Edit tour

Windows Analysis Report
https://rdhomes-my.sharepoint.com/:f:/g/personal/petrina_ryandesignerhomes_com_au/EtwntXraOOdMp3Nx1zZ6gF8Bf8aWSwNn9o_57nz1-Z9h0A?e=arAOsK

Overview

General Information

Sample URL:	https://rdhomes-my.sharepoint.com/:f:/g/personal/petrina_ryandesignerhomes_com_au/EtwntXraOOdMp3Nx1zZ6gF8Bf8aWSwNn9o_57nz1-Z9h0A?e=arAOsK
Analysis ID:	1523276
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Downloads suspicious files via Chrome

Phishing site or detected (based on various text indicators)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

May sleep (evasive loops) to hinder dynamic analysis

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2196 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2004,i,17339215039468375399,16465300689793914417,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

unarchiver.exe (PID: 2676 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\OneDrive_2024-10-01.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 5300 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\u1g2kedq.eh0" "C:\Users\user\Downloads\OneDrive_2024-10-01.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 5772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 6372 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rdhomes-my.sharepoint.com/:f:/g/personal/petrina_ryandesignerhomes_com_au/EtwntXraOOdMp3Nx1zZ6gF8Bf8aWSwNn9o_57nz1-Z9h0A?e=arAOsK" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /personal/petrina_ryandesignerhomes_com_au/_api/v2.1/graphql HTTP/1.1Host: rdhomes-my.sharepoint.comConnection: keep-aliveContent-Length: 507sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/json;odata=verboseContent-Type: application/json;odata=verboseX-ServiceWorker-Strategy: CacheFirstsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://rdhomes-my.sharepoint.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments%2FAcquisition%20Report%2FPayment%20Advise&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitBUHI2dTRUNXdmVlQ3aWRsNnplcW0rMk5NbHdqQVNxWjVxWStudnVHTVZhb21SZlcwVW82c0ZVRWJJaTkzR3ZkcUhtbzhzMzdabnhZYkR0L3hUMmhVZVRrS2k0QkRManNKZz09PC9TUD4=

Source: chromecache_485.2.dr, chromecache_498.2.dr, chromecache_567.2.dr, chromecache_560.2.dr, chromecache_486.2.dr, chromecache_456.2.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_484.2.dr, chromecache_668.2.dr, chromecache_715.2.dr	String found in binary or memory: http://www.contoso.com
Source: chromecache_590.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_721.2.dr, chromecache_583.2.dr, chromecache_441.2.dr	String found in binary or memory: https://1drv.com/
Source: chromecache_721.2.dr, chromecache_583.2.dr, chromecache_441.2.dr	String found in binary or memory: https://centralus1-mediad.svc.ms
Source: chromecache_721.2.dr, chromecache_583.2.dr	String found in binary or memory: https://clients.config.office.net/user/v1.0/web/policies
Source: chromecache_721.2.dr, chromecache_583.2.dr	String found in binary or memory: https://dynmsg.modpim.com/
Source: chromecache_721.2.dr, chromecache_583.2.dr, chromecache_441.2.dr	String found in binary or memory: https://livefilestore.com/
Source: chromecache_576.2.dr, chromecache_622.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_585.2.dr, chromecache_515.2.dr	String found in binary or memory: https://loki.delve.office.com
Source: chromecache_721.2.dr, chromecache_583.2.dr, chromecache_441.2.dr, chromecache_483.2.dr, chromecache_478.2.dr	String found in binary or memory: https://media.cloudapp.net
Source: chromecache_721.2.dr, chromecache_583.2.dr	String found in binary or memory: https://messaging-int.msonerm.com/
Source: chromecache_576.2.dr, chromecache_622.2.dr	String found in binary or memory: https://microsoft.spfx3rdparty.com
Source: chromecache_721.2.dr, chromecache_583.2.dr, chromecache_441.2.dr, chromecache_483.2.dr, chromecache_478.2.dr	String found in binary or memory: https://northcentralus1-medias.svc.ms
Source: chromecache_505.2.dr, chromecache_441.2.dr, chromecache_726.2.dr	String found in binary or memory: https://onedrive.cloud.microsoft
Source: chromecache_505.2.dr, chromecache_441.2.dr, chromecache_726.2.dr	String found in binary or memory: https://onedrive.dev.cloud.microsoft
Source: chromecache_644.2.dr, chromecache_609.2.dr	String found in binary or memory: https://onedrive.live.com/?gologin=1
Source: chromecache_576.2.dr, chromecache_622.2.dr	String found in binary or memory: https://onedrive.live.com/sa
Source: chromecache_721.2.dr, chromecache_583.2.dr, chromecache_441.2.dr	String found in binary or memory: https://portal.office.com/
Source: 7za.exe, 00000008.00000003.2048300294.0000000000D90000.00000004.00000800.00020000.00000000.sdmp, 587456cc-2310-48c7-9983-c07d2d274362.tmp.0.dr, chromecache_488.2.dr, CLICK HERE TO REVIEW DOCUMENT.url.8.dr	String found in binary or memory: https://qE5vHYe.tathyslam.com/Qt2rOX3/
Source: chromecache_548.2.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_721.2.dr, chromecache_583.2.dr	String found in binary or memory: https://res-1-sdf.cdn.office.net
Source: chromecache_721.2.dr, chromecache_644.2.dr, chromecache_583.2.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_684.2.dr, chromecache_617.2.dr, chromecache_659.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/fabric-cdn-prod_20230815.002/assets
Source: chromecache_644.2.dr, chromecache_643.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-09-13.007/
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-09-13.007/odblightspeedwebpack/en-us/initial.r
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-09-13.007/odblightspeedwebpack/odblightspeedwe
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-09-13.007/odblightspeedwebpack/plt.listviewdat
Source: chromecache_643.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-09-13.007/stsserviceworkerprefetch/stsservicew
Source: chromecache_669.2.dr, chromecache_643.2.dr, chromecache_670.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-09-20.006/
Source: chromecache_643.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-09-20.006/spserviceworker.js
Source: chromecache_669.2.dr, chromecache_670.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-09-20.006/spwebworker.js
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp-media-4705cd18
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.1ds/odsp.1ds.lib-67f10919
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.aria/odsp.aria.lib-2306eec9
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.core/fui.core-83eff072
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.core/fui.core-83eff072.js
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.utilities/fui.util-153996e1
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.utilities/fui.util-153996e1.js
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.knockout/odsp.knockout.lib-da617bab
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.knockout/odsp.knockout.lib-da617bab.js
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.react/odsp.react.lib-361c9c69
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.react/odsp.react.lib-361c9c69.js
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.tslib/tslib-e9cf7774
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.tslib/tslib-e9cf7774.js
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.utilities/odsp.util-2d58ae90
Source: chromecache_644.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.utilities/odsp.util-2d58ae90.js
Source: chromecache_644.2.dr	String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2024-09-13.007/
Source: chromecache_644.2.dr	String found in binary or memory: https://shell.cdn.office.net
Source: chromecache_644.2.dr, chromecache_643.2.dr	String found in binary or memory: https://shell.cdn.office.net/api/ShellBootstrapper/business/OneShell
Source: chromecache_721.2.dr, chromecache_583.2.dr	String found in binary or memory: https://shellppe.msocdn.com
Source: chromecache_721.2.dr, chromecache_583.2.dr	String found in binary or memory: https://shellprod.msocdn.com
Source: chromecache_644.2.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold
Source: chromecache_586.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semiligh
Source: chromecache_721.2.dr, chromecache_583.2.dr, chromecache_441.2.dr	String found in binary or memory: https://substrate.office.com
Source: chromecache_566.2.dr, chromecache_503.2.dr	String found in binary or memory: https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48
Source: chromecache_609.2.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$
Source: chromecache_644.2.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive
Source: chromecache_609.2.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2F$
Source: chromecache_644.2.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2Fonedrive

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49741 version: TLS 1.2

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\OneDrive_2024-10-01.zip (copy)

Jump to dropped file

Source: classification engine

Classification label: mal56.phis.win@24/486@48/10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\587456cc-2310-48c7-9983-c07d2d274362.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5772:120:WilError_03

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2004,i,17339215039468375399,16465300689793914417,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rdhomes-my.sharepoint.com/:f:/g/personal/petrina_ryandesignerhomes_com_au/EtwntXraOOdMp3Nx1zZ6gF8Bf8aWSwNn9o_57nz1-Z9h0A?e=arAOsK"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\OneDrive_2024-10-01.zip"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\u1g2kedq.eh0" "C:\Users\user\Downloads\OneDrive_2024-10-01.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2004,i,17339215039468375399,16465300689793914417,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\OneDrive_2024-10-01.zip"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\u1g2kedq.eh0" "C:\Users\user\Downloads\OneDrive_2024-10-01.zip"	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 1880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 3550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 1880000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 4900

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: chromecache_602.2.dr, chromecache_482.2.dr, chromecache_518.2.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_602.2.dr, chromecache_482.2.dr, chromecache_518.2.dr	Binary or memory string: ",DisconnectVirtualMachine:"

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\u1g2kedq.eh0" "C:\Users\user\Downloads\OneDrive_2024-10-01.zip"

Source: Chrome DOM: 0.2	OCR Text: IZ Download Sort z Details Petrina Ryan Acquisition Report Payment Advise Activity Name Modified Modified By File size Sharing Petrina Ryan CLICK HERE TO REVIEW DOCUMENT.url Sunday at 6:21 62 bytes Shared Petrina Ryan shared this file Yes
Source: Chrome DOM: 0.3	OCR Text: OneDrive U Download Sort v 81 Details Petrina Ryan Acquisition Report > Payment Advise 83 Activity Name v Modified Modified By File size Sharing Petrina Ryan E? Petrina Ryan shared this file CLICK HERE TO REVIEW DOCUMENT.url Sunday at 6:21 62 bytes 00 Shared

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: rdhomes-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: rdhomes.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: config.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: australiaeast1-mediap.svc.ms
Source: global traffic	DNS traffic detected: DNS query: df53bbda866f9adda00180748207353e.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: outlook.office365.com
Source: global traffic	DNS traffic detected: DNS query: tr-ooc-atm.office.com
Source: global traffic	DNS traffic detected: DNS query: upload.fp.measure.office.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
https://rdhomes-my.sharepoint.com/:f:/g/personal/petrina_ryandesignerhomes_com_au/EtwntXraOOdMp3Nx1zZ6gF8Bf8aWSwNn9o_57nz1-Z9h0A?e=arAOsK	0%	Virustotal		Browse
https://rdhomes-my.sharepoint.com/:f:/g/personal/petrina_ryandesignerhomes_com_au/EtwntXraOOdMp3Nx1zZ6gF8Bf8aWSwNn9o_57nz1-Z9h0A?e=arAOsK	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Link
www.google.com	0%	Virustotal	Browse
k-9999.k-msedge.net	0%	Virustotal	Browse
mira-ooc.tm-4.office.com	0%	Virustotal	Browse
dual-spo-0005.spo-msedge.net	0%	Virustotal	Browse
FRA-efz.ms-acdc.office.com	0%	Virustotal	Browse
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
outlook.office365.com	0%	Virustotal	Browse
australiaeast1-mediap.svc.ms	0%	Virustotal	Browse
upload.fp.measure.office.com	0%	Virustotal	Browse
r4.res.office365.com	0%	Virustotal	Browse
m365cdn.nel.measure.office.net	0%	Virustotal	Browse
tr-ooc-atm.office.com	0%	Virustotal	Browse
config.fp.measure.office.com	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://www.opensource.org/licenses/mit-license.php	0%	URL Reputation	safe
https://substrate.office.com	0%	URL Reputation	safe
https://reactjs.org/link/react-polyfills	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
http://fb.me/use-check-prop-types	0%	URL Reputation	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2	0%	Virustotal		Browse
https://northcentralus1-medias.svc.ms	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2	0%	Virustotal		Browse
https://onedrive.live.com/?gologin=1	1%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	0%, Virustotal, Browse	unknown
k-9999.k-msedge.net	13.107.18.254	true	false	0%, Virustotal, Browse	unknown
196391-ipv4v6.farm.dprodmgd106.aa-rt.sharepoint.com	52.105.235.41	true	false		unknown
mira-ooc.tm-4.office.com	52.98.243.50	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.186.36	true	false	0%, Virustotal, Browse	unknown
FRA-efz.ms-acdc.office.com	52.98.178.226	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
df53bbda866f9adda00180748207353e.fp.measure.office.com	unknown	unknown	false		unknown
rdhomes-my.sharepoint.com	unknown	unknown	false		unknown
r4.res.office365.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
australiaeast1-mediap.svc.ms	unknown	unknown	false	0%, Virustotal, Browse	unknown
upload.fp.measure.office.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
config.fp.measure.office.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
m365cdn.nel.measure.office.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
rdhomes.sharepoint.com	unknown	unknown	false		unknown
tr-ooc-atm.office.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
outlook.office365.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
spo.nel.measure.office.net	unknown	unknown	false		unknown

Name	Malicious	Reputation
https://tr-ooc-atm.office.com/apc/trans.gif?2b08f9d53a3bc8b8eeadf020fb4d1bbf	false	unknown
https://rdhomes-my.sharepoint.com/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG333	false	unknown
https://rdhomes-my.sharepoint.com/ScriptResource.axd?d=RM75uyDL_1HzyT9ToywPpglCKODr-jurQwop5oMS0Ct9To3fnFYw3EVieBMggiyU74uzbFgSPHNe_w5tWfV7LMLy7NSy8Sa-HZdPz0B-vc2CexWwOjVVxkRSdqmTwggsPwqN4Wn19IGobSdxCHuRAcSBXTwkoLEGSIyftOW0nP2oP1hJ_-duhpMQQjPeoVCf0&t=7a0cc936	false	unknown
https://df53bbda866f9adda00180748207353e.fp.measure.office.com/apc/trans.gif?2056613d49f3680555b42f2edb81ea38	false	unknown
https://rdhomes-my.sharepoint.com/_layouts/15/1033/styles/corev15.css?rev=m%2Fe%2BPmKMYmkX%2Fs1lVR9Uww%3D%3DTAG333	false	unknown
https://rdhomes-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx	false	unknown
https://rdhomes-my.sharepoint.com/_layouts/15/SPComponentRegistry.ashx?projects=[%22spfx%22]&languages=%5B%5D	false	unknown
https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_layouts/15/CSPReporting.aspx	false	unknown
https://rdhomes-my.sharepoint.com/ScriptResource.axd?d=UhxNYNt_5o7-HOUFXNVapCERBXDl1SzdJ7TVVQdGC2_UlRyMZbz_tyq5n3XHL8oPM09VWzdOJi1by2ySbanlnfZssdsl8dEzCoxVmBBEUyDKaDsvJ_OpRK5fxXo92jgkO7T6142f4Buq1lbVlnMXoFJFmFIBH8yxtms1EuveTS-gkLrh5DhTv6y57DRN1JXm0&t=7a0cc936	false	unknown
https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments%2FAcquisition%20Report%2FPayment%20Advise&ga=1	false	unknown
https://tr-ooc-atm.office.com/apc/trans.gif?51e00f218cabd44b99060e5002358d66	false	unknown
https://australiaeast1-mediap.svc.ms/transform/zip?cs=fFNQTw	false	unknown
https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_layouts/15/undefined/_layouts/15/onedrive.aspx?view=1	false	unknown
https://outlook.office365.com/apc/trans.gif?fb9a2c9e0d9837477e572377fccc77a4	false	unknown
https://rdhomes-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&navigationPreloadHeaderValue=%7B%22supportsFeatures%22%3A%5B1855%2C61313%5D%7D&dataHost=Nucleus&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%2C%7B%22id%22%3A%22SPStart%22%7D%2C%7B%22id%22%3A%22Agreements%22%7D%5D&list=v2&prefetchListData=true&defaultBrotli=true&authenticateFast=true&inlineAuth=v2&wwData=true&enableTheming=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true&streamViewServerLoad=true&streamInlineScript=true	false	unknown
https://rdhomes-my.sharepoint.com/_layouts/15/images/odbfavicon.ico?rev=47	false	unknown
https://outlook.office365.com/apc/trans.gif?6266b47f5d4f7c5029fc76391e8ad3b4	false	unknown
https://rdhomes-my.sharepoint.com/WebResource.axd?d=BCu1gpTsV1AN-0NglPD8LdIdsuUyLJN9GzPvdz8u3hKjsxegdY033hpynTH4RBUGPpvOvu1taVmJZIpI3UDKZXIBPlGpx8EoA5-3Uy221o01&t=638588829843638381	false	unknown
https://df53bbda866f9adda00180748207353e.fp.measure.office.com/apc/trans.gif?649a4e95f7bceeb22c56993e172709bb	false	unknown
https://rdhomes-my.sharepoint.com/:f:/g/personal/petrina_ryandesignerhomes_com_au/EtwntXraOOdMp3Nx1zZ6gF8Bf8aWSwNn9o_57nz1-Z9h0A?e=arAOsK	true	unknown
https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_api/v2.1/graphql	false	unknown
https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_layouts/15/AccessDenied.aspx?correlation=dd9b55a1%2D90aa%2D3000%2Dd75a%2D064be18980e4	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff	chromecache_586.2.dr	false	0%, Virustotal, Browse	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2	chromecache_586.2.dr	false	0%, Virustotal, Browse	unknown
https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48	chromecache_566.2.dr, chromecache_503.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula	chromecache_586.2.dr	false	0%, Virustotal, Browse	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff	chromecache_586.2.dr	false	0%, Virustotal, Browse	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2	chromecache_586.2.dr	false	0%, Virustotal, Browse	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w	chromecache_586.2.dr	false	0%, Virustotal, Browse	unknown
http://www.opensource.org/licenses/mit-license.php	chromecache_590.2.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff	chromecache_586.2.dr	false	0%, Virustotal, Browse	unknown
https://northcentralus1-medias.svc.ms	chromecache_721.2.dr, chromecache_583.2.dr, chromecache_441.2.dr, chromecache_483.2.dr, chromecache_478.2.dr	false	0%, Virustotal, Browse	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2	chromecache_586.2.dr	false	0%, Virustotal, Browse	unknown
https://onedrive.live.com/?gologin=1	chromecache_644.2.dr, chromecache_609.2.dr	false	1%, Virustotal, Browse	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo	chromecache_586.2.dr	false	0%, Virustotal, Browse	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2	chromecache_586.2.dr	false	0%, Virustotal, Browse	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2	chromecache_586.2.dr	false	0%, Virustotal, Browse	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2	chromecache_586.2.dr	false	0%, Virustotal, Browse	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff	chromecache_586.2.dr	false	0%, Virustotal, Browse	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff	chromecache_586.2.dr	false	0%, Virustotal, Browse	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2	chromecache_586.2.dr	false		unknown
https://1drv.com/	chromecache_721.2.dr, chromecache_583.2.dr, chromecache_441.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff	chromecache_586.2.dr	false		unknown
https://substrate.office.com	chromecache_721.2.dr, chromecache_583.2.dr, chromecache_441.2.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff	chromecache_586.2.dr	false		unknown
https://onedrive.dev.cloud.microsoft	chromecache_505.2.dr, chromecache_441.2.dr, chromecache_726.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2	chromecache_586.2.dr	false		unknown
https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive	chromecache_644.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo	chromecache_586.2.dr	false		unknown
https://www.office.com/login?ru=%2Flaunch%2F$	chromecache_609.2.dr	false		unknown
https://shellppe.msocdn.com	chromecache_721.2.dr, chromecache_583.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w	chromecache_586.2.dr	false		unknown
https://microsoft.spfx3rdparty.com	chromecache_576.2.dr, chromecache_622.2.dr	false		unknown
https://reactjs.org/link/react-polyfills	chromecache_548.2.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com	chromecache_576.2.dr, chromecache_622.2.dr	false	URL Reputation: safe	unknown
https://onedrive.live.com/sa	chromecache_576.2.dr, chromecache_622.2.dr	false		unknown
https://onedrive.cloud.microsoft	chromecache_505.2.dr, chromecache_441.2.dr, chromecache_726.2.dr	false		unknown
https://shellprod.msocdn.com	chromecache_721.2.dr, chromecache_583.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2	chromecache_586.2.dr	false		unknown
https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$	chromecache_609.2.dr	false		unknown
https://centralus1-mediad.svc.ms	chromecache_721.2.dr, chromecache_583.2.dr, chromecache_441.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2	chromecache_586.2.dr	false		unknown
https://portal.office.com/	chromecache_721.2.dr, chromecache_583.2.dr, chromecache_441.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff	chromecache_586.2.dr	false		unknown
https://clients.config.office.net/user/v1.0/web/policies	chromecache_721.2.dr, chromecache_583.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff	chromecache_586.2.dr	false		unknown
http://fb.me/use-check-prop-types	chromecache_485.2.dr, chromecache_498.2.dr, chromecache_567.2.dr, chromecache_560.2.dr, chromecache_486.2.dr, chromecache_456.2.dr	false	URL Reputation: safe	unknown
https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js	chromecache_644.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2	chromecache_586.2.dr	false		unknown
https://livefilestore.com/	chromecache_721.2.dr, chromecache_583.2.dr, chromecache_441.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof	chromecache_586.2.dr	false		unknown
https://messaging-int.msonerm.com/	chromecache_721.2.dr, chromecache_583.2.dr	false		unknown
https://qE5vHYe.tathyslam.com/Qt2rOX3/	7za.exe, 00000008.00000003.2048300294.0000000000D90000.00000004.00000800.00020000.00000000.sdmp, 587456cc-2310-48c7-9983-c07d2d274362.tmp.0.dr, chromecache_488.2.dr, CLICK HERE TO REVIEW DOCUMENT.url.8.dr	false		unknown
http://www.contoso.com	chromecache_484.2.dr, chromecache_668.2.dr, chromecache_715.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili	chromecache_586.2.dr	false		unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2	chromecache_586.2.dr	false		unknown
https://www.office.com/login?ru=%2Flaunch%2Fonedrive	chromecache_644.2.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
52.98.179.210	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.105.235.41	196391-ipv4v6.farm.dprodmgd106.aa-rt.sharepoint.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.98.243.50	mira-ooc.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.98.178.226	FRA-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.18.254	k-9999.k-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.99.157.18	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523276
Start date and time:	2024-10-01 12:10:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://rdhomes-my.sharepoint.com/:f:/g/personal/petrina_ryandesignerhomes_com_au/EtwntXraOOdMp3Nx1zZ6gF8Bf8aWSwNn9o_57nz1-Z9h0A?e=arAOsK
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@24/486@48/10
Cookbook Comments:	Browse: https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_layouts/15/undefined/_layouts/15/onedrive.aspx?view=1

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<https://qE5vHYe.tathyslam.com/Qt2rOX3/>), ASCII text
Category:	dropped
Size (bytes):	62
Entropy (8bit):	4.876873931040565
Encrypted:	false
SSDEEP:	3:HRAbABGQF6MfzeR4NTLd3rD:HRYF7eqATZ/
MD5:	7A9485AD0AFD12784D932AB9FD6D3B85
SHA1:	9F0B5FD8D58446591B6D8E3AC9F7C330FBE03201
SHA-256:	A07EEB18F0738CF6FF84E43B27D8591D67879ECED8B5765D94DCA0B3B762E4AF
SHA-512:	0980DAF307AF641171847E3AF1D44871AD993546D1AFEF528705C3379B8AED5C211865508734E24F054BB239DADE8CE862BD85F2E62E4E614F521C7EA4B2DE0A
Malicious:	false
Reputation:	low
Preview:	[InternetShortcut].URL=https://qE5vHYe.tathyslam.com/Qt2rOX3/.

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1347
Entropy (8bit):	5.031794760628818
Encrypted:	false
SSDEEP:	24:MwD6hBcFDf9CcGiJDcGiJjWIP7cGiJDcGiJUwFcGiJfk+nUcGiJDcGiJFTA6hBcD:rWXcR9CcGGDcGGbDcGGDcGGpFcGG8+nb
MD5:	F07F8614AC507B1F043EBE738ECFC12C
SHA1:	E3B85D4FEAFB25CEF3C676E06734F77583F22A44
SHA-256:	899804B7951F8B4FD60BE6D6AC72F8C052808D51FD5B4739CAA055990848A9D5
SHA-512:	4F0BABF02407B0DDE94C46D6F6CB7D57A8E35FF7F04A6ABCAD2CA39523067D42524F77B184C0533C725F65AE8523D8D8E987B4B9F036793D55C6E60104DC932F
Malicious:	false
Reputation:	low
Preview:	10/01/2024 6:11 AM: Unpack: C:\Users\user\Downloads\OneDrive_2024-10-01.zip..10/01/2024 6:11 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\u1g2kedq.eh0..10/01/2024 6:11 AM: Received from standard out: ..10/01/2024 6:11 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..10/01/2024 6:11 AM: Received from standard out: ..10/01/2024 6:11 AM: Received from standard out: Scanning the drive for archives:..10/01/2024 6:11 AM: Received from standard out: 1 file, 272 bytes (1 KiB)..10/01/2024 6:11 AM: Received from standard out: ..10/01/2024 6:11 AM: Received from standard out: Extracting archive: C:\Users\user\Downloads\OneDrive_2024-10-01.zip..10/01/2024 6:11 AM: Received from standard out: --..10/01/2024 6:11 AM: Received from standard out: Path = C:\Users\user\Downloads\OneDrive_2024-10-01.zip..10/01/2024 6:11 AM: Received from standard out: Type = zip..10/01/2024 6:11 AM: Received from standard out: Physical Size = 272..10/01/2024 6:11

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	272
Entropy (8bit):	5.152047862397866
Encrypted:	false
SSDEEP:	6:5j+rWm8tCNKIuGYF7eqATZAxx+iWm8tCNKIurmt+ly:5jUWm8tCNbhYFaTZAx/Wm8tCNb0mtay
MD5:	BE030BEF6775C6616CD2E7BB29408413
SHA1:	917D066DB5B5F071C4A392365E09596FE299CE6A
SHA-256:	A20709D11E59BA46FA59700DFAE8E9537FC61BB48D9CDFF8B7EAD531DEFB0B43
SHA-512:	A53EDEB63C7EB1D375692C5B186B1275A4E9C2F07FF81474FB046CBDB45336B932F00AC2B04FA0798C8BA709BCB432D86EEEBD1297E98413433BC19A642370D3
Malicious:	false
Reputation:	low
Preview:	PK........`QAY............0...Payment Advise/CLICK HERE TO REVIEW DOCUMENT.url[InternetShortcut].URL=https://qE5vHYe.tathyslam.com/Qt2rOX3/.PK..7zL.>...>...PK..........`QAY7zL.>...>...0.................Payment Advise/CLICK HERE TO REVIEW DOCUMENT.urlPK..........^.........

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 12:11:07.978640079 CEST	53	50238	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:08.035444975 CEST	53	64418	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:08.861067057 CEST	53	61583	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:10.014915943 CEST	62856	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:10.023133039 CEST	54352	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:12.412372112 CEST	57980	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:12.412739992 CEST	55065	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:12.419287920 CEST	53	57980	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:12.419528008 CEST	53	55065	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:17.204940081 CEST	51012	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:17.205125093 CEST	51396	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:17.951406956 CEST	60540	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:17.951813936 CEST	51726	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:25.890706062 CEST	53	54696	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:26.190274000 CEST	138	138	192.168.2.4	192.168.2.255
Oct 1, 2024 12:11:28.112509966 CEST	55699	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:28.113111973 CEST	51987	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:31.540431023 CEST	49327	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:31.540574074 CEST	50015	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:34.103658915 CEST	56033	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:34.103970051 CEST	62822	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:35.130897045 CEST	62890	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:35.131181002 CEST	65064	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:35.137310982 CEST	59116	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:35.137449980 CEST	59161	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:35.138972998 CEST	53	65064	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:36.167598963 CEST	64145	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:36.167809010 CEST	60455	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:36.198478937 CEST	53	60455	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:37.176626921 CEST	53034	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:37.176626921 CEST	53238	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:37.189524889 CEST	53	53034	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:37.189558983 CEST	53	53238	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:44.857793093 CEST	53	60552	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:46.769139051 CEST	49886	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:46.769283056 CEST	59864	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:46.799510956 CEST	53	59864	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:47.502310038 CEST	63852	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:47.502569914 CEST	55892	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:47.524688959 CEST	53	55892	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:48.190028906 CEST	60646	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:48.190329075 CEST	59580	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:48.197588921 CEST	53	60646	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:48.197602987 CEST	53	59580	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:49.242029905 CEST	63873	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:49.242182970 CEST	62935	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:49.248963118 CEST	53	63873	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:49.248985052 CEST	53	62935	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:50.483817101 CEST	61563	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:50.483982086 CEST	51561	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:50.490883112 CEST	53	61563	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:50.491023064 CEST	53	51561	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:51.498434067 CEST	53553	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:51.498570919 CEST	58397	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:51.505196095 CEST	53	53553	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:51.516076088 CEST	53	58397	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:52.530447960 CEST	49355	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:52.531562090 CEST	55866	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:52.539150000 CEST	53	55866	1.1.1.1	192.168.2.4
Oct 1, 2024 12:11:53.219721079 CEST	60080	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:53.219897032 CEST	60330	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:11:53.226788998 CEST	53	60330	1.1.1.1	192.168.2.4
Oct 1, 2024 12:12:07.394829988 CEST	53	54727	1.1.1.1	192.168.2.4
Oct 1, 2024 12:12:07.491725922 CEST	53	51459	1.1.1.1	192.168.2.4
Oct 1, 2024 12:12:17.951203108 CEST	53057	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:12:17.951407909 CEST	61740	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:12:17.951894045 CEST	64686	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:12:17.952219009 CEST	55750	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:12:17.952790976 CEST	58223	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:12:17.952996016 CEST	59962	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:12:17.953310966 CEST	63818	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:12:17.953499079 CEST	54070	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:12:19.070183039 CEST	65254	53	192.168.2.4	1.1.1.1
Oct 1, 2024 12:12:19.070550919 CEST	51543	53	192.168.2.4	1.1.1.1

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 1, 2024 12:11:36.198545933 CEST	192.168.2.4	1.1.1.1	c22b	(Port unreachable)	Destination Unreachable
Oct 1, 2024 12:12:18.004125118 CEST	192.168.2.4	1.1.1.1	c35d	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-10-01 10:11:10 UTC	771	OUT	GET /:f:/g/personal/petrina_ryandesignerhomes_com_au/EtwntXraOOdMp3Nx1zZ6gF8Bf8aWSwNn9o_57nz1-Z9h0A?e=arAOsK HTTP/1.1 Host: rdhomes-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-01 10:11:13 UTC	3786	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 337 Content-Type: text/html; charset=utf-8 Location: https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments%2FAcquisition%20Report%2FPayment%20Advise&ga=1 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitB [TRUNCATED] X-NetworkStatistics: 0,525568,0,0,432,0,26332,195 X-SharePointHealthScore: 3 X-MS-SPO-CookieValidator: UohGZCubY5fTsIgZI0+5BXC6ZbfpM6Ex7y8APVm7DjkDlhZrAI4qEJdLrbV16KZhhS2FQ+kvWuxHpw8wED+pFjsRCscXA/TVFw6slp0glFhGjUKxj5zKx0RGzy+uFUwrzdpfqsl7OJlY6q0rkBLbZYrDV0ROpskRZwiIn0v9xvK99OpI49yj3SyuSwjet1O1lMbTDSS552O2sj99vfCgn5HCgn6Qsdo4U/FBb6NM8FnypSMtu22+APr6u4T5wfVT7idl6zeqm+2NMlwjASqZ5qY+nvuGMVaomRfW0Uo6sFUEbIi93GvdqHmo8s37ZnxYbDt/xT2hUeTkKi4BDLjsJg== X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: cd9b55a1-f03c-3000-d06f-2c0aea254342 request-id: cd9b55a1-f03c-3000-d06f-2c0aea254342 MS-CV: oVWbzTzwADDQbywK6iVDQg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=cc986967-55d8-460d-b0ce-c89fd792728c&destinationEndpoint=Edge-Prod-EWR31r5a&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 2018 SPIisLatency: 19 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25311 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 0E8C3A24BBE74E6DA270171B0B04E128 Ref B: EWR311000102027 Ref C: 2024-10-01T10:11:10Z Date: Tue, 01 Oct 2024 10:11:13 GMT Connection: close
2024-10-01 10:11:13 UTC	337	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 64 68 6f 6d 65 73 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 70 65 74 72 69 6e 61 5f 72 79 61 6e 64 65 73 69 67 6e 65 72 68 6f 6d 65 73 5f 63 6f 6d 5f 61 75 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 6f 6e 65 64 72 69 76 65 2e 61 73 70 78 3f 69 64 3d 25 32 46 70 65 72 73 6f 6e 61 6c 25 32 46 70 65 74 72 69 6e 61 25 35 46 72 79 61 6e 64 65 73 69 67 6e 65 72 68 6f 6d 65 73 25 35 46 63 6f 6d 25 35 46 61 75 25 32 46 44 6f 63 75 6d 65 6e 74 73 25 32 46 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments%2F

Timestamp	Bytes transferred	Direction	Data
2024-10-01 10:11:13 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-01 10:11:13 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=196477 Date: Tue, 01 Oct 2024 10:11:13 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-10-01 10:11:13 UTC	2012	OUT	GET /personal/petrina_ryandesignerhomes_com_au/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments%2FAcquisition%20Report%2FPayment%20Advise&ga=1 HTTP/1.1 Host: rdhomes-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitBUHI2 [TRUNCATED]
2024-10-01 10:11:14 UTC	10926	IN	HTTP/1.1 200 OK Cache-Control: private Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitB [TRUNCATED] X-NetworkStatistics: 0,525568,0,0,410,0,26332,194 X-SharePointHealthScore: 0 Referrer-Policy: no-referrer, strict-origin-when-cross-origin Reporting-Endpoints: cspendpoint="https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_layouts/15/CSPReporting.aspx" X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com .cloud.microsoft app.powerbi.com; Content-Security-Policy-Report-Only: base-uri 'none';;report-to cspendpoint Content-Security-Policy: worker-src 'self' blob:;script-src https://contentstorage.osi.office.net https://swx.cdn.skype.com https://res.delve.office.com https://lpcres.delve.office.com https://widget.uservoice.com https://by2.uservoice.com https://www.bing.com/api/maps/ https://www.bing.com/rms/ https://fabriciss.azureedge.net https://publiccdn.sharepointonline.com https://ajax.aspnetcdn.com https://res-1.cdn.office.net https://res-1.cdn.office.net https://res-2.cdn.office.net https://webshell.suite.office.com https://amcdn.msftauth.net .cdn.office.net .fluidpreview.office.net https://teams.microsoft.com https://js.monitor.azure.com https://r4.res.office365.com https://c1-excel-15.cdn.office.net https://c1-onenote-15.cdn.office.net https://c1-powerpoint-15.cdn.office.net https://c1-visio-15.cdn.office.net https://c1-word-view-15.cdn.office.net https://loki.delve.office.com https://res.cdn.office.net/midgard/ https://substrate.office.com 'unsafe-eval' 'nonce-454f3921-8209-445a-a663-7f3864b3b6b4'; Content-Security-Policy-Report-Only: style-src https://contentstorage.osi.office.net https://swx.cdn.skype.com https://res.delve.office.com https://lpcres.delve.office.com https://widget.uservoice.com https://by2.uservoice.com https://www.bing.com/api/maps/ https://www.bing.com/rms/ https://fabriciss.azureedge.net https://publiccdn.sharepointonline.com https://ajax.aspnetcdn.com https://res-1.cdn.office.net https://res-1.cdn.office.net https://res-2.cdn.office.net https://webshell.suite.office.com https://amcdn.msftauth.net .cdn.office.net .fluidpreview.office.net https://teams.microsoft.com https://js.monitor.azure.com https://r4.res.office365.com https://c1-excel-15.cdn.office.net https://c1-onenote-15.cdn.office.net https://c1-powerpoint-15.cdn.office.net https://c1-visio-15.cdn.office.net https://c1-word-view-15.cdn.office.net https://loki.delve.office.com https://res.cdn.office.net/midgard/ https://substrate.office.com 'self' blob: 'unsafe-inline';connect-src 'self' blob: https://.bing.com https://.s [TRUNCATED] X-Service-Worker-Application-Id: STS X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: cd9b55a1-20f4-3000-d06f-24583265d996 request-id: cd9b55a1-20f4-3000-d06f-24583265d996 MS-CV: oVWbzfQgADDQbyRYMmXZlg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=cc986967-55d8-460d-b0ce-c89fd792728c&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25311 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 0919DC46DF71448A9FCEB413B1BC8A7C Ref B: EWR311000107051 Ref C: 2024-10-01T10:11:13Z Date: Tue, 01 Oct 2024 10:11:14 GMT Connection: close
2024-10-01 10:11:14 UTC	1340	IN	Data Raw: 35 33 35 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 47 45 4e 45 52 41 54 4f 52 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 69 63 72 6f 73 6f 66 74 20 53 68 61 72 65 50 6f 69 6e 74 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 Data Ascii: 535<!DOCTYPE html><html lang="en-us" dir="ltr"><head><meta name="GENERATOR" content="Microsoft SharePoint" /><meta http-equiv="Content-type" content="text/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta http-equ
2024-10-01 10:11:14 UTC	4248	IN	Data Raw: 31 30 39 30 0d 0a 79 49 64 28 27 53 75 69 74 65 4e 61 76 53 68 65 6c 6c 43 6f 72 65 27 29 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6c 6f 61 64 27 2c 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 28 74 79 70 65 6f 66 20 6d 61 72 6b 50 65 72 66 53 74 61 67 65 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 20 26 26 20 6d 61 72 6b 50 65 72 66 53 74 61 67 65 28 27 73 75 69 74 65 4e 61 76 53 63 72 69 70 74 41 73 79 6e 63 45 6e 64 27 29 29 3b 20 69 66 20 28 77 69 6e 64 6f 77 2e 65 78 65 63 75 74 65 53 75 69 74 65 4e 61 76 4f 6e 63 65 29 20 7b 20 77 69 6e 64 6f 77 2e 65 78 65 63 75 74 65 53 75 69 74 65 4e 61 76 4f 6e 63 65 28 29 20 7d 20 77 69 6e 64 6f 77 2e 73 68 65 6c 6c 43 6f 72 65 4c 6f 61 64 65 64 20 3d 20 74 72 75 65 3b 20 7d 29 3b 77 69 6e 64 6f Data Ascii: 1090yId('SuiteNavShellCore').addEventListener('load', function() { (typeof markPerfStage === 'function' && markPerfStage('suiteNavScriptAsyncEnd')); if (window.executeSuiteNavOnce) { window.executeSuiteNavOnce() } window.shellCoreLoaded = true; });windo
2024-10-01 10:11:14 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 6e 5f 48 69 6e 74 3a 20 27 75 72 6e 3a 73 70 6f 3a 61 6e 6f 6e 23 39 38 61 65 38 61 32 36 36 61 34 62 36 35 66 61 39 31 39 66 37 38 37 32 65 62 66 33 31 61 35 30 62 39 36 30 34 64 34 30 63 64 61 33 37 38 36 62 31 30 65 62 38 35 38 39 32 32 34 34 61 66 36 38 27 2c 20 61 70 70 53 69 67 6e 49 6e 55 72 6c 3a 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6f 66 66 69 63 65 2e 63 6f 6d 2f 6c 6f 67 69 6e 3f 70 72 6f 6d 70 74 3d 73 65 6c 65 63 74 5f 61 63 63 6f 75 6e 74 26 72 75 3d 25 32 46 6c 61 75 6e 63 68 25 32 46 6f 6e 65 64 72 69 76 65 27 2c 20 61 70 70 53 69 67 6e 4f 75 74 55 72 6c 3a 20 27 68 74 74 70 73 3a 5c 75 30 30 32 66 5c 75 30 30 32 66 72 64 68 6f 6d 65 73 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 5c 75 30 30 32 66 70 65 72 Data Ascii: 2000n_Hint: 'urn:spo:anon#98ae8a266a4b65fa919f7872ebf31a50b9604d40cda3786b10eb85892244af68', appSignInUrl: 'https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive', appSignOutUrl: 'https:\u002f\u002frdhomes-my.sharepoint.com\u002fper
2024-10-01 10:11:14 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 72 64 68 6f 6d 65 73 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 22 2c 22 54 65 6e 61 6e 74 41 64 6d 69 6e 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 64 68 6f 6d 65 73 2d 61 64 6d 69 6e 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 22 2c 22 50 6f 72 74 61 6c 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 64 68 6f 6d 65 73 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 22 2c 22 41 64 64 69 74 69 6f 6e 61 6c 55 72 6c 73 22 3a 5b 5d 7d 5d 2c 22 76 69 65 77 4f 6e 6c 79 45 78 70 65 72 69 65 6e 63 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 6d 33 36 35 47 72 6f 75 70 73 42 6c 6f 63 6b 44 6f 77 6e 6c 6f 61 64 73 45 78 70 65 72 69 65 6e 63 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 72 65 61 64 4f 6e 6c 79 45 78 70 Data Ascii: 2000rdhomes-my.sharepoint.com/","TenantAdminUrl":"https://rdhomes-admin.sharepoint.com/","PortalUrl":"https://rdhomes.sharepoint.com/","AdditionalUrls":[]}],"viewOnlyExperienceEnabled":false,"m365GroupsBlockDownloadsExperienceEnabled":false,"readOnlyExp
2024-10-01 10:11:14 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 42 31 22 3a 74 72 75 65 2c 22 45 36 38 46 34 44 39 31 2d 34 46 34 35 2d 34 30 33 34 2d 42 30 43 37 2d 45 41 42 41 39 36 46 32 33 43 31 35 22 3a 74 72 75 65 2c 22 38 30 33 44 45 35 30 41 2d 30 44 34 31 2d 34 44 37 43 2d 39 35 31 32 2d 45 37 41 34 41 44 45 37 34 34 33 31 22 3a 74 72 75 65 2c 22 44 43 44 32 45 38 39 46 2d 35 38 44 34 2d 34 37 30 43 2d 38 32 33 39 2d 30 39 37 37 31 33 33 42 38 35 35 37 22 3a 74 72 75 65 2c 22 44 39 42 38 30 41 43 45 2d 44 33 39 41 2d 34 32 46 32 2d 39 39 33 42 2d 30 34 46 33 45 35 41 46 34 31 34 37 22 3a 74 72 75 65 2c 22 35 36 45 45 33 35 30 37 2d 45 44 35 32 2d 34 46 30 38 2d 41 44 43 35 2d 38 30 34 46 41 45 35 35 31 39 38 46 22 3a 74 72 75 65 2c 22 31 31 38 33 30 35 39 46 2d 41 37 43 44 2d 34 31 39 43 2d Data Ascii: 2000B1":true,"E68F4D91-4F45-4034-B0C7-EABA96F23C15":true,"803DE50A-0D41-4D7C-9512-E7A4ADE74431":true,"DCD2E89F-58D4-470C-8239-0977133B8557":true,"D9B80ACE-D39A-42F2-993B-04F3E5AF4147":true,"56EE3507-ED52-4F08-ADC5-804FAE55198F":true,"1183059F-A7CD-419C-
2024-10-01 10:11:14 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 2c 22 30 30 41 35 34 39 36 39 2d 35 45 41 34 2d 34 30 39 44 2d 39 44 41 30 2d 38 37 34 30 32 39 36 34 35 38 36 45 22 3a 74 72 75 65 2c 22 46 35 43 39 30 30 39 35 2d 43 44 45 43 2d 34 34 37 46 2d 38 38 39 38 2d 45 30 35 38 34 35 37 41 36 44 39 45 22 3a 74 72 75 65 2c 22 42 31 39 33 36 35 35 39 2d 35 38 30 33 2d 31 31 45 45 2d 42 46 30 41 2d 35 34 38 44 35 41 41 46 37 34 35 38 22 3a 74 72 75 65 2c 22 33 36 41 43 31 37 42 44 2d 34 46 32 46 2d 34 36 30 35 2d 42 33 34 43 2d 36 32 39 42 37 39 42 32 30 41 44 38 22 3a 74 72 75 65 2c 22 36 34 41 37 35 31 30 33 2d 37 42 30 30 2d 34 35 35 44 2d 39 43 30 34 2d 38 30 31 44 45 42 39 39 35 44 44 41 22 3a 74 72 75 65 2c 22 32 38 31 46 31 46 31 32 2d 42 41 31 34 2d 34 35 32 38 2d 39 46 38 31 2d 46 39 31 Data Ascii: 2000,"00A54969-5EA4-409D-9DA0-87402964586E":true,"F5C90095-CDEC-447F-8898-E058457A6D9E":true,"B1936559-5803-11EE-BF0A-548D5AAF7458":true,"36AC17BD-4F2F-4605-B34C-629B79B20AD8":true,"64A75103-7B00-455D-9C04-801DEB995DDA":true,"281F1F12-BA14-4528-9F81-F91
2024-10-01 10:11:15 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 44 32 2d 43 34 44 46 2d 34 45 31 46 2d 41 30 46 31 2d 39 41 33 44 43 37 45 36 30 37 34 31 22 3a 74 72 75 65 2c 22 38 36 43 45 37 45 34 37 2d 45 32 43 30 2d 34 46 41 37 2d 39 34 34 44 2d 32 46 43 31 37 36 39 43 30 33 42 44 22 3a 74 72 75 65 2c 22 32 36 44 36 38 41 37 46 2d 35 46 36 42 2d 34 33 41 44 2d 39 42 43 30 2d 35 33 46 35 42 42 39 43 42 43 37 39 22 3a 74 72 75 65 2c 22 42 30 37 39 44 37 36 31 2d 33 41 44 34 2d 34 35 32 31 2d 38 32 31 43 2d 46 33 30 41 39 43 33 41 38 44 34 32 22 3a 74 72 75 65 2c 22 31 35 37 30 43 35 35 41 2d 44 46 44 37 2d 34 37 30 45 2d 39 37 42 33 2d 36 30 39 46 43 45 39 42 32 37 43 46 22 3a 74 72 75 65 2c 22 31 30 44 31 39 44 34 46 2d 34 31 32 37 2d 34 31 42 39 2d 38 41 38 43 2d 43 36 32 30 46 32 44 44 41 41 31 Data Ascii: 2000D2-C4DF-4E1F-A0F1-9A3DC7E60741":true,"86CE7E47-E2C0-4FA7-944D-2FC1769C03BD":true,"26D68A7F-5F6B-43AD-9BC0-53F5BB9CBC79":true,"B079D761-3AD4-4521-821C-F30A9C3A8D42":true,"1570C55A-DFD7-470E-97B3-609FCE9B27CF":true,"10D19D4F-4127-41B9-8A8C-C620F2DDAA1
2024-10-01 10:11:15 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 34 42 42 32 2d 42 37 33 45 2d 37 36 42 34 46 36 38 32 38 44 31 30 22 3a 74 72 75 65 2c 22 44 39 43 35 30 34 39 31 2d 44 31 34 34 2d 34 34 31 43 2d 42 46 37 34 2d 37 35 41 44 39 42 34 37 39 43 30 41 22 3a 74 72 75 65 2c 22 38 39 41 36 46 42 46 44 2d 45 43 30 35 2d 34 39 42 34 2d 42 36 38 31 2d 42 43 46 36 37 45 45 45 31 37 38 34 22 3a 74 72 75 65 2c 22 44 46 34 36 33 33 35 42 2d 34 35 44 41 2d 34 34 36 41 2d 38 41 31 39 2d 43 32 42 34 44 37 31 43 38 44 35 33 22 3a 74 72 75 65 2c 22 46 43 34 36 42 39 46 32 2d 41 44 43 39 2d 34 31 45 35 2d 41 46 41 32 2d 33 38 45 33 35 46 41 41 34 36 34 34 22 3a 74 72 75 65 2c 22 31 37 34 42 45 32 37 35 2d 44 42 45 43 2d 34 34 39 45 2d 38 43 36 41 2d 32 41 46 38 34 31 45 30 32 42 43 43 22 3a 74 72 75 65 2c Data Ascii: 20004BB2-B73E-76B4F6828D10":true,"D9C50491-D144-441C-BF74-75AD9B479C0A":true,"89A6FBFD-EC05-49B4-B681-BCF67EEE1784":true,"DF46335B-45DA-446A-8A19-C2B4D71C8D53":true,"FC46B9F2-ADC9-41E5-AFA2-38E35FAA4644":true,"174BE275-DBEC-449E-8C6A-2AF841E02BCC":true,
2024-10-01 10:11:15 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 38 2d 39 37 42 46 35 45 36 31 43 44 30 42 22 3a 74 72 75 65 2c 22 46 36 31 45 39 33 32 35 2d 33 36 32 39 2d 34 44 32 42 2d 41 37 33 44 2d 42 44 35 34 32 30 46 30 36 31 34 41 22 3a 74 72 75 65 2c 22 44 32 33 46 32 30 41 32 2d 39 38 37 31 2d 34 37 31 32 2d 41 37 30 44 2d 38 35 33 46 37 46 44 39 46 43 42 42 22 3a 74 72 75 65 2c 22 46 42 37 34 42 39 36 42 2d 35 39 39 32 2d 34 46 37 36 2d 42 45 30 45 2d 36 45 35 36 34 33 30 33 30 33 43 44 22 3a 74 72 75 65 2c 22 36 32 33 38 43 42 36 33 2d 39 34 43 34 2d 34 38 34 44 2d 39 38 36 34 2d 43 45 32 39 31 38 42 33 42 38 44 34 22 3a 74 72 75 65 2c 22 34 38 45 31 32 37 37 34 2d 41 44 37 44 2d 34 33 31 36 2d 38 41 30 38 2d 39 32 39 43 35 43 32 46 35 32 33 46 22 3a 74 72 75 65 2c 22 30 37 33 34 34 42 36 Data Ascii: 20008-97BF5E61CD0B":true,"F61E9325-3629-4D2B-A73D-BD5420F0614A":true,"D23F20A2-9871-4712-A70D-853F7FD9FCBB":true,"FB74B96B-5992-4F76-BE0E-6E56430303CD":true,"6238CB63-94C4-484D-9864-CE2918B3B8D4":true,"48E12774-AD7D-4316-8A08-929C5C2F523F":true,"07344B6
2024-10-01 10:11:15 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 39 35 38 32 35 39 22 3a 74 72 75 65 2c 22 33 42 30 32 35 38 31 39 2d 33 30 39 36 2d 34 39 31 36 2d 39 41 46 36 2d 30 42 41 41 45 36 41 39 35 34 38 43 22 3a 74 72 75 65 2c 22 32 38 33 34 43 33 33 42 2d 34 30 37 35 2d 34 41 43 33 2d 42 35 37 41 2d 43 41 46 42 45 43 32 42 36 38 41 38 22 3a 74 72 75 65 2c 22 38 41 45 33 33 43 43 31 2d 32 31 41 31 2d 34 34 36 45 2d 38 36 45 32 2d 33 33 36 37 30 35 35 46 44 32 31 32 22 3a 74 72 75 65 2c 22 35 44 38 45 43 32 32 45 2d 32 35 34 39 2d 34 36 39 30 2d 38 46 32 45 2d 42 41 45 35 38 41 39 39 43 43 43 44 22 3a 74 72 75 65 2c 22 32 37 39 36 42 36 36 42 2d 41 37 34 38 2d 34 42 39 33 2d 42 34 32 46 2d 44 31 46 31 44 41 38 42 45 37 43 43 22 3a 74 72 75 65 2c 22 31 36 33 30 45 31 46 36 2d 42 46 38 38 2d 34 Data Ascii: 2000958259":true,"3B025819-3096-4916-9AF6-0BAAE6A9548C":true,"2834C33B-4075-4AC3-B57A-CAFBEC2B68A8":true,"8AE33CC1-21A1-446E-86E2-3367055FD212":true,"5D8EC22E-2549-4690-8F2E-BAE58A99CCCD":true,"2796B66B-A748-4B93-B42F-D1F1DA8BE7CC":true,"1630E1F6-BF88-4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://rdhomes-my.sharepoint.com/:f:/g/personal/petrina_ryandesignerhomes_com_au/EtwntXraOOdMp3Nx1zZ6gF8Bf8aWSwNn9o_57nz1-Z9h0A?e=arAOsK

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\u1g2kedq.eh0\Payment Advise\CLICK HERE TO REVIEW DOCUMENT.url

C:\Users\user\AppData\Local\Temp\unarchiver.log

C:\Users\user\Downloads\587456cc-2310-48c7-9983-c07d2d274362.tmp

C:\Users\user\Downloads\OneDrive_2024-10-01.zip (copy)

C:\Users\user\Downloads\OneDrive_2024-10-01.zip.crdownload (copy)

Chrome Cache Entry: 441

Chrome Cache Entry: 442

Chrome Cache Entry: 443

Chrome Cache Entry: 444

Chrome Cache Entry: 445

Chrome Cache Entry: 446

Chrome Cache Entry: 447

Chrome Cache Entry: 448

Chrome Cache Entry: 449

Chrome Cache Entry: 450

Chrome Cache Entry: 451

Chrome Cache Entry: 452

Chrome Cache Entry: 453

Chrome Cache Entry: 454

Chrome Cache Entry: 455

Chrome Cache Entry: 456

Chrome Cache Entry: 457

Chrome Cache Entry: 458

Windows Analysis Report
https://rdhomes-my.sharepoint.com/:f:/g/personal/petrina_ryandesignerhomes_com_au/EtwntXraOOdMp3Nx1zZ6gF8Bf8aWSwNn9o_57nz1-Z9h0A?e=arAOsK

Timestamp	Bytes transferred	Direction	Data
2024-10-01 10:11:14 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-01 10:11:14 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=196420 Date: Tue, 01 Oct 2024 10:11:14 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-01 10:11:14 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-10-01 10:11:16 UTC	1551	OUT	GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: rdhomes-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitBUHI2 [TRUNCATED]
2024-10-01 10:11:17 UTC	3157	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitB [TRUNCATED] X-NetworkStatistics: 0,525568,0,0,422,0,26332,199 X-SharePointHealthScore: 2 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: ce9b55a1-b097-3000-d75a-08592061c61e request-id: ce9b55a1-b097-3000-d75a-08592061c61e MS-CV: oVWbzpewADDXWghZIGHGHg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=cc986967-55d8-460d-b0ce-c89fd792728c&destinationEndpoint=Edge-Prod-EWR31r5c&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25311 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: ADF0FE93BC9B4001A292124A793A6BD7 Ref B: EWR311000106051 Ref C: 2024-10-01T10:11:16Z Date: Tue, 01 Oct 2024 10:11:16 GMT Connection: close
2024-10-01 10:11:17 UTC	749	IN	Data Raw: 32 65 36 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 2e6self._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2024-10-01 10:11:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-01 10:11:17 UTC	2110	OUT	POST /personal/petrina_ryandesignerhomes_com_au/_api/v2.1/graphql HTTP/1.1 Host: rdhomes-my.sharepoint.com Connection: keep-alive Content-Length: 507 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json;odata=verbose Content-Type: application/json;odata=verbose X-ServiceWorker-Strategy: CacheFirst sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://rdhomes-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments%2FAcquisition%20Report%2FPayment%20Advise&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitBUHI2 [TRUNCATED]
2024-10-01 10:11:17 UTC	507	OUT	Data Raw: 7b 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 28 5c 6e 20 20 20 20 20 20 20 20 24 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 51 75 65 72 79 53 74 72 69 6e 67 3a 20 53 74 72 69 6e 67 21 5c 6e 20 20 20 20 20 20 20 20 29 5c 6e 20 20 20 20 20 20 7b 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 6c 65 67 61 63 79 20 7b 5c 6e 20 20 20 20 20 20 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 28 5c 6e 20 20 20 20 20 20 71 75 65 72 79 53 74 72 69 6e 67 3a 20 24 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 51 75 65 72 79 53 74 72 69 6e 67 5c 6e 20 20 20 20 20 20 29 20 20 20 20 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 5c 6e 20 20 70 65 72 66 20 7b 5c 6e 20 20 20 20 65 78 65 63 75 74 69 6f 6e 54 69 6d 65 5c 6e 20 Data Ascii: {"query":"query (\n $spoSuiteLinksQueryString: String!\n )\n {\n \n legacy {\n spoSuiteLinks(\n queryString: $spoSuiteLinksQueryString\n ) \n \n }\n \n \n perf {\n executionTime\n
2024-10-01 10:11:19 UTC	3134	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 17803 Content-Type: application/json P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitB [TRUNCATED] X-NetworkStatistics: 0,525568,0,0,405,0,26332,191 X-SharePointHealthScore: 2 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: ce9b55a1-50e5-3000-d06f-2cd32ffa9b42 request-id: ce9b55a1-50e5-3000-d06f-2cd32ffa9b42 MS-CV: oVWbzuVQADDQbyzTL/qbQg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=cc986967-55d8-460d-b0ce-c89fd792728c&destinationEndpoint=Edge-Prod-EWR31r5a&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25311 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 23C5751F61FA4F6B8EF601672FC2CC8C Ref B: EWR311000101017 Ref C: 2024-10-01T10:11:17Z Date: Tue, 01 Oct 2024 10:11:18 GMT Connection: close
2024-10-01 10:11:19 UTC	1036	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6c 65 67 61 63 79 22 3a 7b 22 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 22 3a 7b 0a 20 22 53 50 53 75 69 74 65 56 65 72 73 69 6f 6e 22 3a 32 2c 0a 20 22 53 50 49 73 4d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 0a 20 22 43 73 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 68 61 72 65 64 2e 33 38 34 61 61 63 65 35 66 39 38 61 38 36 32 32 66 34 32 31 63 66 35 39 39 33 35 37 62 36 38 64 2e 63 73 73 22 2c 0a 20 22 4a 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 62 6f 6f 74 73 74 72 Data Ascii: {"data":{"legacy":{"spoSuiteLinks":{ "SPSuiteVersion":2, "SPIsMobile":false, "CssUrl":"https://res-1.cdn.office.net/shellux/suiteux.shell.shared.384aace5f98a8622f421cf599357b68d.css", "JsUrl":"https://res-1.cdn.office.net/shellux/suiteux.shell.bootstr
2024-10-01 10:11:19 UTC	8192	IN	Data Raw: 64 45 6e 61 62 6c 65 64 5c 22 3a 66 61 6c 73 65 2c 5c 22 41 70 70 73 50 69 6e 6e 65 64 44 61 74 61 5c 22 3a 6e 75 6c 6c 2c 5c 22 41 70 70 73 55 70 64 61 74 65 54 69 6d 65 53 70 61 6e 5c 22 3a 31 34 34 30 30 30 30 30 2c 5c 22 41 72 69 61 54 65 6c 65 6d 65 74 72 79 45 6e 61 62 6c 65 64 5c 22 3a 74 72 75 65 2c 5c 22 41 72 69 61 54 65 6c 65 6d 65 74 72 79 53 65 72 76 65 72 52 65 71 75 65 73 74 49 6e 66 6c 75 78 43 6f 6e 74 72 6f 6c 5c 22 3a 35 2c 5c 22 41 72 69 61 54 65 6c 65 6d 65 74 72 79 54 65 6e 61 6e 74 54 6f 6b 65 6e 5c 22 3a 5c 22 63 36 63 31 39 30 61 31 62 37 33 63 34 61 36 33 62 62 61 38 39 38 33 35 64 35 34 36 63 66 32 38 2d 66 32 61 30 34 38 32 66 2d 61 30 30 64 2d 34 38 64 39 2d 38 32 32 65 2d 65 38 39 63 63 38 39 65 62 36 34 64 2d 37 36 38 38 5c Data Ascii: dEnabled\":false,\"AppsPinnedData\":null,\"AppsUpdateTimeSpan\":14400000,\"AriaTelemetryEnabled\":true,\"AriaTelemetryServerRequestInfluxControl\":5,\"AriaTelemetryTenantToken\":\"c6c190a1b73c4a63bba89835d546cf28-f2a0482f-a00d-48d9-822e-e89cc89eb64d-7688\
2024-10-01 10:11:19 UTC	4144	IN	Data Raw: 70 6c 75 67 69 6e 73 5f 64 69 73 74 5f 6f 6e 64 65 6d 61 6e 64 5f 6a 73 2e 65 35 39 62 63 63 63 32 30 66 65 65 36 34 62 37 38 66 31 35 2e 6a 73 5c 22 2c 5c 22 73 65 61 72 63 68 62 6f 78 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 65 61 72 63 68 62 6f 78 2e 37 34 31 64 61 65 37 62 62 64 63 65 64 37 63 62 66 32 34 36 2e 6a 73 5c 22 2c 5c 22 73 65 61 72 63 68 75 78 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 65 61 72 63 68 75 78 2e 63 35 33 33 64 63 64 62 65 33 61 36 35 32 30 35 62 66 36 62 2e 6a 73 5c 22 2c Data Ascii: plugins_dist_ondemand_js.e59bccc20fee64b78f15.js\",\"searchbox\":\"https://res-1.cdn.office.net/shellux/suiteux.shell.searchbox.741dae7bbdced7cbf246.js\",\"searchux\":\"https://res-1.cdn.office.net/shellux/suiteux.shell.searchux.c533dcdbe3a65205bf6b.js\",
2024-10-01 10:11:19 UTC	4431	IN	Data Raw: 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 65 6e 2d 55 53 2f 6d 73 6f 66 66 69 63 65 22 7d 2c 22 43 6f 6d 70 61 6e 79 44 69 73 70 6c 61 79 4e 61 6d 65 22 3a 6e 75 6c 6c 2c 22 43 6f 72 72 65 6c 61 74 69 6f 6e 49 44 22 3a 22 30 30 33 64 37 61 30 34 2d 39 61 35 37 2d 34 35 34 65 2d 38 35 37 35 2d 32 38 36 62 62 35 62 31 38 38 32 38 22 2c 22 43 75 6c 74 75 72 65 4e 61 6d 65 22 3a 22 65 6e 2d 55 53 22 2c 22 43 75 72 72 65 6e 74 4d 61 69 6e 4c 69 6e 6b 45 6c 65 6d 65 6e 74 49 44 22 3a 22 53 68 65 6c 6c 53 68 61 72 65 70 6f 69 6e 74 22 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 48 65 6c 70 53 75 62 4c 69 6e 6b 73 22 3a 6e 75 6c 6c 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 53 65 74 74 69 6e 67 73 4c 69 6e 6b 22 3a 6e 75 6c 6c 2c 22 43 75 72 72 Data Ascii: .microsoft.com/en-US/msoffice"},"CompanyDisplayName":null,"CorrelationID":"003d7a04-9a57-454e-8575-286bb5b18828","CultureName":"en-US","CurrentMainLinkElementID":"ShellSharepoint","CurrentWorkloadHelpSubLinks":null,"CurrentWorkloadSettingsLink":null,"Curr

Timestamp	Bytes transferred	Direction	Data
2024-10-01 10:11:18 UTC	1544	OUT	GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: rdhomes-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitBUHI2 [TRUNCATED]
2024-10-01 10:11:18 UTC	3050	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 Server: Microsoft-IIS/10.0 X-NetworkStatistics: 0,262656,0,0,1054,0,24851,204 Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitB [TRUNCATED] X-SharePointHealthScore: 2 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: cf9b55a1-5005-3000-d4cc-e99f52cbbc88 request-id: cf9b55a1-5005-3000-d4cc-e99f52cbbc88 MS-CV: oVWbzwVQADDUzOmfUsu8iA.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=cc986967-55d8-460d-b0ce-c89fd792728c&destinationEndpoint=196391&frontEnd=FarmDirect&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25311 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Tue, 01 Oct 2024 10:11:18 GMT Connection: close
2024-10-01 10:11:18 UTC	749	IN	Data Raw: 32 65 36 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 2e6self._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2024-10-01 10:11:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-01 10:11:20 UTC	1603	OUT	GET /personal/petrina_ryandesignerhomes_com_au/_api/v2.1/graphql HTTP/1.1 Host: rdhomes-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitBUHI2 [TRUNCATED]
2024-10-01 10:11:21 UTC	3023	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 87 Content-Type: application/json Server: Microsoft-IIS/10.0 X-NetworkStatistics: 0,262656,0,0,896,0,24851,203 Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitB [TRUNCATED] X-SharePointHealthScore: 3 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: cf9b55a1-d095-3000-d4cc-e9950ac0515e request-id: cf9b55a1-d095-3000-d4cc-e9950ac0515e MS-CV: oVWbz5XQADDUzOmVCsBRXg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=196391&frontEnd=FarmDirect&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25311 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Tue, 01 Oct 2024 10:11:21 GMT Connection: close
2024-10-01 10:11:21 UTC	87	IN	Data Raw: 7b 22 65 72 72 6f 72 73 22 3a 5b 7b 22 6d 65 73 73 61 67 65 22 3a 22 41 20 71 75 65 72 79 20 69 73 20 72 65 71 75 69 72 65 64 2e 22 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 22 63 6f 64 65 22 3a 22 45 58 45 43 55 54 49 4f 4e 5f 45 52 52 4f 52 22 7d 7d 5d 7d Data Ascii: {"errors":[{"message":"A query is required.","extensions":{"code":"EXECUTION_ERROR"}}]}

Timestamp	Bytes transferred	Direction	Data
2024-10-01 10:11:23 UTC	2695	OUT	POST /personal/petrina_ryandesignerhomes_com_au/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: rdhomes-my.sharepoint.com Connection: keep-alive Content-Length: 821 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-ms-cc: t ScenarioType: AUO sec-ch-ua-mobile: ?0 Authorization: Bearer User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CollectSPPerfMetrics: SPSQLQueryCount Content-Type: application/json;odata=verbose accept: application/json;odata=verbose X-ClientService-ClientTag: ODB Web X-SP-REQUESTRESOURCES: listUrl=%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments X-ServiceWorker-Strategy: CacheFirst x-requestdigest: 0x66C28F73A92DF6CDA9EBD99B471E436EA394FC47EAD48A43973CFC9DEB83852C9D271A47ECBF4291B9C8A2CE816FDED2054D18CD56FBA056DA2E17F8D7197431,01 Oct 2024 10:11:14 -0000 sec-ch-ua-platform: "Windows" Origin: https://rdhomes-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments%2FAcquisition%20Report%2FPayment%20Advise&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitBUHI2 [TRUNCATED]
2024-10-01 10:11:23 UTC	821	OUT	Data Raw: 7b 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 5f 5f 6d 65 74 61 64 61 74 61 22 3a 7b 22 74 79 70 65 22 3a 22 53 50 2e 52 65 6e 64 65 72 4c 69 73 74 44 61 74 61 50 61 72 61 6d 65 74 65 72 73 22 7d 2c 22 52 65 6e 64 65 72 4f 70 74 69 6f 6e 73 22 3a 31 30 35 32 36 37 39 2c 22 56 69 65 77 58 6d 6c 22 3a 22 3c 56 69 65 77 20 3e 3c 51 75 65 72 79 3e 3c 2f 51 75 65 72 79 3e 3c 56 69 65 77 46 69 65 6c 64 73 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 44 6f 63 49 63 6f 6e 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4c 69 6e 6b 46 69 6c 65 6e 61 6d 65 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4d 6f 64 69 66 69 65 64 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 45 64 69 74 6f 72 5c 22 2f 3e 3c 46 Data Ascii: {"parameters":{"__metadata":{"type":"SP.RenderListDataParameters"},"RenderOptions":1052679,"ViewXml":"<View ><Query></Query><ViewFields><FieldRef Name=\"DocIcon\"/><FieldRef Name=\"LinkFilename\"/><FieldRef Name=\"Modified\"/><FieldRef Name=\"Editor\"/><F
2024-10-01 10:11:24 UTC	3381	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Expires: Mon, 16 Sep 2024 10:11:24 GMT Last-Modified: Tue, 01 Oct 2024 10:11:24 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitB [TRUNCATED] X-NetworkStatistics: 0,525568,0,0,414,0,26332,198 X-SharePointHealthScore: 3 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 307 SPRequestDuration: 308 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: d09b55a1-804f-3000-e77a-566f25864342 request-id: d09b55a1-804f-3000-e77a-566f25864342 MS-CV: oVWb0E+AADDnelZvJYZDQg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=cc986967-55d8-460d-b0ce-c89fd792728c&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25311 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: E92771EA77684A1E96BFBB494A28B903 Ref B: EWR311000108021 Ref C: 2024-10-01T10:11:23Z Date: Tue, 01 Oct 2024 10:11:23 GMT Connection: close
2024-10-01 10:11:24 UTC	790	IN	Data Raw: 33 30 66 0d 0a 7b 22 77 70 71 22 3a 22 22 2c 22 54 65 6d 70 6c 61 74 65 73 22 3a 7b 7d 2c 22 4c 69 73 74 44 61 74 61 22 3a 7b 20 22 52 6f 77 22 20 3a 20 0a 5b 5d 2c 22 46 69 72 73 74 52 6f 77 22 20 3a 20 31 2c 0d 0a 22 46 6f 6c 64 65 72 50 65 72 6d 69 73 73 69 6f 6e 73 22 20 3a 20 22 30 78 33 30 30 38 30 31 31 30 30 30 22 0d 0a 2c 22 4c 61 73 74 52 6f 77 22 20 3a 20 30 2c 0d 0a 22 52 6f 77 4c 69 6d 69 74 22 20 3a 20 31 0d 0a 2c 22 46 69 6c 74 65 72 4c 69 6e 6b 22 20 3a 20 22 3f 22 0a 2c 22 46 6f 72 63 65 4e 6f 48 69 65 72 61 72 63 68 79 22 20 3a 20 22 31 22 0a 2c 22 48 69 65 72 61 72 63 68 79 48 61 73 49 6e 64 65 6e 74 69 6f 6e 22 20 3a 20 22 22 0a 2c 22 43 75 72 72 65 6e 74 46 6f 6c 64 65 72 50 72 69 6e 63 69 70 61 6c 43 6f 75 6e 74 22 20 3a 20 22 30 22 Data Ascii: 30f{"wpq":"","Templates":{},"ListData":{ "Row" : [],"FirstRow" : 1,"FolderPermissions" : "0x3008011000","LastRow" : 0,"RowLimit" : 1,"FilterLink" : "?","ForceNoHierarchy" : "1","HierarchyHasIndention" : "","CurrentFolderPrincipalCount" : "0"
2024-10-01 10:11:24 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 22 2c 0a 22 46 69 65 6c 64 54 79 70 65 22 3a 20 22 43 6f 6d 70 75 74 65 64 22 2c 0a 22 52 65 61 6c 46 69 65 6c 64 4e 61 6d 65 22 3a 20 22 46 69 6c 65 4c 65 61 66 52 65 66 22 2c 0a 22 44 69 73 70 6c 61 79 4e 61 6d 65 22 3a 20 22 4e 61 6d 65 22 2c 0a 22 49 44 22 3a 20 22 35 63 63 36 64 63 37 39 2d 33 37 31 30 2d 34 33 37 34 2d 62 34 33 33 2d 36 31 63 62 34 61 36 38 36 63 31 32 22 2c 0a 22 53 74 61 74 69 63 4e 61 6d 65 22 3a 20 22 4c 69 6e 6b 46 69 6c 65 6e 61 6d 65 22 2c 0a 22 43 6c 61 73 73 49 6e 66 6f 22 3a 20 22 4d 65 6e 75 22 2c 0a 22 72 6f 6c 65 22 3a 20 22 43 6f 6d 70 75 74 65 64 22 2c 0a 22 61 72 69 61 4c 61 62 65 6c 22 3a 20 22 4e 61 6d 65 22 2c 0a 22 46 72 6f 6d 42 61 73 65 54 79 70 65 22 3a 20 22 54 52 55 45 22 2c 0a 22 54 79 70 Data Ascii: 2000","FieldType": "Computed","RealFieldName": "FileLeafRef","DisplayName": "Name","ID": "5cc6dc79-3710-4374-b433-61cb4a686c12","StaticName": "LinkFilename","ClassInfo": "Menu","role": "Computed","ariaLabel": "Name","FromBaseType": "TRUE","Typ
2024-10-01 10:11:24 UTC	4152	IN	Data Raw: 31 30 33 30 0d 0a 68 79 55 32 73 76 63 56 70 52 5a 54 5a 4b 57 69 74 42 50 54 42 31 4f 41 46 4b 45 47 68 68 63 32 68 6c 5a 48 42 79 62 32 39 6d 64 47 39 72 5a 57 35 69 42 48 52 79 64 57 56 79 59 54 42 6f 4c 6d 5a 38 62 57 56 74 59 6d 56 79 63 32 68 70 63 48 78 31 63 6d 34 6c 4d 32 46 7a 63 47 38 6c 4d 32 46 68 62 6d 39 75 49 7a 6b 34 59 57 55 34 59 54 49 32 4e 6d 45 30 59 6a 59 31 5a 6d 45 35 4d 54 6c 6d 4e 7a 67 33 4d 6d 56 69 5a 6a 4d 78 59 54 55 77 59 6a 6b 32 4d 44 52 6b 4e 44 42 6a 5a 47 45 7a 4e 7a 67 32 59 6a 45 77 5a 57 49 34 4e 54 67 35 4d 6a 49 30 4e 47 46 6d 4e 6a 68 36 41 54 44 43 41 57 45 77 49 79 35 6d 66 47 31 6c 62 57 4a 6c 63 6e 4e 6f 61 58 42 38 64 58 4a 75 4a 54 4e 68 63 33 42 76 4a 54 4e 68 59 57 35 76 62 69 4d 35 4f 47 46 6c 4f 47 45 Data Ascii: 1030hyU2svcVpRZTZKWitBPTB1OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjh6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiM5OGFlOGE
2024-10-01 10:11:24 UTC	3854	IN	Data Raw: 66 30 37 0d 0a 61 6c 6c 65 72 53 74 61 63 6b 7d 26 64 6f 63 69 64 3d 7b 2e 73 70 49 74 65 6d 55 72 6c 7d 26 7b 2e 64 72 69 76 65 41 63 63 65 73 73 54 6f 6b 65 6e 7d 22 0d 0a 2c 20 22 2e 74 68 75 6d 62 6e 61 69 6c 55 72 6c 22 20 3a 20 22 7b 2e 6d 65 64 69 61 42 61 73 65 55 72 6c 7d 5c 75 30 30 32 66 74 72 61 6e 73 66 6f 72 6d 5c 75 30 30 32 66 74 68 75 6d 62 6e 61 69 6c 3f 70 72 6f 76 69 64 65 72 3d 73 70 6f 26 69 6e 70 75 74 46 6f 72 6d 61 74 3d 7b 2e 66 69 6c 65 54 79 70 65 7d 26 63 73 3d 7b 2e 63 61 6c 6c 65 72 53 74 61 63 6b 7d 26 64 6f 63 69 64 3d 7b 2e 73 70 49 74 65 6d 55 72 6c 7d 26 7b 2e 64 72 69 76 65 41 63 63 65 73 73 54 6f 6b 65 6e 7d 22 0d 0a 2c 20 22 2e 76 69 64 65 6f 4d 61 6e 69 66 65 73 74 55 72 6c 22 20 3a 20 22 7b 2e 6d 65 64 69 61 42 61 Data Ascii: f07allerStack}&docid={.spItemUrl}&{.driveAccessToken}", ".thumbnailUrl" : "{.mediaBaseUrl}\u002ftransform\u002fthumbnail?provider=spo&inputFormat={.fileType}&cs={.callerStack}&docid={.spItemUrl}&{.driveAccessToken}", ".videoManifestUrl" : "{.mediaBa
2024-10-01 10:11:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-01 10:11:23 UTC	2804	OUT	POST /personal/petrina_ryandesignerhomes_com_au/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments%27&RootFolder=%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments%2FAcquisition%20Report%2FPayment%20Advise&TryNewExperienceSingle=TRUE HTTP/1.1 Host: rdhomes-my.sharepoint.com Connection: keep-alive Content-Length: 201 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-ms-cc: t ScenarioType: AUO Accept-Language: en-US sec-ch-ua-mobile: ?0 Authorization: Bearer User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json;odata=verbose CollectSPPerfMetrics: SPSQLQueryCount accept: application/json;odata=verbose X-ClientService-ClientTag: ODB Web X-SP-REQUESTRESOURCES: listUrl=%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments X-ServiceWorker-Strategy: CacheFirst x-requestdigest: 0x66C28F73A92DF6CDA9EBD99B471E436EA394FC47EAD48A43973CFC9DEB83852C9D271A47ECBF4291B9C8A2CE816FDED2054D18CD56FBA056DA2E17F8D7197431,01 Oct 2024 10:11:14 -0000 sec-ch-ua-platform: "Windows" Origin: https://rdhomes-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments%2FAcquisition%20Report%2FPayment%20Advise&ga=1 Accept-Encoding: gzip, deflate, br Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitBUHI2 [TRUNCATED]
2024-10-01 10:11:23 UTC	201	OUT	Data Raw: 7b 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 5f 5f 6d 65 74 61 64 61 74 61 22 3a 7b 22 74 79 70 65 22 3a 22 53 50 2e 52 65 6e 64 65 72 4c 69 73 74 44 61 74 61 50 61 72 61 6d 65 74 65 72 73 22 7d 2c 22 52 65 6e 64 65 72 4f 70 74 69 6f 6e 73 22 3a 35 34 34 35 33 38 33 2c 22 41 6c 6c 6f 77 4d 75 6c 74 69 70 6c 65 56 61 6c 75 65 46 69 6c 74 65 72 46 6f 72 54 61 78 6f 6e 6f 6d 79 46 69 65 6c 64 73 22 3a 74 72 75 65 2c 22 41 64 64 52 65 71 75 69 72 65 64 46 69 65 6c 64 73 22 3a 74 72 75 65 2c 22 52 65 71 75 69 72 65 46 6f 6c 64 65 72 43 6f 6c 6f 72 69 6e 67 46 69 65 6c 64 73 22 3a 74 72 75 65 7d 7d Data Ascii: {"parameters":{"__metadata":{"type":"SP.RenderListDataParameters"},"RenderOptions":5445383,"AllowMultipleValueFilterForTaxonomyFields":true,"AddRequiredFields":true,"RequireFolderColoringFields":true}}
2024-10-01 10:11:24 UTC	3382	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Expires: Mon, 16 Sep 2024 10:11:23 GMT Last-Modified: Tue, 01 Oct 2024 10:11:23 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitB [TRUNCATED] X-NetworkStatistics: 0,525568,0,0,6491,0,28395,193 X-SharePointHealthScore: 2 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 780 SPRequestDuration: 781 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: d09b55a1-0038-3000-d06f-2dc9e32e611c request-id: d09b55a1-0038-3000-d06f-2dc9e32e611c MS-CV: oVWb0DgAADDQby3J4y5hHA.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=cc986967-55d8-460d-b0ce-c89fd792728c&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25311 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 15F5DC79AA3740A3B211BC30BFB1F054 Ref B: EWR311000108027 Ref C: 2024-10-01T10:11:23Z Date: Tue, 01 Oct 2024 10:11:24 GMT Connection: close
2024-10-01 10:11:24 UTC	2899	IN	Data Raw: 62 34 63 0d 0a 7b 22 77 70 71 22 3a 22 22 2c 22 54 65 6d 70 6c 61 74 65 73 22 3a 7b 7d 2c 22 4c 69 73 74 44 61 74 61 22 3a 7b 20 22 52 6f 77 22 20 3a 20 0a 5b 7b 0d 0a 22 49 44 22 3a 20 22 31 34 31 35 34 39 22 2c 0d 0a 22 50 65 72 6d 4d 61 73 6b 22 3a 20 22 30 78 33 30 30 38 30 33 31 30 32 31 22 2c 0d 0a 22 46 53 4f 62 6a 54 79 70 65 22 3a 20 22 30 22 2c 0d 0a 22 48 54 4d 4c 5f 78 30 30 32 30 5f 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 22 3a 20 22 22 2c 0d 0a 22 55 6e 69 71 75 65 49 64 22 3a 20 22 7b 35 37 41 31 42 30 43 41 2d 44 46 31 30 2d 34 32 34 38 2d 42 31 41 44 2d 38 37 39 37 44 37 45 39 45 44 30 37 7d 22 2c 0d 0a 22 50 72 6f 67 49 64 22 3a 20 22 22 2c 0d 0a 22 4e 6f 45 78 65 63 75 74 65 22 3a 20 22 31 22 2c 0d 0a 22 43 6f 6e 74 65 6e 74 54 79 Data Ascii: b4c{"wpq":"","Templates":{},"ListData":{ "Row" : [{"ID": "141549","PermMask": "0x3008031021","FSObjType": "0","HTML_x0020_File_x0020_Type": "","UniqueId": "{57A1B0CA-DF10-4248-B1AD-8797D7E9ED07}","ProgId": "","NoExecute": "1","ContentTy
2024-10-01 10:11:24 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 69 73 53 65 63 72 65 74 46 69 65 6c 64 56 61 6c 75 65 22 3a 66 61 6c 73 65 7d 5d 2c 0d 0a 22 6f 77 73 68 69 64 64 65 6e 76 65 72 73 69 6f 6e 22 3a 20 22 33 22 2c 0d 0a 22 46 69 6c 65 53 69 7a 65 44 69 73 70 6c 61 79 22 3a 20 22 36 32 22 2c 0d 0a 22 49 74 65 6d 43 68 69 6c 64 43 6f 75 6e 74 22 3a 20 22 30 22 2c 0d 0a 22 46 6f 6c 64 65 72 43 68 69 6c 64 43 6f 75 6e 74 22 3a 20 22 30 22 2c 0d 0a 22 41 32 4f 44 4d 6f 75 6e 74 43 6f 75 6e 74 22 3a 20 22 22 2c 0d 0a 22 5f 53 74 75 62 46 69 6c 65 22 3a 20 22 30 22 2c 0d 0a 22 5f 45 78 70 69 72 61 74 69 6f 6e 44 61 74 65 22 3a 20 22 22 2c 0d 0a 22 5f 45 78 70 69 72 61 74 69 6f 6e 44 61 74 65 2e 22 3a 20 22 22 2c 0d 0a 22 5f 61 63 74 69 76 69 74 79 22 3a 20 22 7b 5c 22 46 69 6c 65 41 63 74 69 76 Data Ascii: 2000isSecretFieldValue":false}],"owshiddenversion": "3","FileSizeDisplay": "62","ItemChildCount": "0","FolderChildCount": "0","A2ODMountCount": "","_StubFile": "0","_ExpirationDate": "","_ExpirationDate.": "","_activity": "{\"FileActiv
2024-10-01 10:11:24 UTC	2041	IN	Data Raw: 37 66 32 0d 0a 63 79 4d 7a 4d 7a 4e 69 31 6a 59 54 45 32 4c 54 51 78 4d 47 51 74 4f 44 68 69 4f 53 30 31 59 6a 52 6b 59 54 6c 6b 5a 6d 4d 34 5a 54 51 69 4c 43 4a 68 63 48 42 66 5a 47 6c 7a 63 47 78 68 65 57 35 68 62 57 55 69 4f 69 4a 4e 5a 57 52 70 59 56 52 42 49 69 77 69 59 58 42 77 61 57 51 69 4f 69 49 35 4e 44 52 6d 4d 47 4a 6b 4d 53 30 78 4d 54 64 69 4c 54 52 69 4d 57 4d 74 59 57 59 79 4e 69 30 34 4d 44 52 6c 5a 44 6b 31 5a 54 63 32 4e 32 55 69 4c 43 4a 68 64 57 51 69 4f 69 49 77 4d 44 41 77 4d 44 41 77 4d 79 30 77 4d 44 41 77 4c 54 42 6d 5a 6a 45 74 59 32 55 77 4d 43 30 77 4d 44 41 77 4d 44 41 77 4d 44 41 77 4d 44 41 76 63 6d 52 6f 62 32 31 6c 63 79 31 74 65 53 35 7a 61 47 46 79 5a 58 42 76 61 57 35 30 4c 6d 4e 76 62 55 42 6a 59 7a 6b 34 4e 6a 6b 32 Data Ascii: 7f2cyMzMzNi1jYTE2LTQxMGQtODhiOS01YjRkYTlkZmM4ZTQiLCJhcHBfZGlzcGxheW5hbWUiOiJNZWRpYVRBIiwiYXBwaWQiOiI5NDRmMGJkMS0xMTdiLTRiMWMtYWYyNi04MDRlZDk1ZTc2N2UiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvcmRob21lcy1teS5zaGFyZXBvaW50LmNvbUBjYzk4Njk2
2024-10-01 10:11:24 UTC	6241	IN	Data Raw: 31 38 35 39 0d 0a 47 65 6e 65 72 61 74 65 22 20 3a 20 22 7b 2e 6d 65 64 69 61 42 61 73 65 55 72 6c 7d 5c 75 30 30 32 66 74 72 61 6e 73 66 6f 72 6d 5c 75 30 30 32 66 4f 66 66 69 63 65 42 75 6e 64 6c 65 3f 70 72 6f 76 69 64 65 72 3d 73 70 6f 26 69 6e 70 75 74 46 6f 72 6d 61 74 3d 7b 2e 66 69 6c 65 54 79 70 65 7d 26 63 73 3d 7b 2e 63 61 6c 6c 65 72 53 74 61 63 6b 7d 26 64 6f 63 69 64 3d 7b 2e 73 70 49 74 65 6d 55 72 6c 7d 26 7b 2e 64 72 69 76 65 41 63 63 65 73 73 54 6f 6b 65 6e 7d 22 0d 0a 2c 20 22 2e 6f 66 66 69 63 65 42 75 6e 64 6c 65 47 65 74 46 72 61 67 6d 65 6e 74 22 20 3a 20 22 7b 2e 6d 65 64 69 61 42 61 73 65 55 72 6c 7d 5c 75 30 30 32 66 74 72 61 6e 73 66 6f 72 6d 5c 75 30 30 32 66 4f 66 66 69 63 65 42 75 6e 64 6c 65 46 72 61 67 6d 65 6e 74 3f 70 72 Data Ascii: 1859Generate" : "{.mediaBaseUrl}\u002ftransform\u002fOfficeBundle?provider=spo&inputFormat={.fileType}&cs={.callerStack}&docid={.spItemUrl}&{.driveAccessToken}", ".officeBundleGetFragment" : "{.mediaBaseUrl}\u002ftransform\u002fOfficeBundleFragment?pr
2024-10-01 10:11:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-01 10:11:23 UTC	2152	OUT	GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1 Host: rdhomes-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments%2FAcquisition%20Report%2FPayment%20Advise&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitBUHI2 [TRUNCATED]
2024-10-01 10:11:23 UTC	1940	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Sat, 28 Sep 2024 03:15:36 GMT Accept-Ranges: bytes ETag: "3cd4caaf5411db1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitB [TRUNCATED] X-NetworkStatistics: 0,525568,0,0,250752,0,30806,197 SPRequestDuration: 9 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25311 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 21DA7925161048B4B19E7D24536F952C Ref B: EWR311000101025 Ref C: 2024-10-01T10:11:23Z Date: Tue, 01 Oct 2024 10:11:23 GMT Connection: close
2024-10-01 10:11:23 UTC	2230	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @
2024-10-01 10:11:23 UTC	5656	IN	Data Raw: df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 cf 00 00 00 00 d4 78 00 60 d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff cf 74 01 ff bf 69 02 ff bf 6c 06 ff d0 80 0e ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 cf df 90 14 10 00 00 00 00 00 00 00 00 d4 78 00 cf d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d2 77 00 ff c4 6d 02 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff ba 67 04 Data Ascii: x`xxxxxxxxxxxxxxxxtilxxxxxxxxxxxxxxwmddddg

Timestamp	Bytes transferred	Direction	Data
2024-10-01 10:11:24 UTC	2835	OUT	POST /personal/petrina_ryandesignerhomes_com_au/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: rdhomes-my.sharepoint.com Connection: keep-alive Content-Length: 669 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-ms-cc: t ScenarioType: AUO sec-ch-ua-mobile: ?0 Authorization: Bearer User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CollectSPPerfMetrics: SPSQLQueryCount Content-Type: application/json;odata=verbose accept: application/json;odata=verbose X-ClientService-ClientTag: ODB Web X-SP-REQUESTRESOURCES: listUrl=%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments X-ServiceWorker-Strategy: CacheFirst x-requestdigest: 0x66C28F73A92DF6CDA9EBD99B471E436EA394FC47EAD48A43973CFC9DEB83852C9D271A47ECBF4291B9C8A2CE816FDED2054D18CD56FBA056DA2E17F8D7197431,01 Oct 2024 10:11:14 -0000 sec-ch-ua-platform: "Windows" Origin: https://rdhomes-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://rdhomes-my.sharepoint.com/personal/petrina_ryandesignerhomes_com_au/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fpetrina%5Fryandesignerhomes%5Fcom%5Fau%2FDocuments%2FAcquisition%20Report%2FPayment%20Advise&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitBUHI2 [TRUNCATED]
2024-10-01 10:11:24 UTC	669	OUT	Data Raw: 7b 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 5f 5f 6d 65 74 61 64 61 74 61 22 3a 7b 22 74 79 70 65 22 3a 22 53 50 2e 52 65 6e 64 65 72 4c 69 73 74 44 61 74 61 50 61 72 61 6d 65 74 65 72 73 22 7d 2c 22 52 65 6e 64 65 72 4f 70 74 69 6f 6e 73 22 3a 31 30 35 32 36 37 39 2c 22 56 69 65 77 58 6d 6c 22 3a 22 3c 56 69 65 77 20 53 63 6f 70 65 3d 5c 22 52 65 63 75 72 73 69 76 65 41 6c 6c 5c 22 3e 3c 51 75 65 72 79 3e 3c 57 68 65 72 65 3e 3c 45 71 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 46 69 6c 65 52 65 66 5c 22 20 2f 3e 3c 56 61 6c 75 65 20 54 79 70 65 3d 5c 22 54 65 78 74 5c 22 3e 3c 21 5b 43 44 41 54 41 5b 2f 70 65 72 73 6f 6e 61 6c 2f 70 65 74 72 69 6e 61 5f 72 79 61 6e 64 65 73 69 67 6e 65 72 68 6f 6d 65 73 5f 63 6f 6d 5f 61 75 2f 44 6f 63 75 Data Ascii: {"parameters":{"__metadata":{"type":"SP.RenderListDataParameters"},"RenderOptions":1052679,"ViewXml":"<View Scope=\"RecursiveAll\"><Query><Where><Eq><FieldRef Name=\"FileRef\" /><Value Type=\"Text\"><![CDATA[/personal/petrina_ryandesignerhomes_com_au/Docu
2024-10-01 10:11:24 UTC	3382	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Expires: Mon, 16 Sep 2024 10:11:24 GMT Last-Modified: Tue, 01 Oct 2024 10:11:24 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitB [TRUNCATED] X-NetworkStatistics: 0,525568,0,0,168340,0,30753,199 X-SharePointHealthScore: 1 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 83 SPRequestDuration: 84 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: d09b55a1-a061-3000-d75a-0ce9e71aad58 request-id: d09b55a1-a061-3000-d75a-0ce9e71aad58 MS-CV: oVWb0GGgADDXWgzp5xqtWA.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=cc986967-55d8-460d-b0ce-c89fd792728c&destinationEndpoint=Edge-Prod-EWR31r5d&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25311 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: F16BF5D3337C4298B34796E2A6F6E019 Ref B: EWR311000107047 Ref C: 2024-10-01T10:11:24Z Date: Tue, 01 Oct 2024 10:11:24 GMT Connection: close
2024-10-01 10:11:24 UTC	789	IN	Data Raw: 33 30 65 0d 0a 7b 22 77 70 71 22 3a 22 22 2c 22 54 65 6d 70 6c 61 74 65 73 22 3a 7b 7d 2c 22 4c 69 73 74 44 61 74 61 22 3a 7b 20 22 52 6f 77 22 20 3a 20 0a 5b 7b 0d 0a 22 49 44 22 3a 20 22 31 34 31 35 34 38 22 2c 0d 0a 22 50 65 72 6d 4d 61 73 6b 22 3a 20 22 30 78 33 30 30 38 30 33 31 30 32 31 22 2c 0d 0a 22 46 53 4f 62 6a 54 79 70 65 22 3a 20 22 31 22 2c 0d 0a 22 48 54 4d 4c 5f 78 30 30 32 30 5f 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 22 3a 20 22 22 2c 0d 0a 22 55 6e 69 71 75 65 49 64 22 3a 20 22 7b 37 41 42 35 32 37 44 43 2d 33 38 44 41 2d 34 43 45 37 2d 41 37 37 33 2d 37 31 44 37 33 36 37 41 38 30 35 46 7d 22 2c 0d 0a 22 50 72 6f 67 49 64 22 3a 20 22 22 2c 0d 0a 22 4e 6f 45 78 65 63 75 74 65 22 3a 20 22 30 22 2c 0d 0a 22 43 6f 6e 74 65 6e 74 54 79 Data Ascii: 30e{"wpq":"","Templates":{},"ListData":{ "Row" : [{"ID": "141548","PermMask": "0x3008031021","FSObjType": "1","HTML_x0020_File_x0020_Type": "","UniqueId": "{7AB527DC-38DA-4CE7-A773-71D7367A805F}","ProgId": "","NoExecute": "0","ContentTy
2024-10-01 10:11:24 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 73 65 72 76 65 72 75 72 6c 2e 70 72 6f 67 69 64 22 3a 20 22 22 2c 0d 0a 22 53 65 72 76 65 72 52 65 64 69 72 65 63 74 65 64 45 6d 62 65 64 55 72 6c 22 3a 20 22 22 2c 0d 0a 22 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 2e 70 72 6f 67 69 64 22 3a 20 22 46 41 4c 53 45 22 2c 0d 0a 22 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 2e 75 72 6c 22 3a 20 22 22 2c 0d 0a 22 46 69 6c 65 4c 65 61 66 52 65 66 22 3a 20 22 50 61 79 6d 65 6e 74 20 41 64 76 69 73 65 22 2c 0d 0a 22 45 64 69 74 6f 72 22 3a 20 5b 7b 22 69 64 22 3a 22 34 22 2c 22 74 69 74 6c 65 22 3a 22 50 65 74 72 69 6e 61 20 52 79 61 6e 22 2c 22 65 6d 61 69 6c 22 3a 22 70 65 74 72 69 6e 61 40 72 79 61 6e 64 65 73 69 67 6e 65 72 68 6f 6d 65 73 2e 63 6f 6d 2e 61 75 22 2c 22 73 69 70 22 3a 22 Data Ascii: 2000serverurl.progid": "","ServerRedirectedEmbedUrl": "","File_x0020_Type.progid": "FALSE","File_x0020_Type.url": "","FileLeafRef": "Payment Advise","Editor": [{"id":"4","title":"Petrina Ryan","email":"petrina@ryandesignerhomes.com.au","sip":"
2024-10-01 10:11:24 UTC	4152	IN	Data Raw: 31 30 33 30 0d 0a 64 43 35 7a 61 47 46 79 5a 58 42 76 61 57 35 30 4b 69 78 77 65 6b 39 75 63 30 4a 4d 4c 30 4a 4e 55 30 45 32 62 6d 45 77 4f 44 6c 53 56 56 52 51 57 6e 70 59 65 6a 4a 4c 54 33 6b 72 55 46 5a 54 4e 32 74 70 5a 55 35 70 54 7a 6c 4e 50 54 42 31 4f 41 46 4b 45 47 68 68 63 32 68 6c 5a 48 42 79 62 32 39 6d 64 47 39 72 5a 57 35 69 42 48 52 79 64 57 56 79 59 54 42 6f 4c 6d 5a 38 62 57 56 74 59 6d 56 79 63 32 68 70 63 48 78 31 63 6d 34 6c 4d 32 46 7a 63 47 38 6c 4d 32 46 68 62 6d 39 75 49 7a 6b 34 59 57 55 34 59 54 49 32 4e 6d 45 30 59 6a 59 31 5a 6d 45 35 4d 54 6c 6d 4e 7a 67 33 4d 6d 56 69 5a 6a 4d 78 59 54 55 77 59 6a 6b 32 4d 44 52 6b 4e 44 42 6a 5a 47 45 7a 4e 7a 67 32 59 6a 45 77 5a 57 49 34 4e 54 67 35 4d 6a 49 30 4e 47 46 6d 4e 6a 68 36 41 Data Ascii: 1030dC5zaGFyZXBvaW50Kixwek9uc0JML0JNU0E2bmEwODlSVVRQWnpYejJLT3krUFZTN2tpZU5pTzlNPTB1OAFKEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjh6A
2024-10-01 10:11:24 UTC	2914	IN	Data Raw: 62 35 62 0d 0a 6f 6c 6f 72 69 6e 67 46 69 65 64 73 22 20 3a 20 22 54 72 75 65 22 7d 2c 22 45 6e 61 62 6c 65 41 74 74 61 63 68 6d 65 6e 74 73 22 3a 20 22 66 61 6c 73 65 22 2c 22 42 61 73 65 56 69 65 77 49 44 22 3a 22 22 2c 22 4c 69 73 74 54 65 6d 70 6c 61 74 65 54 79 70 65 22 3a 22 37 30 30 22 2c 22 6c 69 73 74 42 61 73 65 54 79 70 65 22 3a 31 2c 22 6e 6f 47 72 6f 75 70 43 6f 6c 6c 61 70 73 65 22 3a 74 72 75 65 2c 22 49 6e 6c 69 6e 65 45 64 69 74 22 3a 66 61 6c 73 65 2c 22 4d 6f 64 65 72 6e 4c 69 73 74 54 65 6d 70 6c 61 74 65 54 79 70 65 49 64 22 3a 22 22 2c 22 46 6c 61 67 73 32 22 3a 32 32 39 33 38 35 2c 22 63 68 65 63 6b 50 6f 77 65 72 41 70 70 53 74 61 74 65 22 3a 66 61 6c 73 65 2c 22 68 61 73 50 65 6e 64 69 6e 67 42 75 73 69 6e 65 73 73 41 70 70 4d 69 Data Ascii: b5boloringFieds" : "True"},"EnableAttachments": "false","BaseViewID":"","ListTemplateType":"700","listBaseType":1,"noGroupCollapse":true,"InlineEdit":false,"ModernListTemplateTypeId":"","Flags2":229385,"checkPowerAppState":false,"hasPendingBusinessAppMi
2024-10-01 10:11:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-01 10:11:25 UTC	1724	OUT	GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1 Host: rdhomes-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitBUHI2 [TRUNCATED]
2024-10-01 10:11:25 UTC	1835	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Type: image/x-icon Last-Modified: Sat, 21 Sep 2024 03:09:56 GMT Accept-Ranges: bytes ETag: "8916a5bcd3bdb1:0" Server: Microsoft-IIS/10.0 X-NetworkStatistics: 0,262656,0,0,1078,0,24851,203 Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzk4YWU4YTI2NmE0YjY1ZmE5MTlmNzg3MmViZjMxYTUwYjk2MDRkNDBjZGEzNzg2YjEwZWI4NTg5MjI0NGFmNjgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOThhZThhMjY2YTRiNjVmYTkxOWY3ODcyZWJmMzFhNTBiOTYwNGQ0MGNkYTM3ODZiMTBlYjg1ODkyMjQ0YWY2OCwxMzM3MjI1MTM3MTAwMDAwMDAsMCwxMzM3MjMzNzQ3Mjc2NzgwMDEsMC4wLjAuMCwyNTgsY2M5ODY5NjctNTVkOC00NjBkLWIwY2UtYzg5ZmQ3OTI3MjhjLCwsY2Q5YjU1YTEtZjAzYy0zMDAwLWQwNmYtMmMwYWVhMjU0MzQyLGNkOWI1NWExLWYwM2MtMzAwMC1kMDZmLTJjMGFlYTI1NDM0MixlK3NIcW83cWtrV1pGOVBSZEJOU0FBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTYzOTEsWUY0b3JMRzRfMzEtR1I5bGdqUDItTzZfdnZrLFVvaEdaQ3ViWTVmVHNJZ1pJMCs1QlhDNlpiZnBNNkV4N3k4QVBWbTdEamtEbGhackFJNHFFSmRMcmJWMTZLWmhoUzJGUStrdld1eEhwdzh3RUQrcEZqc1JDc2NYQS9UVkZ3NnNscDBnbEZoR2pVS3hqNXpLeDBSR3p5K3VGVXdyemRwZnFzbDdPSmxZNnEwcmtCTGJaWXJEVjBST3Bza1Jad2lJbjB2OXh2Szk5T3BJNDl5ajNTeXVTd2pldDFPMWxNYlREU1M1NTJPMnNqOTl2ZkNnbjVIQ2duNlFzZG80VS9GQmI2Tk04Rm55cFNNdHUyMitB [TRUNCATED] SPRequestDuration: 23 SPIisLatency: 4 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25311 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Tue, 01 Oct 2024 10:11:24 GMT Connection: close Content-Length: 7886
2024-10-01 10:11:25 UTC	7886	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @