYjk2ODRkNGU5NjBkZTYyYzdjZDAyNzY2fDB8MHw2Mzg1NDQ5MDMyMDQzNjAxNTV8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=US9GVzlGQVVpb0tMcWU1c3BhSjB0bDkrajM4RFJGWStqanVhSkg0NVR2MD0%3d	Get hash	malicious	HTMLPhisher	Browse
	https://qx476hb2.r.us-east-2.awstrack.me/L0/https:%2F%2Flink.sbstck.com%2Fredirect%2F8c34dafe-7d40-4759-8c26-75472688d698%3Fj=eyJ1IjoiM3oyMHY3In0.QqDhAZjsHzRebGt2fCZ1o0v9_q3G5DlBtHVdybO84zw/1/010f018fee20e29f-4188bb2c-c372-47b4-bfe3-6bbf884b6d8a-000000/ARz_lUuZRh6_VQ2DFlMez4MOCi0=162	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse
	http://d84z.remcuaminhhai.com/cUVTSMtKabn4f7WiKrjDj7CKE5Dki7V0c1tnjiSCtLcP7hRKmtpEv3kqgBy3N6jZCahkYCPMdTFSadrDb6ecKQPZhCtU3eEq1vCcJ1KHMwE07qhMacUeY.dy53aXR0ZUB2b2x0YWxpYS5jb20=	Get hash	malicious	HTMLPhisher	Browse
13.107.136.10	http://algestconsulting20-my.sharepoint.com/:f:/g/personal/jacques_cangah_algest-consulting_com/EkolIGllKGRKhe-gd4i73uMBzF46oqcv00d-WXGnz9D-Fw	Get hash	malicious	Unknown	Browse	algestconsulting20-my.sharepoint.com/:f:/g/personal/jacques_cangah_algest-consulting_com/EkolIGllKGRKhe-gd4i73uMBzF46oqcv00d-WXGnz9D-Fw
	http://bombeirosamora-my.sharepoint.com/:o:/g/personal/geral_comando_bombeirosamora_pt/EqT53jeWO6ZGkv1O_1FowosB2CSGfrKDmTZiEPPt31Ds7g	Get hash	malicious	HTMLPhisher	Browse	bombeirosamora-my.sharepoint.com/:o:/g/personal/geral_comando_bombeirosamora_pt/EqT53jeWO6ZGkv1O_1FowosB2CSGfrKDmTZiEPPt31Ds7g
	http://midlandlangarsevasociety-my.sharepoint.com/:w:/g/personal/sharon_bharaj_mlss_org_uk/EWiGFFYhPhtPjz5jsZdcRooBPGLh-q5SsgwgIhmP7JCmAg	Get hash	malicious	HTMLPhisher	Browse	midlandlangarsevasociety-my.sharepoint.com/:w:/g/personal/sharon_bharaj_mlss_org_uk/EWiGFFYhPhtPjz5jsZdcRooBPGLh-q5SsgwgIhmP7JCmAg
52.98.242.242	http://pub-971a2e3bbabc46089125cde1eaa8d3b2.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse
	https://app.box.com/s/0818uk4femepnk27set00nsfufvakx91	Get hash	malicious	HTMLPhisher	Browse
	https://secure.adnxs.com/clktrb?id=273568&redir=https://honeycuttconsturction.com/?ptmmiplh&qrc=tabatha.mccool@cabinetworksgroup.com	Get hash	malicious	HTMLPhisher	Browse
	https://www.yumpu.com/en/document/read/68712704/view-and-print-online-confidential-doc-98372-6-3-2	Get hash	malicious	HTMLPhisher	Browse
	https://bizzerba.com/?ksoxtyqh&qrc=eaastsales@tronicsamerica.com	Get hash	malicious	HTMLPhisher	Browse
	https://Lcatterton.bobwerks.com/Lcatterton/jill.ramirez@lcatterton.com/Lcatterton	Get hash	malicious	Unknown	Browse
	Signed_2023-03-31_24443.sHtml	Get hash	malicious	HTMLPhisher	Browse
	https://gg.gg/13jum5	Get hash	malicious	HTMLPhisher	Browse
	Direct ACH Deposit Processed.msg	Get hash	malicious	HTMLPhisher	Browse
52.98.152.178	Listen____Now_AUD__autoresponse.htm	Get hash	malicious	HTMLPhisher	Browse
	https://netorg7716231-my.sharepoint.com/:f:/g/personal/schamness_jessenmfg_com/EpvvFD967V1ApGKFME3zg84BIzVZPMLc9RCaE7D0w7YFPA?e=hGdbPg	Get hash	malicious	HTMLPhisher	Browse
	https://zjnnx.yontritive.top/?dly=rsydaY25pY2hvbHNAZGVyaWNrZGVybWF0b2xvZ3kuY29t	Get hash	malicious	HTMLPhisher	Browse
	RemittanceAdvice.html	Get hash	malicious	Unknown	Browse
	RemittanceAdvice.html	Get hash	malicious	HTMLPhisher	Browse
	https://bncjlaw.gitbook.io:443/pdf-document/	Get hash	malicious	HTMLPhisher	Browse
	Excel Statement.xlsx	Get hash	malicious	HTMLPhisher	Browse
	https://multilox-my.sharepoint.com/:f:/g/personal/aurelie_forest_multilox_fr/EqeFlfYeVvxCooBmTGt-8cQBauuDu1RN62xV9rF0OXj-Zg?e=dOO3up	Get hash	malicious	Unknown	Browse
	https://www.awin1.com/cread.php?awinmid=7868&awinaffid=208727&clickref=25*4+rainbow+lollies&platform=sl&ued=http%3a%2f%2fr20.rs6.net/tn.jsp?f=001E6nt7lHC9OxpoUYNq1q48oVo7er3PKdaEaB4CRr6ecffxLQM81BzKnaV3c2RT-97HJlALfqsIjFV-oz44AGwWxPt22sK-Lg73TLfx3F2DzWkEHSd2kRWXiHZZFrDkaU6RN3zZCxetug=&c=vqrY_RiSed2fm_gTDI334ZFZMeBUjz3v98TI0DIbJNjbTXwpRWHCvg==&ch=oaD3-PFOBbyDuSD4WCU91N4JFsecos2s6_sCWmTqLqTrVUcsYk0--w==#Z2dhcmFoYnRpYW5Ab21uaWJyaWRnZXdheS5jb20=	Get hash	malicious	Unknown	Browse
	INV-893609.htm	Get hash	malicious	Unknown	Browse
40.99.150.50	https://m.exactag.com/ai.aspx?tc=d9650035bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Acluelesscollective.com%2Fwinner%2F49479%2F%2FYWRyaWFuLmt1amF3YUAyc2ZnLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse
	https://accounts.google.com%20signin=secure%20v2%20identifier=passive@s3.amazonaws.com/appforest_uf/f1679987801785x473645042670373570/Owa.html#urp.zucchi@grupposandonato.it	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse
	https://www.youtube.com/attribution_link?c=coachblog-ytm-acq-int-blog-txt-coach&u=https%3A%2F%2Fbomberosbarcelonaquindio.org%2Fnew%2Fauth%2F/lqnobz%2F%2F%2F%2Fmichael.giantomaso@phillyshipyard.com%3Fid%3Dcom.google.android.apps.youtube.music	Get hash	malicious	HTMLPhisher	Browse
	Excel Statement.xlsx	Get hash	malicious	HTMLPhisher	Browse
	ATT98089.htm	Get hash	malicious	HTMLPhisher	Browse
	https://outlook.office365.com/owa/?viewmodel=ReadMessageItem&InternetMessageID=%3cSN7PR20MB3693735CFCFA64AC6A5E022AA8B49%40SN7PR20MB3693.namprd20.prod.outlook.com%3e	Get hash	malicious	Unknown	Browse
	https://anchorageservices-my.sharepoint.com/:f:/g/personal/bob_anchorageservices_co_uk/EjUN-Kvm2wRGl44yY2id1NMB8ppVW6kLTVm9FMcR54YCZQ?e=N4Uyqr	Get hash	malicious	HTMLPhisher	Browse
	http://Padlet.com/fehoget244/y4ilxldttu5jb77v	Get hash	malicious	HTMLPhisher	Browse
	https://bafybeigwim5u7akvvmgsc6uzd7pc2qxynk7lpmnotmmbgia6t3facvy6ku.ipfs.w3s.link/auth5thlogin.html#test@test.com	Get hash	malicious	HTMLPhisher	Browse
	https://www.nord-inkasso.de/components/0ffIce/index.php	Get hash	malicious	HTMLPhisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://netorgft13995914-my.sharepoint.com/:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK	Get hash	malicious	Unknown	Browse	52.165.165.26 20.190.160.17
	httpsworker-nameless-haze-86e5.berwieberwieberwieberwieberwie.workers.deveba=.htm	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 20.190.160.17
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 20.190.160.17
	(No subject) (60).eml	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 20.190.160.17
	doc1.exe	Get hash	malicious	Clipboard Hijacker, Snake Keylogger	Browse	52.165.165.26 20.190.160.17
	Madisonwellsmedia546.pdf	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 20.190.160.17
	(No subject) (59).eml	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 20.190.160.17
	http://email.e.quickshipping.com/c/eJxszLFSxCAQgOGnId1lYHchWFDY5D042JOdXGJkg45v72ht-88_X03gYiw8cXILUIjBeze1RKEwBLTBu5CDj2gBGWPMD-I7P9wkCSyQjRCcRwKcq1uWSEzW40spdTFkef4YUjZtcp5yvM3lfZ-eqV3XqQZfDawG1jtv0ud8ZeUmfc8b99_PwPp13uQoz1FZDaydq3QulwHUPatmQ3a079vQP7an_-pngp8AAAD__zWIRVU	Get hash	malicious	Unknown	Browse	52.165.165.26 20.190.160.17
	https://t.co/CFNobJuJq9	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 20.190.160.17
	http://esc-dot-wind-blade-416540.uk.r.appspot.com	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 20.190.160.17

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.382744206067618
Encrypted:	false
SSDEEP:	1536:ldYLTkgssxJxNb2Ubgss1NcAz79ysQqt2MZ2UqoQf9rcm0FvvZmyaD64JXLMneQ0:MogttRg7miGu2YqoQ1rt0FvrnQEI9br
MD5:	F35E2A5AB6AA6FE0324B73D5C934A56E
SHA1:	95DA3E05414E1DCB138EAD7F094FA577A0079D7D
SHA-256:	DE0834D84B07D30CB2EE4C12CAA9899260CDD4221EF149704CFD4DE9464FF0EF
SHA-512:	D95FE5248185C8EE9394342C85885C893444BF2C207EE7618F0024CBC502669074C4F91842320FB8BB6C4D079A8099EE15D84E2678289C9A131FFD61CC5F1B0C
Malicious:	false
Reputation:	low
Preview:	TH02...... . ..........SM01X...,...@Q.............IPM.Activity...........h...............h............H..h,........J.....h........@...H..h\hub ...AppD...hhO..0..........h.N.a...........h........_`#k...h.O.a@...I.Dw...h....H...8.(k...0....T...............d.........2h...............k..............!h.............. h).Y...........#h....8.........$h@.......8....."h..............'h..............1h.N.a<.........0h....4....(k../h....h.....(kH..h....p...,.....-h ............+h]M.a.... ........... ...... ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000....Microsoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Aug 27 17:13:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9909607991213765
Encrypted:	false
SSDEEP:	48:8w0dnT/n3HwidAKZdA1oehwiZUklqehNy+3:8wYrHKy
MD5:	EBAF1FF28C67A9CEC91263BF3EBA3CF8
SHA1:	1C43DBDC6D6535397E057A03E4BD862B5B88A78B
SHA-256:	B2B2D06CEB3112DB5645303675E92A3B28D1A25FA0270C3BF11B9FAD1F61E99E
SHA-512:	90F96299C2EC1C2E11C4CD0F5544807E39D90943BE12DEB3134442AF006B70E47C27DFE3E1DC319CA253A5708C2999427A7748B0C31073D53899CEB45564D30B
Malicious:	false
Preview:	L..................F.@.. ...$+.,....>.z....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y......B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

File type:	RFC 822 mail, ASCII text, with very long lines (699), with CRLF line terminators
Entropy (8bit):	5.959780000273207
TrID:
File name:	nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml
File size:	6'198 bytes
MD5:	93746131540acda22bb477c576534fc1
SHA1:	6bd2ff1375841290067f92862159b0b2991840b8
SHA256:	ff9f025ecebad0108ca9e04c7ac9b34495cd29ff5dac4712ce2416805610946e
SHA512:	487079968a2edb7a5d3104b8a6e1391381fc0330ab57b7f142c5fb02e418ea87cfc95396d36dc91ea04ea35b2b705cab1ad3e892635e4804d593becf7ad153a1
SSDEEP:	192:3ekolQGGepWFsPEv8mX5RC/RqgweBj7Igwy9xT:WlHGepWDRC/RdweBj7Nwy9V
TLSH:	BFD13B239409A431BBE1E3C954F56D02B6E6118B88FAF0C0669AD77021D74A6D7CD1AF
File Content Preview:	Received: from CH3PR02MB9961.namprd02.prod.outlook.com.. (2603:10b6:610:1a6::19) by CYXPR02MB10196.namprd02.prod.outlook.com with.. HTTPS; Tue, 27 Aug 2024 15:56:55 +0000..Received: from CYXPR02MB10196.namprd02.prod.outlook.com.. (2603:10b6:930:df::11) by

Subject:	ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf.
From:	Lauren Trzaskus <ltrzaskus@consulttruenorth.com>
To:	Lauren Trzaskus <ltrzaskus@consulttruenorth.com>
Cc:
BCC:
Date:	Tue, 27 Aug 2024 15:56:51 +0000
Communications:	<!-- /* Font Definitions / @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Aptos;} / Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; font-size:11.0pt; font-family:"Aptos",sans-serif; mso-ligatures:standardcontextual;} span.MsoSmartlink {mso-style-priority:99; color:blue; background:#F3F2F1; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:"Aptos",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --> https://netorgft13995914-my.sharepoint.com/:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK
Attachments:

Key	Value
Received	from CYXPR02MB10196.namprd02.prod.outlook.com ([fe80::68b9:f14a:c583:1a16]) by CYXPR02MB10196.namprd02.prod.outlook.com ([fe80::68b9:f14a:c583:1a16%7]) with mapi id 15.20.7875.019; Tue, 27 Aug 2024 15:56:51 +0000
From	Lauren Trzaskus <ltrzaskus@consulttruenorth.com>
To	Lauren Trzaskus <ltrzaskus@consulttruenorth.com>
Subject	ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf.
Thread-Topic	ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf.
Thread-Index	Adr4mYJ2nlXWLHvOTMWk2tIQBMlaJQ==
Date	Tue, 27 Aug 2024 15:56:51 +0000
Message-Id	<CYXPR02MB10196E5D37F0CBC38C8F91AA8DF942@CYXPR02MB10196.namprd02.prod.outlook.com>
Accept-Language	en-US
Content-Language	en-US
X-Ms-Exchange-Organization-Authmechanism	04
X-Ms-Exchange-Organization-Authsource	CYXPR02MB10196.namprd02.prod.outlook.com
X-Ms-Has-Attach	yes
X-Ms-Exchange-Organization-Network-Message-Id	0b1dbf6b-00a6-4bec-b856-08dcc6b0dd64
X-Ms-Exchange-Organization-Scl	1
X-Ms-Publictraffictype	Email
X-Ms-Traffictypediagnostic	CYXPR02MB10196:EE_\|CH3PR02MB9961:EE_\|CYXPR02MB10196:EE_
X-Ms-Exchange-Crosstenant-Originalarrivaltime	27 Aug 2024 15:56:51.0401 (UTC)
X-Ms-Exchange-Crosstenant-Fromentityheader	Hosted
X-Ms-Exchange-Crosstenant-Id	4f541a0d-5981-446f-a96b-54f97a8da888
X-Ms-Exchange-Crosstenant-Network-Message-Id	0b1dbf6b-00a6-4bec-b856-08dcc6b0dd64
X-Ms-Exchange-Transport-Crosstenantheadersstamped	CH3PR02MB9961
X-Ms-Exchange-Transport-Endtoendlatency	00:00:04.1812072
Authentication-Results	dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=consulttruenorth.com;
X-Forefront-Antispam-Report	CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CYXPR02MB10196.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(4073399012)(366016)(3613699012)(3093399012)(41050700001);DIR:INT;
X-Ms-Office365-Filtering-Correlation-Id	0b1dbf6b-00a6-4bec-b856-08dcc6b0dd64
X-Microsoft-Antispam	BCL:0;ARA:13230040\|4073399012\|366016\|3613699012\|3093399012\|41050700001;
X-Ms-Exchange-Crosstenant-Mailboxtype	HOSTED
X-Ms-Exchange-Crosstenant-Userprincipalname	2tcnMY4c61Ul5K4DGT230LH+i1+M04I/du89XiLQA7ofMykyIpFagVLpjKQmL8FJvKqp6hXquZll2lz0P4rZlKOH6CUQQUuBiqFvgRzXJsg=
X-Ms-Exchange-Crosstenant-Authas	Internal
X-Ms-Exchange-Crosstenant-Authsource	CYXPR02MB10196.namprd02.prod.outlook.com
X-Ms-Exchange-Processed-By-Bccfoldering	15.20.7875.019
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(425001)(930097)(140003);
X-Microsoft-Antispam-Message-Info	cskaRf1b7B7rxL9nGhqxndpFzTS5G0UatQO9nYD7UYN8AJ6d8qq3PZ4kpbLl+qR4+oMPZzJVwv+ZVzv/Y/7U0ELSvS7eiqs2LiSqiuNg3CZMOD1Ut8IfimHnr75AM8YyyXCcXst9Pnm8671LuAbl8zvYzesdSFspRC0yTarZr6HiacSf8unIe+HYvSSB5IccPz+FuZ1pk9+U1PmmLdDEerWMWA7ckcCdv9latbeFQpAJi7aDAk2yoleMJLrYZyVVgKyGvsQXdxIDbi1i4O0l+OKf7NLLGuy1IW7/YaISjROFVQoj9aIvOcq+LZeMnJLR6X5Vu4Xm8zX+kEYIRWRpmzQs8DsFnm8HB5N+qzwCEy/pwZDIOXJFwrTxrX2VciE9ntXnwJ+pM2cKep/5Cks3KG6pMt8CiGz90ZwNLfNCykbB4/HXKlATiPNQ7zb/2NF/yHdCMNA2N35wgcjmjifKRkVjd+87sAsQZrOos/m33UXoYKKol1R48vlrNzA6gmCGAzresxueqsluQHWcNMrepqNIrx0BhHHq3nmfjYPkWuITL9cLO0m2dyoChUKtrRs4do316VMnZXX/IQV+DmV6u2hNp+7mSkwaXwmYmwNq36BPUhOimhTm3FUF2gth8SdnehKMTo2fQUD3Kph82I020g==
Content-Type	multipart/mixed; boundary="----sinikael-?=_1-17247791207380.46221486653580657"
MIME-Version	1.0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 20:13:55.814539909 CEST	138	138	192.168.2.8	192.168.2.255
Aug 27, 2024 20:13:55.951647997 CEST	61774	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:13:55.951728106 CEST	51476	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:13:55.956146955 CEST	53	62950	1.1.1.1	192.168.2.8
Aug 27, 2024 20:13:55.960808992 CEST	53	63089	1.1.1.1	192.168.2.8
Aug 27, 2024 20:13:56.954618931 CEST	53	59624	1.1.1.1	192.168.2.8
Aug 27, 2024 20:13:59.075879097 CEST	58439	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:13:59.076023102 CEST	62624	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:00.071857929 CEST	63503	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:00.072117090 CEST	60304	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:00.078553915 CEST	53	63503	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:00.078871012 CEST	53	60304	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:13.582582951 CEST	59965	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:13.588586092 CEST	49313	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:14.999484062 CEST	53	51095	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:15.113723993 CEST	65317	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:15.114340067 CEST	58147	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:15.144412041 CEST	53	58147	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:15.176088095 CEST	50747	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:15.176433086 CEST	56118	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:20.188069105 CEST	52683	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:20.188247919 CEST	52816	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:20.992011070 CEST	57568	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:20.992376089 CEST	64545	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:22.466223001 CEST	65042	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:22.466696024 CEST	50342	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:22.493689060 CEST	53	50342	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:22.507632017 CEST	51589	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:22.507890940 CEST	51905	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:23.420140028 CEST	54433	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:23.420373917 CEST	64601	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:23.666358948 CEST	53	64601	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:24.934099913 CEST	62874	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:24.935026884 CEST	60822	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:24.945168972 CEST	53	62874	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:24.946835995 CEST	53	60822	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:29.020174980 CEST	53621	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:29.020617008 CEST	62807	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:29.072273970 CEST	53	53621	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:29.098309040 CEST	53	62807	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:30.581340075 CEST	57628	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:30.581473112 CEST	54934	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:30.588429928 CEST	53	54934	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:30.588697910 CEST	53	57628	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:32.693089008 CEST	61697	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:32.693248034 CEST	55198	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:32.699796915 CEST	53	61697	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:32.699925900 CEST	53	55198	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:33.437818050 CEST	57950	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:33.438113928 CEST	52432	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:33.656950951 CEST	53	52432	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:35.529687881 CEST	53	53127	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:35.825364113 CEST	49798	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:35.825618029 CEST	63597	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:35.859102011 CEST	53	63597	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:36.982564926 CEST	60568	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:36.982759953 CEST	55783	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:36.997360945 CEST	53	60568	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:36.997373104 CEST	53	55783	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:38.007018089 CEST	59656	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:38.007158995 CEST	49784	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:38.028237104 CEST	53	59656	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:38.028352022 CEST	53	49784	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:39.253303051 CEST	61829	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:39.253525972 CEST	55020	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:39.261070013 CEST	53	61829	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:39.262512922 CEST	53	55020	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:40.602830887 CEST	59711	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:40.603450060 CEST	52130	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:40.609750032 CEST	53	59711	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:40.611262083 CEST	53	52130	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:41.701370001 CEST	50534	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:41.701575041 CEST	50031	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:41.710299969 CEST	53	50031	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:42.424350023 CEST	61476	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:42.424810886 CEST	57560	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:14:42.433346987 CEST	53	57560	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:55.367254972 CEST	53	64034	1.1.1.1	192.168.2.8
Aug 27, 2024 20:14:57.297208071 CEST	53	65313	1.1.1.1	192.168.2.8
Aug 27, 2024 20:15:13.607295990 CEST	65053	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:15:13.607903004 CEST	58648	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:15:13.608762026 CEST	50383	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:15:13.609179020 CEST	57272	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:15:13.609927893 CEST	58546	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:15:13.610147953 CEST	52119	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:15:18.543994904 CEST	50293	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:15:18.544141054 CEST	60828	53	192.168.2.8	1.1.1.1
Aug 27, 2024 20:15:18.564277887 CEST	53	60828	1.1.1.1	192.168.2.8
Aug 27, 2024 20:15:24.709937096 CEST	53	62584	1.1.1.1	192.168.2.8

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 27, 2024 20:13:59.134109020 CEST	192.168.2.8	1.1.1.1	c334	(Port unreachable)	Destination Unreachable
Aug 27, 2024 20:14:22.493762970 CEST	192.168.2.8	1.1.1.1	c22f	(Port unreachable)	Destination Unreachable
Aug 27, 2024 20:14:29.098444939 CEST	192.168.2.8	1.1.1.1	c22e	(Port unreachable)	Destination Unreachable
Aug 27, 2024 20:15:13.668308020 CEST	192.168.2.8	1.1.1.1	c374	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:13:37 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=OgZdc5Cloe6YL3G&MD=UGykDFhF HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-27 18:13:37 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 61665ea8-e8bc-4227-9770-ce449b5ccb69 MS-RequestId: 15ca669f-ccf8-4c33-882b-717620352ec6 MS-CV: jT4Y7x4zGkuW539E.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 27 Aug 2024 18:13:36 GMT Connection: close Content-Length: 24490
2024-08-27 18:13:37 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-27 18:13:37 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\B888F789-B398-426F-B9A3-07E0FBE3EC98

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{4CD5F857-B678-4B72-A25D-99B4F64BD354}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1724782415077788100_D77AD509-3118-42EB-A3F0-5C44D0888A1E.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1724782415080408400_D77AD509-3118-42EB-A3F0-5C44D0888A1E.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240827T1413340143-2564.etl

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

C:\Users\user\Downloads\ConsultTrueNorth.zip (copy)

C:\Users\user\Downloads\ConsultTrueNorth.zip.crdownload

Chrome Cache Entry: 562

Chrome Cache Entry: 563

Chrome Cache Entry: 564

Windows Analysis Report
nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:13:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4722 Host: login.live.com
2024-08-27 18:13:41 UTC	4722	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-08-27 18:13:41 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 27 Aug 2024 18:12:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BAY x-ms-request-id: be456ef2-3492-4a87-92fa-001502e1ef66 PPServer: PPV: 30 H: PH1PEPF00011D94 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 27 Aug 2024 18:13:40 GMT Connection: close Content-Length: 10197
2024-08-27 18:13:41 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:13:56 UTC	773	OUT	GET /:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK HTTP/1.1 Host: netorgft13995914-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 18:13:57 UTC	3761	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 309 Content-Type: text/html; charset=utf-8 Location: https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlq [TRUNCATED] X-NetworkStatistics: 0,1051136,0,0,11890755,0,1051136,37 X-SharePointHealthScore: 3 X-MS-SPO-CookieValidator: AA5hjO0X+czeoXIKw80MQl5cVohRWkdZOa2rOFgVjmJt88+YXM0pkHnHp0w45ZsF2pmRqB57LklSgYKd358SKUSvlLbyM0O3W/y5+CT7g8mmglefMCWnw9djjXeorNAr5wPJscZNaQe9iqtOcgXXZ82ULbqM49lCxvzB5aZk14TDYorQt1S21MxhhTQZX3zIgoHzCnC4v2Uu8zxc3c07Xyk2F1oPy5JCAAkzSSgY+XCJvklqpsw9jfdP9tlHqT0AbIih3H6C+O4Tuk7FayfIcu1nMEz74GhplzpAtPnuEHKGBRpLoUqkZvZPfHUoff/qmU4/iyHLZxkxGlg0b/uQ/Q== X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 83734aa1-7096-6000-4d3b-f4ffef085107 request-id: 83734aa1-7096-6000-4d3b-f4ffef085107 MS-CV: oUpzg5ZwAGBNO/T/7whRBw.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=43516ef3-4425-4b68-bd12-e9a83d682a81&destinationEndpoint=Edge-Prod-EWR31r5a&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 317 SPIisLatency: 4 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25207 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 383F7E6043FF46839E4BCB2BB0D99210 Ref B: EWR311000101037 Ref C: 2024-08-27T18:13:56Z Date: Tue, 27 Aug 2024 18:13:56 GMT Connection: close
2024-08-27 18:13:57 UTC	309	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6e 65 74 6f 72 67 66 74 31 33 39 39 35 39 31 34 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 6a 6f 73 68 67 5f 74 65 6b 74 6f 6e 2d 62 75 69 6c 64 65 72 5f 63 6f 6d 31 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 6f 6e 65 64 72 69 76 65 2e 61 73 70 78 3f 69 64 3d 25 32 46 70 65 72 73 6f 6e 61 6c 25 32 46 6a 6f 73 68 67 25 35 46 74 65 6b 74 6f 6e 25 32 44 62 75 69 6c 64 65 72 25 35 46 63 6f 6d 31 25 32 46 44 6f 63 75 6d 65 6e 74 73 25 32 46 43 6f 6e 73 75 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsu

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:13:57 UTC	1984	OUT	GET /personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1 HTTP/1.1 Host: netorgft13995914-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQ [TRUNCATED]
2024-08-27 18:13:57 UTC	11180	IN	HTTP/1.1 200 OK Cache-Control: private Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlq [TRUNCATED] X-NetworkStatistics: 0,2102272,0,370,2043827,0,1281741,40 X-SharePointHealthScore: 3 Referrer-Policy: no-referrer, strict-origin-when-cross-origin Reporting-Endpoints: cspendpoint="https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/CSPReporting.aspx" X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com .cloud.microsoft .powerbi.com; Content-Security-Policy-Report-Only: base-uri 'none';;report-to cspendpoint Content-Security-Policy: worker-src 'self' blob:;script-src https://contentstorage.osi.office.net https://swx.cdn.skype.com https://res.delve.office.com https://lpcres.delve.office.com https://widget.uservoice.com https://by2.uservoice.com https://www.bing.com/api/maps/ https://www.bing.com/rms/ https://fabriciss.azureedge.net https://publiccdn.sharepointonline.com https://ajax.aspnetcdn.com https://res-1.cdn.office.net https://res-1.cdn.office.net https://res-2.cdn.office.net https://webshell.suite.office.com https://amcdn.msftauth.net .cdn.office.net .fluidpreview.office.net https://res-1.cdn.office.net https://teams.microsoft.com https://js.monitor.azure.com https://r4.res.office365.com https://c1-excel-15.cdn.office.net https://c1-onenote-15.cdn.office.net https://c1-powerpoint-15.cdn.office.net https://c1-visio-15.cdn.office.net https://c1-word-view-15.cdn.office.net https://loki.delve.office.com https://res.cdn.office.net/midgard/ https://substrate.office.com 'unsafe-eval' 'nonce-6c814dbd-499a-488b-ad [TRUNCATED] Content-Security-Policy-Report-Only: style-src https://contentstorage.osi.office.net https://swx.cdn.skype.com https://res.delve.office.com https://lpcres.delve.office.com https://widget.uservoice.com https://by2.uservoice.com https://www.bing.com/api/maps/ https://www.bing.com/rms/ https://fabriciss.azureedge.net https://publiccdn.sharepointonline.com https://ajax.aspnetcdn.com https://res-1.cdn.office.net https://res-1.cdn.office.net https://res-2.cdn.office.net https://webshell.suite.office.com https://amcdn.msftauth.net .cdn.office.net *.fluidpreview.office.net https://res-1.cdn.office.net https://teams.microsoft.com https://js.monitor.azure.com https://r4.res.office365.com https://c1-excel-15.cdn.office.net https://c1-onenote-15.cdn.office.net https://c1-powerpoint-15.cdn.office.net https://c1-visio-15.cdn.office.net https://c1-word-view-15.cdn.office.net https://loki.delve.office.com https://res.cdn.office.net/midgard/ https://substrate.office.com 'self' blob: 'unsafe-inline';connect-src 'self' blob: h [TRUNCATED] X-Service-Worker-Application-Id: STS X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 83734aa1-a0d9-6000-6859-f21280f64162 request-id: 83734aa1-a0d9-6000-6859-f21280f64162 MS-CV: oUpzg9mgAGBoWfISgPZBYg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=43516ef3-4425-4b68-bd12-e9a83d682a81&destinationEndpoint=Edge-Prod-EWR31r5c&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25207 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 1A907597C3C74FEF8E3920E8467AF50E Ref B: EWR311000105025 Ref C: 2024-08-27T18:13:57Z Date: Tue, 27 Aug 2024 18:13:57 GMT Connection: close
2024-08-27 18:13:57 UTC	2249	IN	Data Raw: 38 63 32 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 47 45 4e 45 52 41 54 4f 52 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 69 63 72 6f 73 6f 66 74 20 53 68 61 72 65 50 6f 69 6e 74 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 Data Ascii: 8c2<!DOCTYPE html><html lang="en-us" dir="ltr"><head><meta name="GENERATOR" content="Microsoft SharePoint" /><meta http-equiv="Content-type" content="text/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta http-equ
2024-08-27 18:13:57 UTC	3084	IN	Data Raw: 63 30 35 0d 0a 4f 6e 63 65 29 20 7b 20 77 69 6e 64 6f 77 2e 65 78 65 63 75 74 65 53 75 69 74 65 4e 61 76 4f 6e 63 65 28 29 20 7d 20 7d 29 3b 0d 0a 6e 65 77 53 63 72 69 70 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 65 72 72 6f 72 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 77 69 6e 64 6f 77 2e 6f 33 36 35 53 68 65 6c 6c 53 63 72 69 70 74 4c 6f 61 64 45 72 72 6f 72 20 3d 20 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3b 20 28 74 79 70 65 6f 66 20 6d 61 72 6b 50 65 72 66 53 74 61 67 65 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 20 26 26 20 6d 61 72 6b 50 65 72 66 53 74 61 67 65 28 27 73 75 69 74 65 4e 61 76 53 63 72 69 70 74 45 72 72 6f 72 27 29 29 3b 20 69 66 20 28 77 69 6e 64 6f 77 2e 65 78 65 63 75 74 65 53 75 69 74 65 4e 61 76 4f 6e 63 65 Data Ascii: c05Once) { window.executeSuiteNavOnce() } });newScript.addEventListener('error', function() { window.o365ShellScriptLoadError = arguments[0]; (typeof markPerfStage === 'function' && markPerfStage('suiteNavScriptError')); if (window.executeSuiteNavOnce
2024-08-27 18:13:58 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 75 65 2c 20 65 6e 61 62 6c 65 4c 65 67 61 63 79 52 65 73 70 6f 6e 73 69 76 65 42 65 68 61 76 69 6f 72 3a 20 66 61 6c 73 65 2c 20 65 78 70 65 63 74 53 65 61 72 63 68 42 6f 78 53 65 74 74 69 6e 67 73 3a 20 74 72 75 65 2c 20 64 61 72 6b 41 63 63 65 6e 74 3a 20 27 23 38 32 43 37 46 46 27 2c 20 73 68 65 6c 6c 41 75 74 68 50 72 6f 76 69 64 65 72 43 6f 6e 66 69 67 3a 20 7b 20 74 79 70 65 3a 20 27 77 65 62 41 61 64 57 69 74 68 4d 73 61 50 72 6f 78 79 27 2c 20 6c 6f 67 69 6e 5f 48 69 6e 74 3a 20 27 75 72 6e 3a 73 70 6f 3a 61 6e 6f 6e 23 35 39 37 61 30 38 34 35 37 33 61 39 66 64 65 61 38 31 65 61 30 32 33 39 30 30 66 62 36 38 63 62 35 32 36 38 35 39 32 36 38 36 62 38 39 30 65 32 34 62 65 37 36 30 30 64 35 39 63 31 34 63 39 37 27 2c 20 61 70 70 53 Data Ascii: 2000ue, enableLegacyResponsiveBehavior: false, expectSearchBoxSettings: true, darkAccent: '#82C7FF', shellAuthProviderConfig: { type: 'webAadWithMsaProxy', login_Hint: 'urn:spo:anon#597a084573a9fdea81ea023900fb68cb5268592686b890e24be7600d59c14c97', appS
2024-08-27 18:13:58 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 22 7d 2c 22 76 61 6e 69 74 79 55 72 6c 73 22 3a 7b 7d 2c 22 6d 75 6c 74 69 47 65 6f 49 6e 66 6f 22 3a 5b 7b 22 49 6e 73 74 61 6e 63 65 49 64 22 3a 22 64 30 31 64 64 31 37 62 2d 36 35 66 39 2d 34 38 66 35 2d 61 62 35 39 2d 37 36 35 38 37 30 37 36 38 36 38 39 22 2c 22 44 61 74 61 4c 6f 63 61 74 69 6f 6e 22 3a 22 22 2c 22 49 73 44 65 66 61 75 6c 74 44 61 74 61 4c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 52 6f 6f 74 53 69 74 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 65 74 6f 72 67 66 74 31 33 39 39 35 39 31 34 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 22 2c 22 4d 79 53 69 74 65 48 6f 73 74 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 65 74 6f 72 67 66 74 31 33 39 39 35 39 31 34 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e Data Ascii: 2000"},"vanityUrls":{},"multiGeoInfo":[{"InstanceId":"d01dd17b-65f9-48f5-ab59-765870768689","DataLocation":"","IsDefaultDataLocation":false,"RootSiteUrl":"https://netorgft13995914.sharepoint.com/","MySiteHostUrl":"https://netorgft13995914-my.sharepoint.
2024-08-27 18:13:58 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 32 2d 41 44 37 34 2d 31 36 34 39 38 43 44 33 39 36 41 30 22 3a 74 72 75 65 2c 22 33 31 46 36 39 39 35 38 2d 36 34 46 33 2d 34 34 30 46 2d 39 36 41 39 2d 34 41 38 44 45 39 41 45 37 31 41 39 22 3a 74 72 75 65 2c 22 42 42 39 33 30 39 32 36 2d 39 42 42 34 2d 34 42 42 32 2d 41 35 44 45 2d 33 36 32 46 46 30 33 42 42 35 31 35 22 3a 74 72 75 65 2c 22 32 35 30 31 41 31 34 41 2d 45 46 33 44 2d 34 41 38 37 2d 38 33 32 45 2d 38 46 33 41 38 42 44 31 30 32 30 35 22 3a 74 72 75 65 2c 22 34 42 41 37 42 30 33 35 2d 42 34 34 33 2d 34 39 31 39 2d 38 42 46 38 2d 42 33 45 34 44 31 43 33 34 44 41 30 22 3a 74 72 75 65 2c 22 46 44 41 45 39 45 39 34 2d 38 41 38 38 2d 34 38 36 30 2d 38 38 30 42 2d 46 41 33 30 34 39 35 34 43 32 41 37 22 3a 74 72 75 65 2c 22 31 30 Data Ascii: 20002-AD74-16498CD396A0":true,"31F69958-64F3-440F-96A9-4A8DE9AE71A9":true,"BB930926-9BB4-4BB2-A5DE-362FF03BB515":true,"2501A14A-EF3D-4A87-832E-8F3A8BD10205":true,"4BA7B035-B443-4919-8BF8-B3E4D1C34DA0":true,"FDAE9E94-8A88-4860-880B-FA304954C2A7":true,"10
2024-08-27 18:13:58 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 41 31 44 33 30 30 43 42 30 39 33 22 3a 74 72 75 65 2c 22 42 42 43 30 32 41 33 43 2d 46 34 39 34 2d 34 44 37 30 2d 39 32 36 31 2d 30 45 34 36 44 43 32 45 30 33 45 43 22 3a 74 72 75 65 2c 22 34 43 45 37 38 32 38 38 2d 38 42 46 41 2d 34 34 30 34 2d 41 45 45 32 2d 32 31 43 45 44 31 31 33 31 44 32 38 22 3a 74 72 75 65 2c 22 44 35 31 46 33 31 37 44 2d 46 42 45 45 2d 34 46 36 42 2d 39 42 37 30 2d 32 45 38 36 37 37 32 31 42 30 41 37 22 3a 74 72 75 65 2c 22 33 41 35 33 35 34 45 39 2d 39 42 37 45 2d 34 30 46 35 2d 38 42 43 46 2d 34 43 45 39 33 37 31 42 37 39 42 46 22 3a 74 72 75 65 2c 22 36 38 42 43 33 30 42 30 2d 32 30 41 36 2d 34 39 34 36 2d 41 45 35 32 2d 33 34 32 39 42 41 43 37 39 30 36 38 22 3a 74 72 75 65 2c 22 37 39 34 39 39 31 45 45 2d 38 Data Ascii: 2000A1D300CB093":true,"BBC02A3C-F494-4D70-9261-0E46DC2E03EC":true,"4CE78288-8BFA-4404-AEE2-21CED1131D28":true,"D51F317D-FBEE-4F6B-9B70-2E867721B0A7":true,"3A5354E9-9B7E-40F5-8BCF-4CE9371B79BF":true,"68BC30B0-20A6-4946-AE52-3429BAC79068":true,"794991EE-8
2024-08-27 18:13:58 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 41 42 33 22 3a 74 72 75 65 2c 22 32 31 41 32 39 33 36 46 2d 33 43 41 38 2d 34 39 39 42 2d 42 35 44 46 2d 34 35 44 30 32 32 44 30 39 30 41 32 22 3a 74 72 75 65 2c 22 43 39 36 36 44 41 45 45 2d 36 35 42 46 2d 34 42 37 34 2d 38 35 34 39 2d 39 42 33 37 37 30 41 37 32 44 30 37 22 3a 74 72 75 65 2c 22 43 46 37 46 44 45 38 43 2d 45 38 36 31 2d 34 31 35 34 2d 42 31 32 33 2d 37 37 31 30 36 31 37 43 46 35 39 37 22 3a 74 72 75 65 2c 22 42 37 42 39 30 36 36 34 2d 37 37 37 38 2d 34 30 41 44 2d 39 34 44 30 2d 41 33 42 36 37 36 30 38 33 32 43 31 22 3a 74 72 75 65 2c 22 38 39 35 39 31 32 39 46 2d 34 39 39 37 2d 34 39 41 45 2d 42 36 45 39 2d 39 44 43 34 33 36 42 43 41 38 46 39 22 3a 74 72 75 65 2c 22 44 32 33 46 32 30 41 32 2d 39 38 37 31 2d 34 37 31 32 Data Ascii: 2000AB3":true,"21A2936F-3CA8-499B-B5DF-45D022D090A2":true,"C966DAEE-65BF-4B74-8549-9B3770A72D07":true,"CF7FDE8C-E861-4154-B123-7710617CF597":true,"B7B90664-7778-40AD-94D0-A3B6760832C1":true,"8959129F-4997-49AE-B6E9-9DC436BCA8F9":true,"D23F20A2-9871-4712
2024-08-27 18:13:58 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 65 2c 22 44 36 42 38 44 35 38 34 2d 46 34 36 31 2d 34 32 35 32 2d 42 33 39 41 2d 33 38 31 43 41 39 36 33 34 38 30 42 22 3a 74 72 75 65 2c 22 39 35 39 39 43 44 33 46 2d 41 33 35 32 2d 34 32 41 39 2d 41 37 36 45 2d 33 37 41 44 33 45 31 34 44 36 33 31 22 3a 74 72 75 65 2c 22 35 36 42 30 39 37 33 36 2d 39 38 31 34 2d 34 31 38 44 2d 39 45 37 46 2d 31 36 33 31 34 33 38 36 39 36 38 38 22 3a 74 72 75 65 2c 22 36 35 41 46 34 42 45 34 2d 32 38 46 45 2d 34 33 42 33 2d 39 35 38 44 2d 44 45 32 36 46 34 33 33 41 41 36 45 22 3a 74 72 75 65 2c 22 46 32 45 41 42 43 45 42 2d 35 35 30 41 2d 34 30 33 36 2d 42 36 33 39 2d 45 43 41 33 39 30 41 30 39 33 31 34 22 3a 74 72 75 65 2c 22 45 38 33 32 45 45 32 36 2d 36 36 34 31 2d 34 38 35 35 2d 41 37 41 44 2d 33 30 Data Ascii: 2000e,"D6B8D584-F461-4252-B39A-381CA963480B":true,"9599CD3F-A352-42A9-A76E-37AD3E14D631":true,"56B09736-9814-418D-9E7F-163143869688":true,"65AF4BE4-28FE-43B3-958D-DE26F433AA6E":true,"F2EABCEB-550A-4036-B639-ECA390A09314":true,"E832EE26-6641-4855-A7AD-30
2024-08-27 18:13:58 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 35 45 37 2d 36 46 44 39 2d 34 31 34 42 2d 38 45 36 44 2d 34 45 32 33 30 42 42 44 31 39 43 33 22 3a 74 72 75 65 2c 22 35 36 32 43 37 43 43 31 2d 45 46 46 30 2d 34 43 35 31 2d 38 38 38 39 2d 42 43 32 35 36 45 44 32 39 33 39 36 22 3a 74 72 75 65 2c 22 34 36 35 30 39 44 31 30 2d 39 41 46 33 2d 34 31 35 36 2d 38 36 31 43 2d 34 45 37 45 37 43 33 44 39 32 38 38 22 3a 74 72 75 65 2c 22 30 38 34 41 41 36 33 37 2d 30 41 39 34 2d 34 31 34 43 2d 42 30 36 44 2d 41 42 30 43 30 38 39 35 38 32 35 39 22 3a 74 72 75 65 2c 22 30 46 46 41 43 30 32 45 2d 34 33 46 33 2d 34 42 43 31 2d 42 35 30 38 2d 37 46 38 46 44 43 42 46 46 31 46 38 22 3a 74 72 75 65 2c 22 30 42 44 45 38 35 39 32 2d 45 41 38 42 2d 34 31 39 37 2d 42 46 46 42 2d 33 46 37 42 46 31 30 34 39 43 Data Ascii: 20005E7-6FD9-414B-8E6D-4E230BBD19C3":true,"562C7CC1-EFF0-4C51-8889-BC256ED29396":true,"46509D10-9AF3-4156-861C-4E7E7C3D9288":true,"084AA637-0A94-414C-B06D-AB0C08958259":true,"0FFAC02E-43F3-4BC1-B508-7F8FDCBFF1F8":true,"0BDE8592-EA8B-4197-BFFB-3F7BF1049C
2024-08-27 18:13:58 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 2d 34 31 32 38 2d 41 31 36 44 2d 45 41 45 35 42 42 43 43 39 36 42 42 22 3a 74 72 75 65 2c 22 30 45 45 36 44 37 32 43 2d 36 42 41 35 2d 34 33 34 36 2d 41 37 45 37 2d 41 35 45 45 38 33 33 42 30 34 46 39 22 3a 74 72 75 65 2c 22 45 34 33 35 46 30 36 34 2d 35 45 36 34 2d 34 38 33 41 2d 38 41 43 30 2d 42 46 42 42 36 45 41 39 37 30 46 39 22 3a 74 72 75 65 2c 22 45 42 30 35 36 31 41 38 2d 33 42 45 39 2d 34 38 41 42 2d 38 45 42 37 2d 45 30 44 45 38 41 39 30 35 35 43 43 22 3a 74 72 75 65 2c 22 31 43 37 43 43 37 37 35 2d 43 38 31 44 2d 34 32 35 42 2d 42 38 38 33 2d 30 41 34 34 45 33 34 42 31 32 41 45 22 3a 74 72 75 65 2c 22 33 38 45 39 44 32 43 35 2d 37 45 41 45 2d 34 37 33 34 2d 39 37 37 36 2d 38 45 33 35 44 46 30 38 36 33 36 37 22 3a 74 72 75 65 Data Ascii: 2000-4128-A16D-EAE5BBCC96BB":true,"0EE6D72C-6BA5-4346-A7E7-A5EE833B04F9":true,"E435F064-5E64-483A-8AC0-BFBB6EA970F9":true,"EB0561A8-3BE9-48AB-8EB7-E0DE8A9055CC":true,"1C7CC775-C81D-425B-B883-0A44E34B12AE":true,"38E9D2C5-7EAE-4734-9776-8E35DF086367":true

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:13:58 UTC	1560	OUT	GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: netorgft13995914-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQ [TRUNCATED]
2024-08-27 18:13:59 UTC	3170	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlq [TRUNCATED] X-NetworkStatistics: 1,2102272,0,127,15435803,2102272,2102272,40 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 84734aa1-0022-6000-2b60-2bebc4fde3b4 request-id: 84734aa1-0022-6000-2b60-2bebc4fde3b4 MS-CV: oUpzhCIAAGArYCvrxP3jtA.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=43516ef3-4425-4b68-bd12-e9a83d682a81&destinationEndpoint=Edge-Prod-EWR31r5a&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25207 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: D6FFC9076C9C4180A1DB297A9182259F Ref B: EWR311000102053 Ref C: 2024-08-27T18:13:58Z Date: Tue, 27 Aug 2024 18:13:58 GMT Connection: close
2024-08-27 18:13:59 UTC	540	IN	Data Raw: 32 31 35 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 215self._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2024-08-27 18:13:59 UTC	215	IN	Data Raw: 64 31 0d 0a 6c 65 73 2f 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 34 2d 30 38 2d 31 36 2e 30 30 34 2f 73 70 77 65 62 77 6f 72 6b 65 72 2e 6a 73 27 29 3b 0a 73 65 6c 66 2e 5f 77 77 4b 69 6c 6c 53 77 69 74 63 68 65 73 20 3d 20 7b 27 34 38 46 45 41 37 41 35 2d 35 41 37 37 2d 34 38 30 42 2d 39 34 45 42 2d 34 33 46 31 39 33 37 44 46 34 44 36 27 3a 74 72 75 65 7d 3b 0a 28 74 79 70 65 6f 66 20 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 20 26 26 20 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 28 27 69 6d 70 6f 72 74 53 63 72 69 70 74 73 45 6e 64 27 29 29 3b 0a 0d 0a Data Ascii: d1les/odsp-web-prod_2024-08-16.004/spwebworker.js');self._wwKillSwitches = {'48FEA7A5-5A77-480B-94EB-43F1937DF4D6':true};(typeof self._markPerfStage === 'function' && self._markPerfStage('importScriptsEnd'));
2024-08-27 18:13:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:14:00 UTC	1553	OUT	GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: netorgft13995914-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQ [TRUNCATED]
2024-08-27 18:14:00 UTC	3160	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlq [TRUNCATED] X-NetworkStatistics: 0,525568,0,123,317533,0,299283,40 X-SharePointHealthScore: 2 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 84734aa1-a06a-6000-4d3b-fb551fdef9cc request-id: 84734aa1-a06a-6000-4d3b-fb551fdef9cc MS-CV: oUpzhGqgAGBNO/tVH975zA.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=43516ef3-4425-4b68-bd12-e9a83d682a81&destinationEndpoint=Edge-Prod-EWR31r5a&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25207 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: FCD207CD885C4DB09B3C59DDA7C7CA48 Ref B: EWR311000102049 Ref C: 2024-08-27T18:14:00Z Date: Tue, 27 Aug 2024 18:13:59 GMT Connection: close
2024-08-27 18:14:00 UTC	749	IN	Data Raw: 32 65 36 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 2e6self._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2024-08-27 18:14:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:14:01 UTC	2093	OUT	POST /personal/joshg_tekton-builder_com1/_api/v2.1/graphql HTTP/1.1 Host: netorgft13995914-my.sharepoint.com Connection: keep-alive Content-Length: 507 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json;odata=verbose Content-Type: application/json;odata=verbose X-ServiceWorker-Strategy: CacheFirst sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://netorgft13995914-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQ [TRUNCATED]
2024-08-27 18:14:01 UTC	507	OUT	Data Raw: 7b 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 28 5c 6e 20 20 20 20 20 20 20 20 24 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 51 75 65 72 79 53 74 72 69 6e 67 3a 20 53 74 72 69 6e 67 21 5c 6e 20 20 20 20 20 20 20 20 29 5c 6e 20 20 20 20 20 20 7b 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 6c 65 67 61 63 79 20 7b 5c 6e 20 20 20 20 20 20 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 28 5c 6e 20 20 20 20 20 20 71 75 65 72 79 53 74 72 69 6e 67 3a 20 24 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 51 75 65 72 79 53 74 72 69 6e 67 5c 6e 20 20 20 20 20 20 29 20 20 20 20 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 5c 6e 20 20 70 65 72 66 20 7b 5c 6e 20 20 20 20 65 78 65 63 75 74 69 6f 6e 54 69 6d 65 5c 6e 20 Data Ascii: {"query":"query (\n $spoSuiteLinksQueryString: String!\n )\n {\n \n legacy {\n spoSuiteLinks(\n queryString: $spoSuiteLinksQueryString\n ) \n \n }\n \n \n perf {\n executionTime\n
2024-08-27 18:14:01 UTC	3140	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 17754 Content-Type: application/json P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlq [TRUNCATED] X-NetworkStatistics: 0,1051136,0,317,1431236,0,1051136,40 X-SharePointHealthScore: 2 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 84734aa1-00bb-6000-6859-f2e5844667fa request-id: 84734aa1-00bb-6000-6859-f2e5844667fa MS-CV: oUpzhLsAAGBoWfLlhEZn+g.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=43516ef3-4425-4b68-bd12-e9a83d682a81&destinationEndpoint=Edge-Prod-EWR31r5a&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25207 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 84253CC836084DD8B76C8585773153CB Ref B: EWR311000101051 Ref C: 2024-08-27T18:14:01Z Date: Tue, 27 Aug 2024 18:14:01 GMT Connection: close
2024-08-27 18:14:01 UTC	1030	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6c 65 67 61 63 79 22 3a 7b 22 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 22 3a 7b 0a 20 22 53 50 53 75 69 74 65 56 65 72 73 69 6f 6e 22 3a 32 2c 0a 20 22 53 50 49 73 4d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 0a 20 22 43 73 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 68 61 72 65 64 2e 33 38 34 61 61 63 65 35 66 39 38 61 38 36 32 32 66 34 32 31 63 66 35 39 39 33 35 37 62 36 38 64 2e 63 73 73 22 2c 0a 20 22 4a 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 62 6f 6f 74 73 74 72 Data Ascii: {"data":{"legacy":{"spoSuiteLinks":{ "SPSuiteVersion":2, "SPIsMobile":false, "CssUrl":"https://res-1.cdn.office.net/shellux/suiteux.shell.shared.384aace5f98a8622f421cf599357b68d.css", "JsUrl":"https://res-1.cdn.office.net/shellux/suiteux.shell.bootstr
2024-08-27 18:14:01 UTC	8192	IN	Data Raw: 6f 77 6e 6c 6f 61 64 45 6e 61 62 6c 65 64 5c 22 3a 66 61 6c 73 65 2c 5c 22 41 70 70 73 50 69 6e 6e 65 64 44 61 74 61 5c 22 3a 6e 75 6c 6c 2c 5c 22 41 70 70 73 55 70 64 61 74 65 54 69 6d 65 53 70 61 6e 5c 22 3a 31 34 34 30 30 30 30 30 2c 5c 22 41 72 69 61 54 65 6c 65 6d 65 74 72 79 45 6e 61 62 6c 65 64 5c 22 3a 74 72 75 65 2c 5c 22 41 72 69 61 54 65 6c 65 6d 65 74 72 79 53 65 72 76 65 72 52 65 71 75 65 73 74 49 6e 66 6c 75 78 43 6f 6e 74 72 6f 6c 5c 22 3a 35 2c 5c 22 41 72 69 61 54 65 6c 65 6d 65 74 72 79 54 65 6e 61 6e 74 54 6f 6b 65 6e 5c 22 3a 5c 22 63 36 63 31 39 30 61 31 62 37 33 63 34 61 36 33 62 62 61 38 39 38 33 35 64 35 34 36 63 66 32 38 2d 66 32 61 30 34 38 32 66 2d 61 30 30 64 2d 34 38 64 39 2d 38 32 32 65 2d 65 38 39 63 63 38 39 65 62 36 34 64 Data Ascii: ownloadEnabled\":false,\"AppsPinnedData\":null,\"AppsUpdateTimeSpan\":14400000,\"AriaTelemetryEnabled\":true,\"AriaTelemetryServerRequestInfluxControl\":5,\"AriaTelemetryTenantToken\":\"c6c190a1b73c4a63bba89835d546cf28-f2a0482f-a00d-48d9-822e-e89cc89eb64d
2024-08-27 18:14:01 UTC	4144	IN	Data Raw: 5f 64 69 73 74 5f 6f 6e 64 65 6d 61 6e 64 5f 6a 73 2e 36 66 63 64 33 31 33 32 31 34 63 37 32 62 32 62 37 65 33 34 2e 6a 73 5c 22 2c 5c 22 73 65 61 72 63 68 62 6f 78 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 65 61 72 63 68 62 6f 78 2e 65 34 36 37 37 61 33 36 64 33 31 65 30 33 35 38 32 65 39 63 2e 6a 73 5c 22 2c 5c 22 73 65 61 72 63 68 75 78 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 65 61 72 63 68 75 78 2e 62 37 66 63 62 31 38 33 31 32 32 39 33 36 30 34 37 64 36 38 2e 6a 73 5c 22 2c 5c 22 73 68 65 6c 6c Data Ascii: _dist_ondemand_js.6fcd313214c72b2b7e34.js\",\"searchbox\":\"https://res-1.cdn.office.net/shellux/suiteux.shell.searchbox.e4677a36d31e03582e9c.js\",\"searchux\":\"https://res-1.cdn.office.net/shellux/suiteux.shell.searchux.b7fcb183122936047d68.js\",\"shell
2024-08-27 18:14:01 UTC	4388	IN	Data Raw: 6f 66 74 2e 63 6f 6d 2f 65 6e 2d 55 53 2f 6d 73 6f 66 66 69 63 65 22 7d 2c 22 43 6f 6d 70 61 6e 79 44 69 73 70 6c 61 79 4e 61 6d 65 22 3a 6e 75 6c 6c 2c 22 43 6f 72 72 65 6c 61 74 69 6f 6e 49 44 22 3a 22 36 30 30 64 63 65 64 63 2d 31 61 33 38 2d 34 36 35 39 2d 38 39 39 66 2d 62 32 66 30 64 36 66 36 61 64 35 61 22 2c 22 43 75 6c 74 75 72 65 4e 61 6d 65 22 3a 22 65 6e 2d 55 53 22 2c 22 43 75 72 72 65 6e 74 4d 61 69 6e 4c 69 6e 6b 45 6c 65 6d 65 6e 74 49 44 22 3a 22 53 68 65 6c 6c 53 68 61 72 65 70 6f 69 6e 74 22 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 48 65 6c 70 53 75 62 4c 69 6e 6b 73 22 3a 6e 75 6c 6c 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 53 65 74 74 69 6e 67 73 4c 69 6e 6b 22 3a 6e 75 6c 6c 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b Data Ascii: oft.com/en-US/msoffice"},"CompanyDisplayName":null,"CorrelationID":"600dcedc-1a38-4659-899f-b2f0d6f6ad5a","CultureName":"en-US","CurrentMainLinkElementID":"ShellSharepoint","CurrentWorkloadHelpSubLinks":null,"CurrentWorkloadSettingsLink":null,"CurrentWork

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:14:02 UTC	1572	OUT	GET /personal/joshg_tekton-builder_com1/_api/v2.1/graphql HTTP/1.1 Host: netorgft13995914-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQ [TRUNCATED]
2024-08-27 18:14:02 UTC	3137	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 87 Content-Type: application/json P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlq [TRUNCATED] X-NetworkStatistics: 0,1051136,36,36,3128968,0,1001739,36 X-SharePointHealthScore: 2 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 85734aa1-a00d-6000-4d3b-f5d8c887f4dd request-id: 85734aa1-a00d-6000-4d3b-f5d8c887f4dd MS-CV: oUpzhQ2gAGBNO/XYyIf03Q.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25207 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: BED7CF9E585A494C8726845E5A2622A4 Ref B: EWR311000107019 Ref C: 2024-08-27T18:14:02Z Date: Tue, 27 Aug 2024 18:14:01 GMT Connection: close
2024-08-27 18:14:02 UTC	87	IN	Data Raw: 7b 22 65 72 72 6f 72 73 22 3a 5b 7b 22 6d 65 73 73 61 67 65 22 3a 22 41 20 71 75 65 72 79 20 69 73 20 72 65 71 75 69 72 65 64 2e 22 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 22 63 6f 64 65 22 3a 22 45 58 45 43 55 54 49 4f 4e 5f 45 52 52 4f 52 22 7d 7d 5d 7d Data Ascii: {"errors":[{"message":"A query is required.","extensions":{"code":"EXECUTION_ERROR"}}]}

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:14:08 UTC	2664	OUT	POST /personal/joshg_tekton-builder_com1/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: netorgft13995914-my.sharepoint.com Connection: keep-alive Content-Length: 821 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-ms-cc: t ScenarioType: AUO sec-ch-ua-mobile: ?0 Authorization: Bearer User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CollectSPPerfMetrics: SPSQLQueryCount Content-Type: application/json;odata=verbose accept: application/json;odata=verbose X-ClientService-ClientTag: ODB Web X-SP-REQUESTRESOURCES: listUrl=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments X-ServiceWorker-Strategy: CacheFirst x-requestdigest: 0xD2B361ABBFB0AFDAC2CA7E25CD0FEECE7FD289787CACBB19F9638E5D914BB939183B7856F3C46A870C6969CB2A10AA79236FF77D73A831837A4C7AE8DEB255F8,27 Aug 2024 18:13:57 -0000 sec-ch-ua-platform: "Windows" Origin: https://netorgft13995914-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQ [TRUNCATED]
2024-08-27 18:14:08 UTC	821	OUT	Data Raw: 7b 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 5f 5f 6d 65 74 61 64 61 74 61 22 3a 7b 22 74 79 70 65 22 3a 22 53 50 2e 52 65 6e 64 65 72 4c 69 73 74 44 61 74 61 50 61 72 61 6d 65 74 65 72 73 22 7d 2c 22 52 65 6e 64 65 72 4f 70 74 69 6f 6e 73 22 3a 31 30 35 32 36 37 39 2c 22 56 69 65 77 58 6d 6c 22 3a 22 3c 56 69 65 77 20 3e 3c 51 75 65 72 79 3e 3c 2f 51 75 65 72 79 3e 3c 56 69 65 77 46 69 65 6c 64 73 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 44 6f 63 49 63 6f 6e 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4c 69 6e 6b 46 69 6c 65 6e 61 6d 65 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4d 6f 64 69 66 69 65 64 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 45 64 69 74 6f 72 5c 22 2f 3e 3c 46 Data Ascii: {"parameters":{"__metadata":{"type":"SP.RenderListDataParameters"},"RenderOptions":1052679,"ViewXml":"<View ><Query></Query><ViewFields><FieldRef Name=\"DocIcon\"/><FieldRef Name=\"LinkFilename\"/><FieldRef Name=\"Modified\"/><FieldRef Name=\"Editor\"/><F
2024-08-27 18:14:09 UTC	3387	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Expires: Mon, 12 Aug 2024 18:14:08 GMT Last-Modified: Tue, 27 Aug 2024 18:14:08 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlq [TRUNCATED] X-NetworkStatistics: 0,2102272,45,324,23966408,0,2102272,44 X-SharePointHealthScore: 0 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 60 SPRequestDuration: 60 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 86734aa1-7094-6000-4d3e-d94f30d99a0c request-id: 86734aa1-7094-6000-4d3e-d94f30d99a0c MS-CV: oUpzhpRwAGBNPtlPMNmaDA.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=43516ef3-4425-4b68-bd12-e9a83d682a81&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25207 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 906F6A21062C4FEFB18EB285236F2C44 Ref B: EWR311000107045 Ref C: 2024-08-27T18:14:08Z Date: Tue, 27 Aug 2024 18:14:08 GMT Connection: close
2024-08-27 18:14:09 UTC	784	IN	Data Raw: 33 30 39 0d 0a 7b 22 77 70 71 22 3a 22 22 2c 22 54 65 6d 70 6c 61 74 65 73 22 3a 7b 7d 2c 22 4c 69 73 74 44 61 74 61 22 3a 7b 20 22 52 6f 77 22 20 3a 20 0a 5b 7b 0d 0a 22 49 44 22 3a 20 22 31 38 22 2c 0d 0a 22 50 65 72 6d 4d 61 73 6b 22 3a 20 22 30 78 33 30 30 38 30 33 31 30 32 31 22 2c 0d 0a 22 46 53 4f 62 6a 54 79 70 65 22 3a 20 22 31 22 2c 0d 0a 22 48 54 4d 4c 5f 78 30 30 32 30 5f 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 22 3a 20 22 22 2c 0d 0a 22 55 6e 69 71 75 65 49 64 22 3a 20 22 7b 46 38 44 46 44 43 36 44 2d 32 35 46 33 2d 34 38 36 42 2d 38 33 42 35 2d 42 46 36 43 43 43 30 41 36 43 32 38 7d 22 2c 0d 0a 22 50 72 6f 67 49 64 22 3a 20 22 22 2c 0d 0a 22 4e 6f 45 78 65 63 75 74 65 22 3a 20 22 30 22 2c 0d 0a 22 43 6f 6e 74 65 6e 74 54 79 70 65 49 64 Data Ascii: 309{"wpq":"","Templates":{},"ListData":{ "Row" : [{"ID": "18","PermMask": "0x3008031021","FSObjType": "1","HTML_x0020_File_x0020_Type": "","UniqueId": "{F8DFDC6D-25F3-486B-83B5-BF6CCC0A6C28}","ProgId": "","NoExecute": "0","ContentTypeId
2024-08-27 18:14:09 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 76 65 72 52 65 64 69 72 65 63 74 65 64 45 6d 62 65 64 55 72 6c 22 3a 20 22 22 2c 0d 0a 22 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 2e 70 72 6f 67 69 64 22 3a 20 22 46 41 4c 53 45 22 2c 0d 0a 22 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 2e 75 72 6c 22 3a 20 22 22 2c 0d 0a 22 46 69 6c 65 4c 65 61 66 52 65 66 22 3a 20 22 43 6f 6e 73 75 6c 74 54 72 75 65 4e 6f 72 74 68 22 2c 0d 0a 22 43 68 65 63 6b 6f 75 74 55 73 65 72 22 3a 20 22 22 2c 0d 0a 22 43 68 65 63 6b 65 64 4f 75 74 55 73 65 72 49 64 22 3a 20 22 22 2c 0d 0a 22 49 73 43 68 65 63 6b 65 64 6f 75 74 54 6f 4c 6f 63 61 6c 22 3a 20 22 30 22 2c 0d 0a 22 5f 43 6f 6d 70 6c 69 61 6e 63 65 46 6c 61 67 73 22 3a 20 22 22 2c 0d 0a 22 5f 53 68 6f 72 74 63 75 74 55 72 6c 22 3a 20 22 22 2c 0d Data Ascii: 2000verRedirectedEmbedUrl": "","File_x0020_Type.progid": "FALSE","File_x0020_Type.url": "","FileLeafRef": "ConsultTrueNorth","CheckoutUser": "","CheckedOutUserId": "","IsCheckedoutToLocal": "0","_ComplianceFlags": "","_ShortcutUrl": "",
2024-08-27 18:14:09 UTC	4152	IN	Data Raw: 31 30 33 30 0d 0a 20 22 46 69 6c 65 52 65 66 22 2c 0a 22 46 69 65 6c 64 54 79 70 65 22 3a 20 22 4c 6f 6f 6b 75 70 22 2c 0a 22 52 65 61 6c 46 69 65 6c 64 4e 61 6d 65 22 3a 20 22 46 69 6c 65 52 65 66 22 2c 0a 22 44 69 73 70 6c 61 79 4e 61 6d 65 22 3a 20 22 55 52 4c 20 50 61 74 68 22 2c 0a 22 49 44 22 3a 20 22 39 34 66 38 39 37 31 35 2d 65 30 39 37 2d 34 65 38 62 2d 62 61 37 39 2d 65 61 30 32 61 61 38 62 37 61 64 62 22 2c 0a 22 53 74 61 74 69 63 4e 61 6d 65 22 3a 20 22 46 69 6c 65 52 65 66 22 2c 0a 22 52 65 61 64 4f 6e 6c 79 22 3a 20 22 54 52 55 45 22 2c 0a 22 72 6f 6c 65 22 3a 20 22 4c 6f 6f 6b 75 70 22 2c 0a 22 61 72 69 61 4c 61 62 65 6c 22 3a 20 22 55 52 4c 20 50 61 74 68 22 2c 0a 22 46 72 6f 6d 42 61 73 65 54 79 70 65 22 3a 20 22 54 52 55 45 22 2c 0a 22 Data Ascii: 1030 "FileRef","FieldType": "Lookup","RealFieldName": "FileRef","DisplayName": "URL Path","ID": "94f89715-e097-4e8b-ba79-ea02aa8b7adb","StaticName": "FileRef","ReadOnly": "TRUE","role": "Lookup","ariaLabel": "URL Path","FromBaseType": "TRUE","
2024-08-27 18:14:09 UTC	7473	IN	Data Raw: 31 64 32 39 0d 0a 4a 54 44 42 68 61 33 56 50 51 55 52 4b 63 6d 68 32 4e 47 46 34 5a 77 6f 49 43 67 4e 7a 64 48 41 53 41 58 51 4b 43 67 6f 45 63 32 35 70 5a 42 49 43 4d 7a 4d 53 42 67 69 45 76 6a 6f 51 41 52 6f 4c 4f 43 34 30 4e 69 34 78 4d 6a 4d 75 4d 7a 4d 69 46 47 31 70 59 33 4a 76 63 32 39 6d 64 43 35 7a 61 47 46 79 5a 58 42 76 61 57 35 30 4b 69 78 77 51 58 70 4d 56 44 42 43 64 32 67 33 65 56 6c 52 54 54 4a 75 62 33 68 35 51 55 67 30 55 6b 38 79 5a 58 46 56 5a 6b 70 55 54 56 46 31 4f 45 35 5a 4c 30 4e 72 56 58 68 46 50 54 42 2d 4f 41 46 4b 45 47 68 68 63 32 68 6c 5a 48 42 79 62 32 39 6d 64 47 39 72 5a 57 35 69 42 48 52 79 64 57 56 79 59 54 42 6f 4c 6d 5a 38 62 57 56 74 59 6d 56 79 63 32 68 70 63 48 78 31 63 6d 34 6c 4d 32 46 7a 63 47 38 6c 4d 32 46 68 Data Ascii: 1d29JTDBha3VPQURKcmh2NGF4ZwoICgNzdHASAXQKCgoEc25pZBICMzMSBgiEvjoQARoLOC40Ni4xMjMuMzMiFG1pY3Jvc29mdC5zaGFyZXBvaW50KixwQXpMVDBCd2g3eVlRTTJub3h5QUg0Uk8yZXFVZkpUTVF1OE5ZL0NrVXhFPTB-OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fh
2024-08-27 18:14:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:14:08 UTC	2743	OUT	POST /personal/joshg_tekton-builder_com1/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%27&RootFolder=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&TryNewExperienceSingle=TRUE HTTP/1.1 Host: netorgft13995914-my.sharepoint.com Connection: keep-alive Content-Length: 201 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-ms-cc: t ScenarioType: AUO Accept-Language: en-US sec-ch-ua-mobile: ?0 Authorization: Bearer User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json;odata=verbose CollectSPPerfMetrics: SPSQLQueryCount accept: application/json;odata=verbose X-ClientService-ClientTag: ODB Web X-SP-REQUESTRESOURCES: listUrl=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments X-ServiceWorker-Strategy: CacheFirst x-requestdigest: 0xD2B361ABBFB0AFDAC2CA7E25CD0FEECE7FD289787CACBB19F9638E5D914BB939183B7856F3C46A870C6969CB2A10AA79236FF77D73A831837A4C7AE8DEB255F8,27 Aug 2024 18:13:57 -0000 sec-ch-ua-platform: "Windows" Origin: https://netorgft13995914-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1 Accept-Encoding: gzip, deflate, br Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQ [TRUNCATED]
2024-08-27 18:14:08 UTC	201	OUT	Data Raw: 7b 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 5f 5f 6d 65 74 61 64 61 74 61 22 3a 7b 22 74 79 70 65 22 3a 22 53 50 2e 52 65 6e 64 65 72 4c 69 73 74 44 61 74 61 50 61 72 61 6d 65 74 65 72 73 22 7d 2c 22 52 65 6e 64 65 72 4f 70 74 69 6f 6e 73 22 3a 35 34 34 35 33 38 33 2c 22 41 6c 6c 6f 77 4d 75 6c 74 69 70 6c 65 56 61 6c 75 65 46 69 6c 74 65 72 46 6f 72 54 61 78 6f 6e 6f 6d 79 46 69 65 6c 64 73 22 3a 74 72 75 65 2c 22 41 64 64 52 65 71 75 69 72 65 64 46 69 65 6c 64 73 22 3a 74 72 75 65 2c 22 52 65 71 75 69 72 65 46 6f 6c 64 65 72 43 6f 6c 6f 72 69 6e 67 46 69 65 6c 64 73 22 3a 74 72 75 65 7d 7d Data Ascii: {"parameters":{"__metadata":{"type":"SP.RenderListDataParameters"},"RenderOptions":5445383,"AllowMultipleValueFilterForTaxonomyFields":true,"AddRequiredFields":true,"RequireFolderColoringFields":true}}
2024-08-27 18:14:09 UTC	3387	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Expires: Mon, 12 Aug 2024 18:14:08 GMT Last-Modified: Tue, 27 Aug 2024 18:14:08 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlq [TRUNCATED] X-NetworkStatistics: 0,2102272,42,118,12325389,0,2008561,40 X-SharePointHealthScore: 1 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 82 SPRequestDuration: 82 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: 86734aa1-7094-6000-6859-f621350ad9bc request-id: 86734aa1-7094-6000-6859-f621350ad9bc MS-CV: oUpzhpRwAGBoWfYhNQrZvA.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=43516ef3-4425-4b68-bd12-e9a83d682a81&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25207 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 652DFC1A087041C1AC39BA91BE41BC8D Ref B: EWR311000107023 Ref C: 2024-08-27T18:14:08Z Date: Tue, 27 Aug 2024 18:14:08 GMT Connection: close
2024-08-27 18:14:09 UTC	929	IN	Data Raw: 33 39 61 0d 0a 7b 22 77 70 71 22 3a 22 22 2c 22 54 65 6d 70 6c 61 74 65 73 22 3a 7b 7d 2c 22 4c 69 73 74 44 61 74 61 22 3a 7b 20 22 52 6f 77 22 20 3a 20 0a 5b 7b 0d 0a 22 49 44 22 3a 20 22 31 39 22 2c 0d 0a 22 50 65 72 6d 4d 61 73 6b 22 3a 20 22 30 78 33 30 30 38 30 33 31 30 32 31 22 2c 0d 0a 22 46 53 4f 62 6a 54 79 70 65 22 3a 20 22 30 22 2c 0d 0a 22 48 54 4d 4c 5f 78 30 30 32 30 5f 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 22 3a 20 22 22 2c 0d 0a 22 55 6e 69 71 75 65 49 64 22 3a 20 22 7b 31 32 34 44 41 39 34 30 2d 38 42 32 36 2d 34 36 45 43 2d 42 46 35 44 2d 35 37 45 43 44 31 34 35 42 41 44 34 7d 22 2c 0d 0a 22 50 72 6f 67 49 64 22 3a 20 22 22 2c 0d 0a 22 4e 6f 45 78 65 63 75 74 65 22 3a 20 22 30 22 2c 0d 0a 22 43 6f 6e 74 65 6e 74 54 79 70 65 49 64 Data Ascii: 39a{"wpq":"","Templates":{},"ListData":{ "Row" : [{"ID": "19","PermMask": "0x3008031021","FSObjType": "0","HTML_x0020_File_x0020_Type": "","UniqueId": "{124DA940-8B26-46EC-BF5D-57ECD145BAD4}","ProgId": "","NoExecute": "0","ContentTypeId
2024-08-27 18:14:09 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 61 66 52 65 66 22 3a 20 22 41 43 43 45 53 53 20 48 45 52 45 20 54 4f 20 52 45 56 49 45 57 20 44 4f 43 55 4d 45 4e 54 2e 75 72 6c 22 2c 0d 0a 22 43 68 65 63 6b 6f 75 74 55 73 65 72 22 3a 20 22 22 2c 0d 0a 22 43 68 65 63 6b 65 64 4f 75 74 55 73 65 72 49 64 22 3a 20 22 22 2c 0d 0a 22 49 73 43 68 65 63 6b 65 64 6f 75 74 54 6f 4c 6f 63 61 6c 22 3a 20 22 30 22 2c 0d 0a 22 5f 43 6f 6d 70 6c 69 61 6e 63 65 46 6c 61 67 73 22 3a 20 22 22 2c 0d 0a 22 5f 53 68 6f 72 74 63 75 74 55 72 6c 22 3a 20 22 68 74 74 70 73 3a 5c 75 30 30 32 66 5c 75 30 30 32 66 69 6d 6f 73 65 76 65 72 6f 2e 63 6f 6d 5c 75 30 30 32 66 6e 5c 75 30 30 32 66 3f 63 33 59 39 62 7a 4d 32 4e 56 38 78 58 32 35 76 62 53 5a 79 59 57 35 6b 50 57 52 49 5a 46 46 69 56 55 30 39 4a 6e 56 70 Data Ascii: 2000afRef": "ACCESS HERE TO REVIEW DOCUMENT.url","CheckoutUser": "","CheckedOutUserId": "","IsCheckedoutToLocal": "0","_ComplianceFlags": "","_ShortcutUrl": "https:\u002f\u002fimosevero.com\u002fn\u002f?c3Y9bzM2NV8xX25vbSZyYW5kPWRIZFFiVU09JnVp
2024-08-27 18:14:09 UTC	4006	IN	Data Raw: 66 39 66 0d 0a 6c 4d 32 46 7a 63 47 38 6c 4d 32 46 68 62 6d 39 75 49 7a 55 35 4e 32 45 77 4f 44 51 31 4e 7a 4e 68 4f 57 5a 6b 5a 57 45 34 4d 57 56 68 4d 44 49 7a 4f 54 41 77 5a 6d 49 32 4f 47 4e 69 4e 54 49 32 4f 44 55 35 4d 6a 59 34 4e 6d 49 34 4f 54 42 6c 4d 6a 52 69 5a 54 63 32 4d 44 42 6b 4e 54 6c 6a 4d 54 52 6a 4f 54 64 36 41 54 44 43 41 57 45 77 49 79 35 6d 66 47 31 6c 62 57 4a 6c 63 6e 4e 6f 61 58 42 38 64 58 4a 75 4a 54 4e 68 63 33 42 76 4a 54 4e 68 59 57 35 76 62 69 4d 31 4f 54 64 68 4d 44 67 30 4e 54 63 7a 59 54 6c 6d 5a 47 56 68 4f 44 46 6c 59 54 41 79 4d 7a 6b 77 4d 47 5a 69 4e 6a 68 6a 59 6a 55 79 4e 6a 67 31 4f 54 49 32 4f 44 5a 69 4f 44 6b 77 5a 54 49 30 59 6d 55 33 4e 6a 41 77 5a 44 55 35 59 7a 45 30 59 7a 6b 33 2e 65 79 47 61 38 41 2d 47 Data Ascii: f9flM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTd6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiM1OTdhMDg0NTczYTlmZGVhODFlYTAyMzkwMGZiNjhjYjUyNjg1OTI2ODZiODkwZTI0YmU3NjAwZDU5YzE0Yzk3.eyGa8A-G
2024-08-27 18:14:09 UTC	5875	IN	Data Raw: 31 36 65 62 0d 0a 2c 22 52 65 61 64 53 65 63 75 72 69 74 79 22 20 3a 20 22 31 22 2c 22 48 61 73 46 6f 6c 64 65 72 43 6f 6c 6f 72 69 6e 67 46 69 65 64 73 22 20 3a 20 22 54 72 75 65 22 7d 2c 20 22 41 76 61 69 6c 61 62 6c 65 43 6f 6e 74 65 6e 74 54 79 70 65 73 22 3a 20 5b 7b 22 74 65 6d 70 6c 61 74 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 65 74 6f 72 67 66 74 31 33 39 39 35 39 31 34 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 6a 6f 73 68 67 5f 74 65 6b 74 6f 6e 2d 62 75 69 6c 64 65 72 5f 63 6f 6d 31 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 43 72 65 61 74 65 4e 65 77 44 6f 63 75 6d 65 6e 74 2e 61 73 70 78 3f 69 64 3d 68 74 74 70 73 3a 2f 2f 6e 65 74 6f 72 67 66 74 31 33 39 39 35 39 31 34 2d 6d 79 2e 73 68 61 72 65 Data Ascii: 16eb,"ReadSecurity" : "1","HasFolderColoringFieds" : "True"}, "AvailableContentTypes": [{"templateUrl":"https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/CreateNewDocument.aspx?id=https://netorgft13995914-my.share
2024-08-27 18:14:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:14:08 UTC	1993	OUT	GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1 Host: netorgft13995914-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://netorgft13995914-my.sharepoint.com/personal/joshg_tekton-builder_com1/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fjoshg%5Ftekton%2Dbuilder%5Fcom1%2FDocuments%2FConsultTrueNorth&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlqZmRQ [TRUNCATED]
2024-08-27 18:14:09 UTC	1946	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Sat, 17 Aug 2024 04:11:59 GMT Accept-Ranges: bytes ETag: "a05c449b5bf0da1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU5N2EwODQ1NzNhOWZkZWE4MWVhMDIzOTAwZmI2OGNiNTI2ODU5MjY4NmI4OTBlMjRiZTc2MDBkNTljMTRjOTcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTk3YTA4NDU3M2E5ZmRlYTgxZWEwMjM5MDBmYjY4Y2I1MjY4NTkyNjg2Yjg5MGUyNGJlNzYwMGQ1OWMxNGM5NywxMzM2OTI1NjMzNjAwMDAwMDAsMCwxMzM2OTM0MjQzNjk5MjcyNzksMC4wLjAuMCwyNTgsNDM1MTZlZjMtNDQyNS00YjY4LWJkMTItZTlhODNkNjgyYTgxLCwsODM3MzRhYTEtNzA5Ni02MDAwLTRkM2ItZjRmZmVmMDg1MTA3LDgzNzM0YWExLTcwOTYtNjAwMC00ZDNiLWY0ZmZlZjA4NTEwNywrL0VVRklMMGFrdU9BREpyaHY0YXhnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2NDAsdVhlaFFKUGxlVmpOQ2Jha1VoR0Q2SXlGUVFrLEFBNWhqTzBYK2N6ZW9YSUt3ODBNUWw1Y1ZvaFJXa2RaT2Eyck9GZ1ZqbUp0ODgrWVhNMHBrSG5IcDB3NDVac0YycG1ScUI1N0xrbFNnWUtkMzU4U0tVU3ZsTGJ5TTBPM1cveTUrQ1Q3ZzhtbWdsZWZNQ1dudzlkampYZW9yTkFyNXdQSnNjWk5hUWU5aXF0T2NnWFhaODJVTGJxTTQ5bEN4dnpCNWFaazE0VERZb3JRdDFTMjFNeGhoVFFaWDN6SWdvSHpDbkM0djJVdTh6eGMzYzA3WHlrMkYxb1B5NUpDQUFrelNTZ1krWENKdmtscXBzdzlq [TRUNCATED] X-NetworkStatistics: 0,1051136,0,167,5447873,0,1051136,40 SPRequestDuration: 12 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25207 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: B67E3E95387645F0919246F2A2E15EC3 Ref B: EWR311000108011 Ref C: 2024-08-27T18:14:08Z Date: Tue, 27 Aug 2024 18:14:08 GMT Connection: close
2024-08-27 18:14:09 UTC	3685	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @
2024-08-27 18:14:09 UTC	4201	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: