Edit tour

Windows Analysis Report
https://url.au.m.mimecastprotect.com/s/ym7TCZY1GQuMp54GSzAaWK?domain=netorgft11294697-my.sharepoint.com

Overview

General Information

Sample URL:	https://url.au.m.mimecastprotect.com/s/ym7TCZY1GQuMp54GSzAaWK?domain=netorgft11294697-my.sharepoint.com
Analysis ID:	1431934
Infos:

Detection

Score:	22
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Phishing site or detected (based on various text indicators)

Drops files with a non-matching file extension (content does not match file extension)

HTML page contains hidden URLs or javascript code

Phishing site detected (based on OCR NLP Model)

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1600 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6388 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2348,i,3611515841190200981,8393978954978914487,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2824 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.au.m.mimecastprotect.com/s/ym7TCZY1GQuMp54GSzAaWK?domain=netorgft11294697-my.sharepoint.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 0.4

OCR Text: New Document.pdf Info 1/1 New Document Shared with you. ThS WAS to you to Pages: I Size | 2.3 MB.Expir, 104/28/2024 Ref: PrWt-y Click View and Print Online"" TO view document

Source: https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/documentationsecured.html

HTTP Parser: Base64 decoded: https://bomoorenewcombsrtrewqe.store/documtationconstruction/bocon/8c73f62.php

Source: Chrome DOM: 0.4

ML Model on OCR Text: Matched 95.3% probability on "New Document.pdf Info 1/1 New Document Shared with you. ThS WAS to you to Pages: I Size | 2.3 MB.Expir, 104/28/2024 Ref: PrWt-y Click View and Print Online"" TO view document "

Source: https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/documentationsecured.html	HTTP Parser: No favicon
Source: https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/documentationsecured.html	HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49721 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.46.214.6:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.46.214.6:443 -> 192.168.2.5:49715 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49721 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.214.6
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /s/ym7TCZY1GQuMp54GSzAaWK?domain=netorgft11294697-my.sharepoint.com HTTP/1.1Host: url.au.m.mimecastprotect.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/im5eXWNvPH6MzmFjnUZH7VKmX5D-oEqyhX6BLVHIKi6FlTzGJPUyDxq9AdoJ1t6F4jkiaAb70X6GduOhJvlJPcCgcx8lhZYiUCKfG6YM51NAXkAqD6dMfnuAIB8n6mxF4SmjiDkw2eV4lG0cZLTWNd9hWyykOYyJ4-J8cvqka3_uixmsaGUaV2jSfHlRy4o3DAgCVkGu4-oOosBmjCL0HOOiLeo67jzXfs1FA2ZNxv1Zj7Li1pzRLAD3OAabPPvCp4gdrxNT4lW3QfiLdhJWYVHsFkj--QlCxxa5HpSmegf0yedKcvOcT0UjShofCdYZSMd2v6-rhEfcMPKV1CnJ7UsCBdqlcgkpwZM9n-5S4EDBmhYPR3_wHrHOvPR4XTGrbvcgUP3wKnLZAYpWdO5IQcafXjvdMclTjSavPIXmJG75KRJy9Ed8uno3V_mph26UPZYYTMpa9TTysa9MFN_l7AByQtviKuz_PdJVXkUTfJjDheuyWHWrhxs-rLaINUN-k-h6a849Cl_k0gZWb7ZZJKCeQW0JJsDL4qS8vEV2nbnXXuJao8se88_y0jCfZE4BLk54e0K3qxCl-F7PGQWt8LmCtnHWYeiwfJxx4Bt_hVRulnBxb4uCPe8EQO4PuoKElE7iz9Rk8gvbalJoOAOT9HZMvYniD3_KP_p0sj9r2dC2nbR_R_GJjyEFyS5UQ7SjhMopox9Je_rETZsi4afr4k1bJTMqwlrgJuMDi_eTu4LdHliGyAAyz7CvFL1gGJR6_swdXqsftnD43S8OYOmPIQLbbqPVJhLluPBs_-5abK7d055DII7xZ48bni0hKaB-2QIDEugJnYteyibxnO_dCYCzA3_NTCXIX2DSEBpNXN7kk4MmoW8HxgA3JAIVrk5L4AiXBtZVyWx6kRu_i_mQy3J-cFY7brreuunQ77aJ07nNoN6QSa_mNmCvxYRW3TFNz0WtLe3R6bGyep1v2yf8zMdXHShMegfNZeP80aoj1Cf36rAsng6FwkoHG4ZgzPHMmgSHMSN41A3wdcgxVPicDOOL4PPcbffhnf7PlAP1D1W6fvHdR1Ru0ZPG1ErI0zh6A_ZV_GncKO0nQzivTnvzu04lA3MzIt51_fvTSP4Gfs9nfdLwZ46tVHFmLvWmUODnevWz8LkLIxCOUbCrIZm-xdgMeYOp6CDpNJwt4SQDIoOBArJ-V-dor-yX00PYTISoIGdCBHLIQtL7IXjTHLAcIzTkJ8tN-V3nNQbXiYbyVAEytqCV6OZ0xIRvDOT0g2Li3f1TA7sZLlV4LBWc-ejiPB8MflvRtRZCGdcVYiO6J6daXzxnCzXB4hlXca1wd4pNbKaRHxwfHNhnVRl1PlkdWp32ejg-4--z7ECoixtOzpkQ4w0n55-dU0PrNbeAw9_qqySsOJO65zBmk2LZ4njliTOk4afonwQPkbwD0vuWZhab9X57ZsEN41VZHh7LDkCYQl2N5xD9DCL6kV12ETtiH6-BaZQSeOStRIcwQzvtirIW1toPlINm4W31_ym0ujm9nFdzK2uyk1mQz0s9W9lMm7QhD1kysjU1or46OeTCG-pZCq5USskDpM-m4FBYfAybTN8x3ny_KrODd_jbLx8WD7MOWgGdJTQwYPYfjNa0elzGqEV3p43m5WO_VFUyBWnTnnVSXAfzov2S-7S22_yvx1nMzqy1LqkV999PNC0yMPSo9NKxex5U8ATSx28_rheaD0CZBkjzT17CnZiUjZb1JAN0F4MtrMOghgRKT-QCCzOwa4qPSeUVEDvtqazCjopPkXya-4a1WEqfA8CNWb_UKPmHmUb4isr76mTdcTIZEW5KYO51it14QShu31AheGB9FR5M_fSooz8lk5pVIXoyVbW0hVCvRTAmKSBAVyXdEgpsyCbQW_-grgs6TgG-9TEmgjBAkF3CFMfst5-UF8XzogyJto2vlya6zlQCFTl7azTbvW5x0YTJw8pq9Qk88xk7wZGlh_QcyymdstJgsk8L2PjTTIC1rUxLxu_Q4sA5sLY0j6rsyTQg2O5svuhlplp4SUgxABBGgM_yHV2svyD3s1YK3JYCGj7tLqsQbyJ-AfTRXP_LfbfQk_DzklRr-NmRgtMsIEMT3R5149anfu5AYqD0Dd4qeNbU_yCDnBFVEiLUFBGwc4SIhOnkE7Hafvd5vNidDJ_qQmtiEi4fAjbpRM0Iz7MXFU3UtbD5tX9zc7LG0aHyWDmzaJR7_zycfMyrAy7hCdGwH67FQ7qDCRoCE0OXR5mC55g4hzzQLDMuQysMJO3r0owoUNkUA6aGs_RzyjCQlmDHx5imtK4q93suoKmPDDRrWaqLVAuBgLjQjPdP5oJcgzaQS97zs43FigINRYk6uqEEdS6d4GDqpaPAyx--W-qFC9wlCHXpW0ckfUjlXbM8P_q4inUKHWmdzS5cEKntTJgf6Mbcv1-pzwvD_NeOd9O-1NxrT-YmSpePBA34aDZVBLuX2zkBNPsd0c6DubtrBVcy6OZ6vmse9ScFWrQS-zWK-kkocLk76LcW7gxo1yaIcLn-FEKCUc1HdfBcJ7z_BcCYdHODpZKFfo1Jq5Wfi74djSKFnY4K2j5_YRMni1CLE_FH6gQB5R7F01Kp2EwgajzVxHFBiKwg-NPqvVFL8p8a8QFfiFnxXvBcYzGMlZiJJKzYpSOl5y8TWIJRkmSlmO93WoUvYEpyj-qHbeR7o0V-DRd3vB3hT4lYTBmrdFtDKPqPWHjIs6_WhZ5R0lR--YdHtJbmSdRVOcCjwg HTTP/1.1Host: url.au.m.mimecastprotect.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/5
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /:b:/g/personal/damion_riverbrookcustomhomes_com/EcjtaC-2Z0ZDidK1aM6NTrIBlouG5tiRXKd2X6ScLbrh9w?e=eKrSwx HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/damion_riverbrookcustomhomes_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom%2FNew%20Document%2Epdf&parent=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom&ga=1 HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/damion_riverbrookcustomhomes_com/_api/v2.1/graphql HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom%2FNew%20Document%2Epdf&parent=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/damion_riverbrookcustomhomes_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/damion_riverbrookcustomhomes_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom&TryNewExperienceSingle=TRUE HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/damion_riverbrookcustomhomes_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/damion_riverbrookcustomhomes_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%5D&defaultBrotli=true&authenticateFast=true&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099649,3]&spStartApplicationWebBundle=true&enableIntegrities=true HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom%2FNew%20Document%2Epdf&parent=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom&ga=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fnetorgft11294697-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!6q9ypYAG0UC_JuhrtzUZffccGRFER6dPs8JCcdbGtbW2y6dBhwheTK_Q-mGeVVPd%2Fitems%2F01547BUFGI5VUC7NTHIZBYTUVVNDHI2TVS%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbmV0b3JnZnQxMTI5NDY5Ny1teS5zaGFyZXBvaW50LmNvbUAwNGJjYWIzNC02OGYzLTQ0YTQtOTY0ZC1jZTRhNjUyYTZkNGMiLCJjYWNoZWtleSI6IjBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYiLCJlbmRwb2ludHVybCI6IkFHVTdsRXZZaEk3TnFkN0UyTXk5V3ZIc2t4Y2lJdS9vTk1OWDJoWjlneUU9IiwiZW5kcG9pbnR1cmxMZW5ndGgiOiIxMjYiLCJleHAiOiIxNzE0MTAwNDAwIiwiaXBhZGRyIjoiMTAyLjEyOS4xNTIuMjIwIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiIsIm5iZiI6IjE3MTQwNzg4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6Imw0RTRSTGlWSWsyaEJjYzdPb2F1OEEiLCJzaXRlaWQiOiJZVFUzTW1GbVpXRXRNRFk0TUMwME1HUXhMV0ptTWpZdFpUZzJZbUkzTXpVeE9UZGsiLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.aVeK3sOsufkWVhMl-Eq84GlafYE3KUYGGK30GNz_jNk&cTag=%22c%3A%7B2F68EDC8-67B6-4346-89D2-B568CE8D4EB2%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1Host: southcentralus1-mediap.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://netorgft11294697-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fnetorgft11294697-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!6q9ypYAG0UC_JuhrtzUZffccGRFER6dPs8JCcdbGtbW2y6dBhwheTK_Q-mGeVVPd%2Fitems%2F01547BUFGI5VUC7NTHIZBYTUVVNDHI2TVS%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbmV0b3JnZnQxMTI5NDY5Ny1teS5zaGFyZXBvaW50LmNvbUAwNGJjYWIzNC02OGYzLTQ0YTQtOTY0ZC1jZTRhNjUyYTZkNGMiLCJjYWNoZWtleSI6IjBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYiLCJlbmRwb2ludHVybCI6IkFHVTdsRXZZaEk3TnFkN0UyTXk5V3ZIc2t4Y2lJdS9vTk1OWDJoWjlneUU9IiwiZW5kcG9pbnR1cmxMZW5ndGgiOiIxMjYiLCJleHAiOiIxNzE0MTAwNDAwIiwiaXBhZGRyIjoiMTAyLjEyOS4xNTIuMjIwIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiIsIm5iZiI6IjE3MTQwNzg4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6Imw0RTRSTGlWSWsyaEJjYzdPb2F1OEEiLCJzaXRlaWQiOiJZVFUzTW1GbVpXRXRNRFk0TUMwME1HUXhMV0ptTWpZdFpUZzJZbUkzTXpVeE9UZGsiLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.aVeK3sOsufkWVhMl-Eq84GlafYE3KUYGGK30GNz_jNk&cTag=%22c%3A%7B2F68EDC8-67B6-4346-89D2-B568CE8D4EB2%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1Host: southcentralus1-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=odbmspdfwebworker&debug=false&bypass=false HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom%2FNew%20Document%2Epdf&parent=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=a18a9d07-a7e7-4cde-ad96-8955cad7fab9
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fnetorgft11294697-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!6q9ypYAG0UC_JuhrtzUZffccGRFER6dPs8JCcdbGtbW2y6dBhwheTK_Q-mGeVVPd%2Fitems%2F01547BUFGI5VUC7NTHIZBYTUVVNDHI2TVS%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbmV0b3JnZnQxMTI5NDY5Ny1teS5zaGFyZXBvaW50LmNvbUAwNGJjYWIzNC02OGYzLTQ0YTQtOTY0ZC1jZTRhNjUyYTZkNGMiLCJjYWNoZWtleSI6IjBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYiLCJlbmRwb2ludHVybCI6IkFHVTdsRXZZaEk3TnFkN0UyTXk5V3ZIc2t4Y2lJdS9vTk1OWDJoWjlneUU9IiwiZW5kcG9pbnR1cmxMZW5ndGgiOiIxMjYiLCJleHAiOiIxNzE0MTAwNDAwIiwiaXBhZGRyIjoiMTAyLjEyOS4xNTIuMjIwIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiIsIm5iZiI6IjE3MTQwNzg4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6Imw0RTRSTGlWSWsyaEJjYzdPb2F1OEEiLCJzaXRlaWQiOiJZVFUzTW1GbVpXRXRNRFk0TUMwME1HUXhMV0ptTWpZdFpUZzJZbUkzTXpVeE9UZGsiLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.aVeK3sOsufkWVhMl-Eq84GlafYE3KUYGGK30GNz_jNk&cTag=%22c%3A%7B2F68EDC8-67B6-4346-89D2-B568CE8D4EB2%7D%2C1%22 HTTP/1.1Host: southcentralus1-mediap.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://netorgft11294697-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://netorgft11294697-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fnetorgft11294697-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!6q9ypYAG0UC_JuhrtzUZffccGRFER6dPs8JCcdbGtbW2y6dBhwheTK_Q-mGeVVPd%2Fitems%2F01547BUFGI5VUC7NTHIZBYTUVVNDHI2TVS%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvbmV0b3JnZnQxMTI5NDY5Ny1teS5zaGFyZXBvaW50LmNvbUAwNGJjYWIzNC02OGYzLTQ0YTQtOTY0ZC1jZTRhNjUyYTZkNGMiLCJjYWNoZWtleSI6IjBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYiLCJlbmRwb2ludHVybCI6IkFHVTdsRXZZaEk3TnFkN0UyTXk5V3ZIc2t4Y2lJdS9vTk1OWDJoWjlneUU9IiwiZW5kcG9pbnR1cmxMZW5ndGgiOiIxMjYiLCJleHAiOiIxNzE0MTAwNDAwIiwiaXBhZGRyIjoiMTAyLjEyOS4xNTIuMjIwIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiIsIm5iZiI6IjE3MTQwNzg4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6Imw0RTRSTGlWSWsyaEJjYzdPb2F1OEEiLCJzaXRlaWQiOiJZVFUzTW1GbVpXRXRNRFk0TUMwME1HUXhMV0ptTWpZdFpUZzJZbUkzTXpVeE9UZGsiLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.aVeK3sOsufkWVhMl-Eq84GlafYE3KUYGGK30GNz_jNk&cTag=%22c%3A%7B2F68EDC8-67B6-4346-89D2-B568CE8D4EB2%7D%2C1%22 HTTP/1.1Host: southcentralus1-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_api/v2.0/drive/apps?select=*%2Cpromoted%2CbuiltIn&%24expand=actions HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonAccept-Language: en-USsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom%2FNew%20Document%2Epdf&parent=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom&ga=1Accept-Encoding: gzip, deflate, brCookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=a18a9d07-a7e7-4cde-ad96-8955cad7fab9; ai_session=MamqljbeuDgT5wpQP+xdX3\|1714089576110\|1714089576110; MSFPC=GUID=7b420f8af88542298ef72d2ae744eeb7&HASH=7b42&LV=202404&V=4&LU=1714089581492
Source: global traffic	HTTP traffic detected: GET /documentationsecured.html HTTP/1.1Host: pub-582bd2d04f444919a09966cc59090a26.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /documtationconstruction/bocon/admin/js/sc.php?r=ZW0sZW1haWwsYWRk HTTP/1.1Host: bomoorenewcombsrtrewqe.storeConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/471dc2adc340/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: pub-582bd2d04f444919a09966cc59090a26.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/documentationsecured.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /documtationconstruction/bocon/8c73f62.php HTTP/1.1Host: bomoorenewcombsrtrewqe.storeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/damion_riverbrookcustomhomes_com/_layouts/15/AccessDenied.aspx?correlation=0a9e22a1%2D008f%2D5000%2D3c2f%2Db4052f54218d HTTP/1.1Host: netorgft11294697-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=a18a9d07-a7e7-4cde-ad96-8955cad7fab9; ai_session=MamqljbeuDgT5wpQP+xdX3\|1714089576110\|1714089576110; MSFPC=GUID=7b420f8af88542298ef72d2ae744eeb7&HASH=7b42&LV=202404&V=4&LU=1714089581492

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: url.au.m.mimecastprotect.com
Source: global traffic	DNS traffic detected: DNS query: netorgft11294697-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: southcentralus1-mediap.svc.ms
Source: global traffic	DNS traffic detected: DNS query: pub-582bd2d04f444919a09966cc59090a26.r2.dev
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: bomoorenewcombsrtrewqe.store
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714089504005&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: private, max-age=0Transfer-Encoding: chunkedContent-Type: application/xml;charset=utf-8Expires: Wed, 10 Apr 2024 23:59:10 GMTLast-Modified: Thu, 25 Apr 2024 23:59:10 GMTVary: OriginP3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"X-NetworkStatistics: 0,2102272,88587,303,2097957,0,2102272X-SharePointHealthScore: 3X-Forms_Based_Auth_Required: https://netorgft11294697-my.sharepoint.com/_forms/default.aspx?ReturnUrl=/_layouts/15/error.aspx&Source=%2f_vti_bin%2fclient.svc%2fweb%2fGetListUsingPath(DecodedUrl%3d%40a1)%2fRenderListDataAsStream%3f%40a1%3d%2527%252Fpersonal%252Fdamion%255Friverbrookcustomhomes%255Fcom%252FDocuments%2527%26TryNewExperienceSingle%3dTRUEX-Forms_Based_Auth_Return_Url: https://netorgft11294697-my.sharepoint.com/_layouts/15/error.aspxX-MSDAVEXT_Error: 917656; Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically.DATASERVICEVERSION: 3.0X-SubStatusCode: 16X-AspNet-Version: 4.0.30319X-IDCRL_AUTH_PARAMS_V1: IDCRL Type="BPOSIDCRL", EndPoint="/personal/damion_riverbrookcustomhomes_com/_vti_bin/idcrl.svc/", RootDomain="sharepoint.com", Policy="MBI"X-DataBoundary: NONEX-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/SPRequestGuid: fb9d22a1-3097-5000-361b-57f71aede9b1request-id: fb9d22a1-3097-5000-361b-57f71aede9b1MS-CV: oSKd+5cwAFA2G1f3Gu3psQ.0Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=04bcab34-68f3-44a4-964d-ce4a652a6d4c&destinationEndpoint=Edge-Prod-MIA30r5c&frontEnd=AFD&RemoteIP=102.129.152.0"}]}NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}Strict-Transport-Security: max-age=31536000X-FRAME-OPTIONS: SAMEORIGINContent-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com;X-Powered-By: ASP.NETMicrosoftSharePointTeamServices: 16.0.0.24803X-Content-Type-Options: nosniffX-MS-InvokeApp: 1; RequireReadOnlyX-Cache: CONFIG_NOCACHEX-MSEdge-Ref: Ref A: 72B2BF42CA724ACCB9396A066A8D02BA Ref B: MIA301000105051 Ref C: 2024-04-25T23:59:10ZDate: Thu, 25 Apr 2024 23:59:09 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: private, max-age=0Transfer-Encoding: chunkedContent-Type: application/xml;charset=utf-8Expires: Wed, 10 Apr 2024 23:59:10 GMTLast-Modified: Thu, 25 Apr 2024 23:59:10 GMTVary: OriginP3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"X-NetworkStatistics: 0,1051136,27,0,3394879,0,1051136X-SharePointHealthScore: 1X-Forms_Based_Auth_Required: https://netorgft11294697-my.sharepoint.com/_forms/default.aspx?ReturnUrl=/_layouts/15/error.aspx&Source=%2f_vti_bin%2fclient.svc%2fweb%2fGetListUsingPath(DecodedUrl%3d%40a1)%2fRenderListDataAsStream%3f%40a1%3d%2527%252Fpersonal%252Fdamion%255Friverbrookcustomhomes%255Fcom%252FDocuments%2527%26RootFolder%3d%252Fpersonal%252Fdamion%255Friverbrookcustomhomes%255Fcom%252FDocuments%252Fnetorgft13782%252Dmy%252Esharepoint%252Ecom%26TryNewExperienceSingle%3dTRUEX-Forms_Based_Auth_Return_Url: https://netorgft11294697-my.sharepoint.com/_layouts/15/error.aspxX-MSDAVEXT_Error: 917656; Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically.DATASERVICEVERSION: 3.0X-SubStatusCode: 16X-AspNet-Version: 4.0.30319X-IDCRL_AUTH_PARAMS_V1: IDCRL Type="BPOSIDCRL", EndPoint="/personal/damion_riverbrookcustomhomes_com/_vti_bin/idcrl.svc/", RootDomain="sharepoint.com", Policy="MBI"X-DataBoundary: NONEX-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/SPRequestGuid: fb9d22a1-f098-5000-3c2f-b33a7061b776request-id: fb9d22a1-f098-5000-3c2f-b33a7061b776MS-CV: oSKd+5jwAFA8L7M6cGG3dg.0Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=04bcab34-68f3-44a4-964d-ce4a652a6d4c&destinationEndpoint=Edge-Prod-MIA30r5d&frontEnd=AFD&RemoteIP=102.129.152.0"}]}NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}Strict-Transport-Security: max-age=31536000X-FRAME-OPTIONS: SAMEORIGINContent-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com;X-Powered-By: ASP.NETMicrosoftSharePointTeamServices: 16.0.0.24803X-Content-Type-Options: nosniffX-MS-InvokeApp: 1; RequireReadOnlyX-Cache: CONFIG_NOCACHEX-MSEdge-Ref: Ref A: D3633D3E8B0B416F805B4A02D652EE37 Ref B: MIA301000108017 Ref C: 2024-04-25T23:59:10ZDate: Thu, 25 Apr 2024 23:59:09 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: private, max-age=0Transfer-Encoding: chunkedContent-Type: application/xml;charset=utf-8Expires: Wed, 10 Apr 2024 23:59:10 GMTLast-Modified: Thu, 25 Apr 2024 23:59:10 GMTVary: OriginP3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"X-NetworkStatistics: 0,525568,0,29,508249,0,394639X-SharePointHealthScore: 2X-Forms_Based_Auth_Required: https://netorgft11294697-my.sharepoint.com/_forms/default.aspx?ReturnUrl=/_layouts/15/error.aspx&Source=%2f_vti_bin%2fclient.svc%2fweb%2fGetListUsingPath(DecodedUrl%3d%40a1)%2fRenderListDataAsStream%3f%40a1%3d%2527%252Fpersonal%252Fdamion%255Friverbrookcustomhomes%255Fcom%252FDocuments%2527%26TryNewExperienceSingle%3dTRUEX-Forms_Based_Auth_Return_Url: https://netorgft11294697-my.sharepoint.com/_layouts/15/error.aspxX-MSDAVEXT_Error: 917656; Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically.DATASERVICEVERSION: 3.0X-SubStatusCode: 16X-AspNet-Version: 4.0.30319X-IDCRL_AUTH_PARAMS_V1: IDCRL Type="BPOSIDCRL", EndPoint="/personal/damion_riverbrookcustomhomes_com/_vti_bin/idcrl.svc/", RootDomain="sharepoint.com", Policy="MBI"X-DataBoundary: NONEX-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/SPRequestGuid: fb9d22a1-70ba-5000-361b-536eaa3f2be4request-id: fb9d22a1-70ba-5000-361b-536eaa3f2be4MS-CV: oSKd+7pwAFA2G1Nuqj8r5A.0Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=04bcab34-68f3-44a4-964d-ce4a652a6d4c&destinationEndpoint=Edge-Prod-MIA30r5c&frontEnd=AFD&RemoteIP=102.129.152.0"}]}NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}Strict-Transport-Security: max-age=31536000X-FRAME-OPTIONS: SAMEORIGINContent-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com;X-Powered-By: ASP.NETMicrosoftSharePointTeamServices: 16.0.0.24803X-Content-Type-Options: nosniffX-MS-InvokeApp: 1; RequireReadOnlyX-Cache: CONFIG_NOCACHEX-MSEdge-Ref: Ref A: F5507FA1EAC54B99A7D42E215E1605EF Ref B: MIA301000105037 Ref C: 2024-04-25T23:59:10ZDate: Thu, 25 Apr 2024 23:59:10 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: private, max-age=0Transfer-Encoding: chunkedContent-Type: application/xml;charset=utf-8Expires: Wed, 10 Apr 2024 23:59:11 GMTLast-Modified: Thu, 25 Apr 2024 23:59:11 GMTVary: OriginP3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"X-NetworkStatistics: 0,525568,0,0,781628,0,221819X-SharePointHealthScore: 0X-Forms_Based_Auth_Required: https://netorgft11294697-my.sharepoint.com/_forms/default.aspx?ReturnUrl=/_layouts/15/error.aspx&Source=%2f_vti_bin%2fclient.svc%2fweb%2fGetListUsingPath(DecodedUrl%3d%40a1)%2fRenderListDataAsStream%3f%40a1%3d%2527%252Fpersonal%252Fdamion%255Friverbrookcustomhomes%255Fcom%252FDocuments%2527%26TryNewExperienceSingle%3dTRUEX-Forms_Based_Auth_Return_Url: https://netorgft11294697-my.sharepoint.com/_layouts/15/error.aspxX-MSDAVEXT_Error: 917656; Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically.DATASERVICEVERSION: 3.0X-SubStatusCode: 16X-AspNet-Version: 4.0.30319X-IDCRL_AUTH_PARAMS_V1: IDCRL Type="BPOSIDCRL", EndPoint="/personal/damion_riverbrookcustomhomes_com/_vti_bin/idcrl.svc/", RootDomain="sharepoint.com", Policy="MBI"X-DataBoundary: NONEX-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/SPRequestGuid: fb9d22a1-30e1-5000-3c2f-bbc04eb42c1arequest-id: fb9d22a1-30e1-5000-3c2f-bbc04eb42c1aMS-CV: oSKd++EwAFA8L7vATrQsGg.0Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=04bcab34-68f3-44a4-964d-ce4a652a6d4c&destinationEndpoint=Edge-Prod-MIA30r5d&frontEnd=AFD&RemoteIP=102.129.152.0"}]}NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0}Strict-Transport-Security: max-age=31536000X-FRAME-OPTIONS: SAMEORIGINContent-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com;X-Powered-By: ASP.NETMicrosoftSharePointTeamServices: 16.0.0.24803X-Content-Type-Options: nosniffX-MS-InvokeApp: 1; RequireReadOnlyX-Cache: CONFIG_NOCACHEX-MSEdge-Ref: Ref A: B7D251381FF6408E8929FF9E51882E3F Ref B: MIA301000108045 Ref C: 2024-04-25T23:59:11ZDate: Thu, 25 Apr 2024 23:59:10 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Apr 2024 23:59:49 GMTContent-Type: text/htmlContent-Length: 27242Connection: closeServer: cloudflareCF-RAY: 87a24a00489c74ba-MIA
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 25 Apr 2024 23:59:51 GMTServer: ApacheContent-Length: 278Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: chromecache_375.2.dr, chromecache_467.2.dr	String found in binary or memory: http://scripts.sil.org/OFLThis
Source: chromecache_436.2.dr, chromecache_362.2.dr, chromecache_541.2.dr, chromecache_578.2.dr, chromecache_619.2.dr	String found in binary or memory: http://www.contoso.com
Source: chromecache_358.2.dr, chromecache_367.2.dr	String found in binary or memory: https://1drv.com/
Source: chromecache_383.2.dr, chromecache_388.2.dr	String found in binary or memory: https://200.hc.com/the-harpercollins-200/moby-dick/
Source: chromecache_315.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Source: chromecache_358.2.dr, chromecache_367.2.dr	String found in binary or memory: https://centralus1-mediad.svc.ms
Source: chromecache_331.2.dr	String found in binary or memory: https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute
Source: chromecache_522.2.dr	String found in binary or memory: https://lists.live.com/
Source: chromecache_358.2.dr, chromecache_367.2.dr	String found in binary or memory: https://livefilestore.com/
Source: chromecache_358.2.dr, chromecache_367.2.dr	String found in binary or memory: https://media.cloudapp.net
Source: chromecache_358.2.dr, chromecache_367.2.dr	String found in binary or memory: https://northcentralus1-medias.svc.ms
Source: chromecache_444.2.dr	String found in binary or memory: https://odspwebdevdeploy.blob.core.windows.net
Source: chromecache_444.2.dr, chromecache_564.2.dr	String found in binary or memory: https://onedrive.live.com/?gologin=1
Source: chromecache_550.2.dr, chromecache_583.2.dr	String found in binary or memory: https://outlook.office.com/search
Source: chromecache_358.2.dr, chromecache_367.2.dr	String found in binary or memory: https://portal.office.com/
Source: chromecache_288.2.dr, chromecache_289.2.dr	String found in binary or memory: https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/documentationsecured.html)
Source: chromecache_300.2.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_281.2.dr, chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-12.003/
Source: chromecache_281.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-12.003/spwebworker.js
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp-media-cc7da505
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.1ds/odsp.1ds.lib-ef4794d7
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.aria/odsp.aria.lib-3ff49754
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.components/fui.co-d25fe9cf
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.core/fui.core-386588f5
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.legacy.components.migration.shims/fui.lco
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.legacy.components.migration/fui.lcom-97d4
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.legacy.components/fui.lco-efe8d61f
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.legacy.customizable/fui.lcu-c10ae93c
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.fluentui.utilities/fui.util-7c2f5169
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.knockout/odsp.knockout.lib-5819e006
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.react/odsp.react.lib-2600836d
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.tslib/tslib-1e17100f
Source: chromecache_564.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/sp-client/odsp.utilities/odsp.util-8562588b
Source: chromecache_564.2.dr	String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2024-04-12.003/
Source: chromecache_444.2.dr	String found in binary or memory: https://res.cdn.office.net/teams-js/2.0.0/js/MicrosoftTeams.min.js
Source: chromecache_444.2.dr	String found in binary or memory: https://securebroker.sharepointonline.com
Source: chromecache_564.2.dr	String found in binary or memory: https://shell.cdn.office.net
Source: chromecache_564.2.dr	String found in binary or memory: https://shell.cdn.office.net/api/ShellBootstrapper/business/OneShell
Source: chromecache_564.2.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold
Source: chromecache_353.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semiligh
Source: chromecache_367.2.dr	String found in binary or memory: https://substrate.office.com
Source: chromecache_383.2.dr, chromecache_388.2.dr	String found in binary or memory: https://www.littlebrown.com/titles/j-d-salinger/the-catcher-in-the-rye/9780316769488/
Source: chromecache_444.2.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$
Source: chromecache_564.2.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive
Source: chromecache_444.2.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2F$
Source: chromecache_564.2.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2Fonedrive
Source: chromecache_383.2.dr, chromecache_388.2.dr	String found in binary or memory: https://www.peachpit.com/store/dont-make-me-think-revisited-a-common-sense-approach-9780321965516
Source: chromecache_383.2.dr, chromecache_388.2.dr	String found in binary or memory: https://www.penguinrandomhouse.com/books/196330/great-tales-and-poems-of-edgar-allan-poe-by-edgar-al
Source: chromecache_388.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~007E;007E
Source: chromecache_383.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~007E;:tex
Source: chromecache_388.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~007E;007E
Source: chromecache_383.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~:text=The

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2348,i,3611515841190200981,8393978954978914487,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://url.au.m.mimecastprotect.com/s/ym7TCZY1GQuMp54GSzAaWK?domain=netorgft11294697-my.sharepoint.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2348,i,3611515841190200981,8393978954978914487,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 288	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 289
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 289	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff	0%	Avira URL Cloud	safe
https://netorgft11294697-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=odbmspdfwebworker&debug=false&bypass=false	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff	0%	Avira URL Cloud	safe
http://www.contoso.com	0%	URL Reputation	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff	0%	Virustotal		Browse
https://bomoorenewcombsrtrewqe.store/documtationconstruction/bocon/admin/js/sc.php?r=ZW0sZW1haWwsYWRk	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2	0%	Virustotal		Browse
https://northcentralus1-medias.svc.ms	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff	0%	Virustotal		Browse
https://northcentralus1-medias.svc.ms	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo	0%	Avira URL Cloud	safe
https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/documentationsecured.html)	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2	0%	Avira URL Cloud	safe
https://netorgft11294697-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2	0%	Avira URL Cloud	safe
https://200.hc.com/the-harpercollins-200/moby-dick/	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2	0%	Virustotal		Browse
https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/CSPReporting.aspx	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2	0%	Avira URL Cloud	safe
https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/favicon.ico	0%	Avira URL Cloud	safe
https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff	0%	Avira URL Cloud	safe
https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_api/SP.OAuth.Token/Acquire()	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2	0%	Avira URL Cloud	safe
https://netorgft11294697-my.sharepoint.com/:b:/g/personal/damion_riverbrookcustomhomes_com/EcjtaC-2Z0ZDidK1aM6NTrIBlouG5tiRXKd2X6ScLbrh9w?e=eKrSwx	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff	0%	Virustotal		Browse
https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/AccessDenied.aspx?correlation=0a9e22a1%2D008f%2D5000%2D3c2f%2Db4052f54218d	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff	0%	Virustotal		Browse
https://netorgft11294697-my.sharepoint.com/:b:/g/personal/damion_riverbrookcustomhomes_com/EcjtaC-2Z0ZDidK1aM6NTrIBlouG5tiRXKd2X6ScLbrh9w?e=eKrSwx	0%	Virustotal		Browse
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w	0%	Avira URL Cloud	safe
https://www.littlebrown.com/titles/j-d-salinger/the-catcher-in-the-rye/9780316769488/	0%	Avira URL Cloud	safe
https://securebroker.sharepointonline.com	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo	0%	Avira URL Cloud	safe
https://centralus1-mediad.svc.ms	0%	Avira URL Cloud	safe
https://netorgft11294697-my.sharepoint.com/_layouts/15/images/odbfavicon.ico?rev=47	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold	0%	Avira URL Cloud	safe
https://netorgft11294697-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%5D&defaultBrotli=true&authenticateFast=true&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099649,3]&spStartApplicationWebBundle=true&enableIntegrities=true	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili	0%	Avira URL Cloud	safe
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
url.au.m.mimecastprotect.com	124.47.150.19	true	false	unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	unknown
code.jquery.com	151.101.2.137	true	false	high
svc.ms-acdc-spo.office.com	52.107.247.63	true	false	high
cdnjs.cloudflare.com	104.17.24.14	true	false	high
challenges.cloudflare.com	104.17.2.184	true	false	high
www.google.com	142.250.217.196	true	false	high
pub-582bd2d04f444919a09966cc59090a26.r2.dev	104.18.2.35	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
windowsupdatebg.s.llnwi.net	208.111.136.128	true	false	unknown
bomoorenewcombsrtrewqe.store	107.174.244.125	true	false	unknown
netorgft11294697-my.sharepoint.com	unknown	unknown	false	unknown
southcentralus1-mediap.svc.ms	unknown	unknown	false	unknown
m365cdn.nel.measure.office.net	unknown	unknown	false	high
spo.nel.measure.office.net	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.138.10	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
107.174.244.125	bomoorenewcombsrtrewqe.store	United States	36352	AS-COLOCROSSINGUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.18.2.35	pub-582bd2d04f444919a09966cc59090a26.r2.dev	United States	13335	CLOUDFLARENETUS	false
124.47.150.19	url.au.m.mimecastprotect.com	Australia	17477	MCT-SYDNEYMacquarieTelecomAU	false
52.107.247.63	svc.ms-acdc-spo.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
142.250.217.196	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.17.2.184	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431934
Start date and time:	2024-04-26 01:57:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://url.au.m.mimecastprotect.com/s/ym7TCZY1GQuMp54GSzAaWK?domain=netorgft11294697-my.sharepoint.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus22.phis.win@18/758@35/12
Cookbook Comments:	Browse: https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/documentationsecured.html

Name	Malicious	Antivirus Detection	Reputation
https://netorgft11294697-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=odbmspdfwebworker&debug=false&bypass=false	false	Avira URL Cloud: safe	unknown
https://bomoorenewcombsrtrewqe.store/documtationconstruction/bocon/admin/js/sc.php?r=ZW0sZW1haWwsYWRk	false	Avira URL Cloud: safe	unknown
https://netorgft11294697-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx	false	Avira URL Cloud: safe	unknown
https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/documentationsecured.html	false		unknown
https://url.au.m.mimecastprotect.com/s/ym7TCZY1GQuMp54GSzAaWK?domain=netorgft11294697-my.sharepoint.com	false		unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/CSPReporting.aspx	false	Avira URL Cloud: safe	unknown
https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/favicon.ico	false	Avira URL Cloud: safe	unknown
https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_api/SP.OAuth.Token/Acquire()	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/b/471dc2adc340/api.js?onload=onloadTurnstileCallback	false		high
https://netorgft11294697-my.sharepoint.com/:b:/g/personal/damion_riverbrookcustomhomes_com/EcjtaC-2Z0ZDidK1aM6NTrIBlouG5tiRXKd2X6ScLbrh9w?e=eKrSwx	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/AccessDenied.aspx?correlation=0a9e22a1%2D008f%2D5000%2D3c2f%2Db4052f54218d	false	Avira URL Cloud: safe	unknown
https://netorgft11294697-my.sharepoint.com/_layouts/15/images/odbfavicon.ico?rev=47	false	Avira URL Cloud: safe	unknown
https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom%2FNew%20Document%2Epdf&parent=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom&ga=1	false		unknown
https://code.jquery.com/jquery-3.1.1.min.js	false		high
https://netorgft11294697-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%5D&defaultBrotli=true&authenticateFast=true&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099649,3]&spStartApplicationWebBundle=true&enableIntegrities=true	false	Avira URL Cloud: safe	unknown
https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_api/v2.1/graphql	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	false		high
https://bomoorenewcombsrtrewqe.store/documtationconstruction/bocon/8c73f62.php	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~007E;:tex	chromecache_383.2.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://northcentralus1-medias.svc.ms	chromecache_358.2.dr, chromecache_367.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://pub-582bd2d04f444919a09966cc59090a26.r2.dev/documentationsecured.html)	chromecache_288.2.dr, chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://onedrive.live.com/?gologin=1	chromecache_444.2.dr, chromecache_564.2.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://200.hc.com/the-harpercollins-200/moby-dick/	chromecache_383.2.dr, chromecache_388.2.dr	false	Avira URL Cloud: safe	unknown
https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute	chromecache_331.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~007E;007E	chromecache_388.2.dr	false		high
https://1drv.com/	chromecache_358.2.dr, chromecache_367.2.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~:text=The	chromecache_383.2.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://substrate.office.com	chromecache_367.2.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://lists.live.com/	chromecache_522.2.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2Fonedrive	chromecache_564.2.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~007E;007E	chromecache_388.2.dr	false		high
https://outlook.office.com/search	chromecache_550.2.dr, chromecache_583.2.dr	false		high
https://www.office.com/login?ru=%2Flaunch%2F$	chromecache_444.2.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof	chromecache_353.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://www.littlebrown.com/titles/j-d-salinger/the-catcher-in-the-rye/9780316769488/	chromecache_383.2.dr, chromecache_388.2.dr	false	Avira URL Cloud: safe	unknown
https://reactjs.org/link/react-polyfills	chromecache_300.2.dr	false		high
https://securebroker.sharepointonline.com	chromecache_444.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$	chromecache_444.2.dr	false		high
https://centralus1-mediad.svc.ms	chromecache_358.2.dr, chromecache_367.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://portal.office.com/	chromecache_358.2.dr, chromecache_367.2.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://www.penguinrandomhouse.com/books/196330/great-tales-and-poems-of-edgar-allan-poe-by-edgar-al	chromecache_383.2.dr, chromecache_388.2.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js	chromecache_564.2.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://livefilestore.com/	chromecache_358.2.dr, chromecache_367.2.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://www.peachpit.com/store/dont-make-me-think-revisited-a-common-sense-approach-9780321965516	chromecache_383.2.dr, chromecache_388.2.dr	false		high
http://www.contoso.com	chromecache_436.2.dr, chromecache_362.2.dr, chromecache_541.2.dr, chromecache_578.2.dr, chromecache_619.2.dr	false	URL Reputation: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://www.office.com/login?ru=%2Flaunch%2Fonedrive	chromecache_564.2.dr	false		high
http://scripts.sil.org/OFLThis	chromecache_375.2.dr, chromecache_467.2.dr	false		high
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown
https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semiligh	chromecache_353.2.dr	false	Avira URL Cloud: safe	unknown

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Apr 25 22:58:41 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9843618749035983
Encrypted:	false
SSDEEP:	48:8odDoTjs8GHYidAKZdA19ehwiZUklqehvy+3:8uofHpYy
MD5:	41FC687C108D5E76CC9F8916112F59A7
SHA1:	9311EA7812D8C7F50F717DA503E99505596C3F08
SHA-256:	7EBD5644487AEDC1722B3656B890101B571F08035B3120645BA884B067BA22BA
SHA-512:	1C5CB951A508891C92A62134A34D0326E8822474D25093A348BF6C2D153ED4F60DACCC22FD1402531D893F6F17610A5064A517ABCC8BA44C20B986B2246BF57E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....(...l...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.XQ.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.XQ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.XQ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.XQ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.XU............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........`..W.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 01:58:40.939646006 CEST	53	64760	1.1.1.1	192.168.2.5
Apr 26, 2024 01:58:40.959778070 CEST	53	49339	1.1.1.1	192.168.2.5
Apr 26, 2024 01:58:41.818233013 CEST	53	64304	1.1.1.1	192.168.2.5
Apr 26, 2024 01:58:42.585447073 CEST	62793	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:58:42.585666895 CEST	61587	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:58:42.710527897 CEST	53	61587	1.1.1.1	192.168.2.5
Apr 26, 2024 01:58:42.711013079 CEST	53	62793	1.1.1.1	192.168.2.5
Apr 26, 2024 01:58:42.747555017 CEST	54462	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:58:42.747828960 CEST	64892	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:58:42.873670101 CEST	53	54462	1.1.1.1	192.168.2.5
Apr 26, 2024 01:58:42.917279959 CEST	53	64892	1.1.1.1	192.168.2.5
Apr 26, 2024 01:58:57.313648939 CEST	57487	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:58:57.314296961 CEST	61304	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:58:58.916307926 CEST	53	64162	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:00.932751894 CEST	64847	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:00.932934046 CEST	62912	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:10.298676014 CEST	49500	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:10.298943996 CEST	55481	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:17.791009903 CEST	53	58024	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:23.351063013 CEST	55314	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:23.351063967 CEST	52017	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:23.475931883 CEST	53	55314	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:23.477792978 CEST	53	52017	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:24.505851030 CEST	51786	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:24.506848097 CEST	59513	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:24.642064095 CEST	53	59513	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:25.641474009 CEST	55893	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:25.767122030 CEST	53	55893	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:35.490189075 CEST	53	64069	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:40.534812927 CEST	53	62388	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:41.705523014 CEST	53	61334	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:47.105757952 CEST	50976	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:47.108253002 CEST	63305	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:47.235471010 CEST	53	50976	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:47.236219883 CEST	53	63305	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:47.879463911 CEST	61645	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:47.879678011 CEST	59338	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:47.880052090 CEST	60835	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:47.880166054 CEST	59028	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:48.004575968 CEST	53	61645	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:48.005522013 CEST	53	59338	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:48.014020920 CEST	53	60835	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:48.014130116 CEST	53	59028	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:48.846472979 CEST	55913	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:48.846885920 CEST	58852	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:48.847392082 CEST	63650	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:48.847563982 CEST	60561	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:48.972711086 CEST	53	58852	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:48.973026037 CEST	53	63650	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:48.973114967 CEST	53	60561	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:48.973437071 CEST	53	55913	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:51.028111935 CEST	56219	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:51.028965950 CEST	54069	53	192.168.2.5	1.1.1.1
Apr 26, 2024 01:59:51.160507917 CEST	53	56219	1.1.1.1	192.168.2.5
Apr 26, 2024 01:59:51.160972118 CEST	53	54069	1.1.1.1	192.168.2.5
Apr 26, 2024 02:00:08.362488985 CEST	53	52377	1.1.1.1	192.168.2.5
Apr 26, 2024 02:00:10.443526030 CEST	55200	53	192.168.2.5	1.1.1.1
Apr 26, 2024 02:00:10.443866014 CEST	55164	53	192.168.2.5	1.1.1.1
Apr 26, 2024 02:00:10.445573092 CEST	60708	53	192.168.2.5	1.1.1.1
Apr 26, 2024 02:00:10.446255922 CEST	63823	53	192.168.2.5	1.1.1.1
Apr 26, 2024 02:00:10.448064089 CEST	64032	53	192.168.2.5	1.1.1.1
Apr 26, 2024 02:00:10.448223114 CEST	50572	53	192.168.2.5	1.1.1.1
Apr 26, 2024 02:00:10.448565960 CEST	59397	53	192.168.2.5	1.1.1.1
Apr 26, 2024 02:00:10.448687077 CEST	53099	53	192.168.2.5	1.1.1.1

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 26, 2024 01:58:42.917365074 CEST	192.168.2.5	1.1.1.1	c22b	(Port unreachable)	Destination Unreachable
Apr 26, 2024 01:59:01.353765965 CEST	192.168.2.5	1.1.1.1	c34c	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:58:43 UTC	737	OUT	GET /s/ym7TCZY1GQuMp54GSzAaWK?domain=netorgft11294697-my.sharepoint.com HTTP/1.1 Host: url.au.m.mimecastprotect.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 23:58:44 UTC	3011	IN	HTTP/1.1 307 Temporary Redirect Date: Thu, 25 Apr 2024 23:58:44 GMT Content-Length: 0 Connection: close Location: https://url.au.m.mimecastprotect.com/r/im5eXWNvPH6MzmFjnUZH7VKmX5D-oEqyhX6BLVHIKi6FlTzGJPUyDxq9AdoJ1t6F4jkiaAb70X6GduOhJvlJPcCgcx8lhZYiUCKfG6YM51NAXkAqD6dMfnuAIB8n6mxF4SmjiDkw2eV4lG0cZLTWNd9hWyykOYyJ4-J8cvqka3_uixmsaGUaV2jSfHlRy4o3DAgCVkGu4-oOosBmjCL0HOOiLeo67jzXfs1FA2ZNxv1Zj7Li1pzRLAD3OAabPPvCp4gdrxNT4lW3QfiLdhJWYVHsFkj--QlCxxa5HpSmegf0yedKcvOcT0UjShofCdYZSMd2v6-rhEfcMPKV1CnJ7UsCBdqlcgkpwZM9n-5S4EDBmhYPR3_wHrHOvPR4XTGrbvcgUP3wKnLZAYpWdO5IQcafXjvdMclTjSavPIXmJG75KRJy9Ed8uno3V_mph26UPZYYTMpa9TTysa9MFN_l7AByQtviKuz_PdJVXkUTfJjDheuyWHWrhxs-rLaINUN-k-h6a849Cl_k0gZWb7ZZJKCeQW0JJsDL4qS8vEV2nbnXXuJao8se88_y0jCfZE4BLk54e0K3qxCl-F7PGQWt8LmCtnHWYeiwfJxx4Bt_hVRulnBxb4uCPe8EQO4PuoKElE7iz9Rk8gvbalJoOAOT9HZMvYniD3_KP_p0sj9r2dC2nbR_R_GJjyEFyS5UQ7SjhMopox9Je_rETZsi4afr4k1bJTMqwlrgJuMDi_eTu4LdHliGyAAyz7CvFL1gGJR6_swdXqsftnD43S8OYOmPIQLbbqPVJhLluPBs_-5abK7d055DII7xZ48bni0hKaB-2QIDEugJnYteyibxnO_dCYCzA3_NTCXIX2DSEBpNXN7kk4MmoW8HxgA3JAIVrk5L4AiXBtZVyWx6kRu_i_mQy3J-cFY7brreuunQ77aJ07nNoN6QSa_mNmCvxYRW3TFNz0WtLe3R6bGyep1v2yf8zMdXHShMegfNZeP80aoj1Cf36rAsng6FwkoHG4ZgzPHMmgSHMSN41A3wdcgxVPicDOOL4PPcbffhnf7PlAP1D1W6fvHdR1Ru0ZPG1ErI0zh6A_ZV_GncKO0nQzivTnvzu04lA3MzIt51_fvTSP4Gfs9nfdLwZ46tVHFmLvWmUODnevWz8LkLIxCOUbCrIZm-xdgMeYOp6CDpNJwt4SQDIoOBArJ-V-dor-yX00PYTISoIGdCBHLIQtL7IXjTHLAcIzTkJ8tN-V3nNQbXiYbyVAEytqCV6OZ0xIRvDOT0g2Li3f1TA7sZLlV4LBWc-ejiPB8MflvRtRZCGdcVYiO6J6daXzxnCzXB4hlXca1wd4pNbKaRHxwfHNhnVRl1PlkdWp32ejg-4--z7ECoixtOzpkQ4w0n55-dU0PrNbeAw9_qqySsOJO65zBmk2LZ4njliTOk4afonwQPkbwD0vuWZhab9X57ZsEN41VZHh7LDkCYQl2N5xD9DCL6kV12ETtiH6-BaZQSeOStRIcwQzvtirIW1toPlINm4W31_ym0ujm9nFdzK2uyk1mQz0s9W9lMm7QhD1kysjU1or46OeTCG-pZCq5USskDpM-m4FBYfAybTN8x3ny_KrODd_jbLx8WD7MOWgGdJTQwYPYfjNa0elzGqEV3p43m5WO_VFUyBWnTnnVSXAfzov2S-7S22_yvx1nMzqy1LqkV999PNC0yMPSo9NKxex5U8ATSx28_rheaD0CZBkjzT17CnZiUjZb1JAN0F4MtrMOghgRKT-QCCzOwa4qPSeUVEDvtqazCjopPkXya-4a1WEqfA8CNWb_UKPmHmUb4isr76mTdcTIZEW5KYO51it14QShu31AheGB9FR5M_fSooz8lk5pVIXoyVbW0hVCvRTAmKSBAVyXdEgpsyCbQW_-grgs6TgG-9TEmgjBAkF3CFMfst5-UF8XzogyJto2vlya6zlQCFTl7azTbvW5x0YTJw8pq9Qk88xk7wZGlh_QcyymdstJgsk8L2PjTTIC1rUxLxu_Q4sA5sLY0j6rsyTQg2O5svuhlplp4SUgxABBGgM_yHV2svyD3s1YK3JYCGj7tLqsQbyJ-AfTRXP_LfbfQk_DzklRr-NmRgtMsIEMT3R5149anfu5AYqD0Dd4qeNbU_yCDnBFVEiLUFBGwc4SIhOnkE7Hafvd5vNidDJ_qQmtiEi4fAjbpRM0Iz7MXFU3UtbD5tX9zc7LG0aHyWDmzaJR7_zycfMyrAy7hCdGwH67FQ7qDCRoCE0OXR5mC55g4hzzQLDMuQysMJO3r0owoUNkUA6aGs_RzyjCQlmDHx5imtK4q93suoKmPDDRrWaqLVAuBgLjQjPdP5oJcgzaQS97zs43FigINRYk6uqEEdS6d4GDqpaPAyx--W-qFC9wlCHXpW0ckfUjlXbM8P_q4inUKHWmdzS5cEKntTJgf6Mbcv1-pzwvD_NeOd9O-1NxrT-YmSpePBA34aDZVBLuX2zkBNPsd0c6DubtrBVcy6OZ6vmse9ScFWrQS-zWK-kkocLk76LcW7gxo1yaIcLn-FEKCUc1HdfBcJ7z_BcCYdHODpZKFfo1Jq5Wfi74djSKFnY4K2j5_YRMni1CLE_FH6gQB5R7F01Kp2EwgajzVxHFBiKwg-NPqvVFL8p8a8QFfiFnxXvBcYzGMlZiJJKzYpSOl5y8TWIJRkmSlmO93WoUvYEpyj-qHbeR7o0V-DRd3vB3hT4lYTBmrdFtDKPqPWHjIs6_WhZ5R0lR--YdHtJbmSdRVOcCjwg Cache-control: no-store Pragma: no-cache X-Robots-Tag: noindex, nofollow

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:58:44 UTC	3447	OUT	GET /r/im5eXWNvPH6MzmFjnUZH7VKmX5D-oEqyhX6BLVHIKi6FlTzGJPUyDxq9AdoJ1t6F4jkiaAb70X6GduOhJvlJPcCgcx8lhZYiUCKfG6YM51NAXkAqD6dMfnuAIB8n6mxF4SmjiDkw2eV4lG0cZLTWNd9hWyykOYyJ4-J8cvqka3_uixmsaGUaV2jSfHlRy4o3DAgCVkGu4-oOosBmjCL0HOOiLeo67jzXfs1FA2ZNxv1Zj7Li1pzRLAD3OAabPPvCp4gdrxNT4lW3QfiLdhJWYVHsFkj--QlCxxa5HpSmegf0yedKcvOcT0UjShofCdYZSMd2v6-rhEfcMPKV1CnJ7UsCBdqlcgkpwZM9n-5S4EDBmhYPR3_wHrHOvPR4XTGrbvcgUP3wKnLZAYpWdO5IQcafXjvdMclTjSavPIXmJG75KRJy9Ed8uno3V_mph26UPZYYTMpa9TTysa9MFN_l7AByQtviKuz_PdJVXkUTfJjDheuyWHWrhxs-rLaINUN-k-h6a849Cl_k0gZWb7ZZJKCeQW0JJsDL4qS8vEV2nbnXXuJao8se88_y0jCfZE4BLk54e0K3qxCl-F7PGQWt8LmCtnHWYeiwfJxx4Bt_hVRulnBxb4uCPe8EQO4PuoKElE7iz9Rk8gvbalJoOAOT9HZMvYniD3_KP_p0sj9r2dC2nbR_R_GJjyEFyS5UQ7SjhMopox9Je_rETZsi4afr4k1bJTMqwlrgJuMDi_eTu4LdHliGyAAyz7CvFL1gGJR6_swdXqsftnD43S8OYOmPIQLbbqPVJhLluPBs_-5abK7d055DII7xZ48bni0hKaB-2QIDEugJnYteyibxnO_dCYCzA3_NTCXIX2DSEBpNXN7kk4MmoW8HxgA3JAIVrk5L4AiXBtZVyWx6kRu_i_mQy3J-cFY7brreuunQ77aJ07nNoN6QSa_mNmCvxYRW3TFNz0WtLe3R6bGyep1v2yf8zMdXHShMegfNZeP80aoj1Cf36rAsng6FwkoHG4ZgzPHMmgSHMSN41A3wdcgxVPicDOOL4PPcbffhnf7PlAP1D1W6fvHdR1Ru0ZPG1ErI0zh6A_ZV_GncKO0nQzivTnvzu04lA3MzIt51_fvTSP4Gfs9nfdLwZ46tVHFmLvWmUODnevWz8LkLIxCOUbCrIZm-xdgMeYOp6CDpNJwt4SQDIoOBArJ-V-dor-yX00PYTISoIGdCBHLIQtL7IXjTHLAcIzTkJ8tN-V3nNQbXiYbyVAEytqCV6OZ0xIRvDOT0g2Li3f1TA7sZLlV4LBWc-ejiPB8MflvRtRZCGdcVYiO6J6daXzxnCzXB4hlXca1wd4pNbKaRHxwfHNhnVRl1PlkdWp32ejg-4--z7ECoixtOzpkQ4w0n55-dU0PrNbeAw9_qqySsOJO65zBmk2LZ4njliTOk4afonwQPkbwD0vuWZhab9X57ZsEN41VZHh7LDkCYQl2N5xD9DCL6kV12ETtiH6-BaZQSeOStRIcwQzvtirIW1toPlINm4W31_ym0ujm9nFdzK2uyk1mQz0s9W9lMm7QhD1kysjU1or46OeTCG-pZCq5USskDpM-m4FBYfAybTN8x3ny_KrODd_jbLx8WD7MOWgGdJTQwYPYfjNa0elzGqEV3p43m5WO_VFUyBWnTnnVSXAfzov2S-7S22_yvx1nMzqy1LqkV999PNC0yMPSo9NKxex5U8ATSx28_rheaD0CZBkjzT17CnZiUjZb1JAN0F4MtrMOghgRKT-QCCzOwa4qPSeUVEDvtqazCjopPkXya-4a1WEqfA8CNWb_UKPmHmUb4isr76mTdcTIZEW5KYO51it14QShu31AheGB9FR5M_fSooz8lk5pVIXoyVbW0hVCvRTAmKSBAVyXdEgpsyCbQW_-grgs6TgG-9TEmgjBAkF3CFMfst5-UF8XzogyJto2vlya6zlQCFTl7azTbvW5x0YTJw8pq9Qk88xk7wZGlh_QcyymdstJgsk8L2PjTTIC1rUxLxu_Q4sA5sLY0j6rsyTQg2O5svuhlplp4SUgxABBGgM_yHV2svyD3s1YK3JYCGj7tLqsQbyJ-AfTRXP_LfbfQk_DzklRr-NmRgtMsIEMT3R5149anfu5AYqD0Dd4qeNbU_yCDnBFVEiLUFBGwc4SIhOnkE7Hafvd5vNidDJ_qQmtiEi4fAjbpRM0Iz7MXFU3UtbD5tX9zc7LG0aHyWDmzaJR7_zycfMyrAy7hCdGwH67FQ7qDCRoCE0OXR5mC55g4hzzQLDMuQysMJO3r0owoUNkUA6aGs_RzyjCQlmDHx5imtK4q93suoKmPDDRrWaqLVAuBgLjQjPdP5oJcgzaQS97zs43FigINRYk6uqEEdS6d4GDqpaPAyx--W-qFC9wlCHXpW0ckfUjlXbM8P_q4inUKHWmdzS5cEKntTJgf6Mbcv1-pzwvD_NeOd9O-1NxrT-YmSpePBA34aDZVBLuX2zkBNPsd0c6DubtrBVcy6OZ6vmse9ScFWrQS-zWK-kkocLk76LcW7gxo1yaIcLn-FEKCUc1HdfBcJ7z_BcCYdHODpZKFfo1Jq5Wfi74djSKFnY4K2j5_YRMni1CLE_FH6gQB5R7F01Kp2EwgajzVxHFBiKwg-NPqvVFL8p8a8QFfiFnxXvBcYzGMlZiJJKzYpSOl5y8TWIJRkmSlmO93WoUvYEpyj-qHbeR7o0V-DRd3vB3hT4lYTBmrdFtDKPqPWHjIs6_WhZ5R0lR--YdHtJbmSdRVOcCjwg HTTP/1.1 Host: url.au.m.mimecastprotect.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 23:58:57 UTC	417	IN	HTTP/1.1 307 Temporary Redirect Date: Thu, 25 Apr 2024 23:58:57 GMT Content-Length: 0 Connection: close Location: https://netorgft11294697-my.sharepoint.com/:b:/g/personal/damion_riverbrookcustomhomes_com/EcjtaC-2Z0ZDidK1aM6NTrIBlouG5tiRXKd2X6ScLbrh9w?e=eKrSwx Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Cache-control: no-store Pragma: no-cache X-Robots-Tag: noindex, nofollow

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:58:46 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 23:58:46 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=111902 Date: Thu, 25 Apr 2024 23:58:46 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:58:46 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 23:58:47 UTC	521	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-MSEdge-Ref: Ref A: 86D4C1EC23844E65A40A9F1508D7BABF Ref B: BL2EDGE2514 Ref C: 2023-04-05T23:36:05Z Cache-Control: public, max-age=111844 Date: Thu, 25 Apr 2024 23:58:47 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-25 23:58:47 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:58:56 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1714089504005&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-04-25 23:58:56 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-04-25 23:58:56 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-04-25 23:58:57 UTC	479	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 7E960988EB284B5083378349C992E04B Ref B: LAX311000114029 Ref C: 2024-04-25T23:58:57Z Date: Thu, 25 Apr 2024 23:58:57 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1714089537.ddb5544

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://url.au.m.mimecastprotect.com/s/ym7TCZY1GQuMp54GSzAaWK?domain=netorgft11294697-my.sharepoint.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 277

Chrome Cache Entry: 278

Chrome Cache Entry: 279

Chrome Cache Entry: 280

Chrome Cache Entry: 281

Chrome Cache Entry: 282

Chrome Cache Entry: 283

Chrome Cache Entry: 284

Chrome Cache Entry: 285

Chrome Cache Entry: 286

Chrome Cache Entry: 287

Chrome Cache Entry: 288

Chrome Cache Entry: 289

Chrome Cache Entry: 290

Chrome Cache Entry: 291

Chrome Cache Entry: 292

Chrome Cache Entry: 293

Chrome Cache Entry: 294

Chrome Cache Entry: 295

Chrome Cache Entry: 296

Chrome Cache Entry: 297

Windows Analysis Report
https://url.au.m.mimecastprotect.com/s/ym7TCZY1GQuMp54GSzAaWK?domain=netorgft11294697-my.sharepoint.com

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:58:58 UTC	780	OUT	GET /:b:/g/personal/damion_riverbrookcustomhomes_com/EcjtaC-2Z0ZDidK1aM6NTrIBlouG5tiRXKd2X6ScLbrh9w?e=eKrSwx HTTP/1.1 Host: netorgft11294697-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 23:58:59 UTC	3437	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 479 Content-Type: text/html; charset=utf-8 Location: https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom%2FNew%20Document%2Epdf&parent=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom&ga=1 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=; path=/; SameSite=None; Partitioned; secure; HttpOnly X-NetworkStatistics: 0,525568,0,86,874747,0,525568 X-SharePointHealthScore: 2 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: f89d22a1-30a8-5000-3c2f-b5f0b3fa8f47 request-id: f89d22a1-30a8-5000-3c2f-b5f0b3fa8f47 MS-CV: oSKd+KgwAFA8L7Xws/qPRw.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=04bcab34-68f3-44a4-964d-ce4a652a6d4c&destinationEndpoint=Edge-Prod-MIA30r5a&frontEnd=AFD&RemoteIP=102.129.152.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 922 SPIisLatency: 4 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 56AF461F9E554CC0B94F1D9537C1B20D Ref B: MIA301000101017 Ref C: 2024-04-25T23:58:58Z Date: Thu, 25 Apr 2024 23:58:59 GMT Connection: close
2024-04-25 23:58:59 UTC	479	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6e 65 74 6f 72 67 66 74 31 31 32 39 34 36 39 37 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 64 61 6d 69 6f 6e 5f 72 69 76 65 72 62 72 6f 6f 6b 63 75 73 74 6f 6d 68 6f 6d 65 73 5f 63 6f 6d 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 6f 6e 65 64 72 69 76 65 2e 61 73 70 78 3f 69 64 3d 25 32 46 70 65 72 73 6f 6e 61 6c 25 32 46 64 61 6d 69 6f 6e 25 35 46 72 69 76 65 72 62 72 6f 6f 6b 63 75 73 74 6f 6d 68 6f 6d 65 73 25 35 46 63 6f 6d 25 32 46 44 6f 63 75 6d Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocum

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:59:00 UTC	1560	OUT	GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: netorgft11294697-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=
2024-04-25 23:59:00 UTC	3047	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=; path=/; SameSite=None; Partitioned; secure; HttpOnly X-NetworkStatistics: 0,2102272,0,206,1153681,0,891131 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: f99d22a1-c04b-5000-3c2f-b89fe90955d1 request-id: f99d22a1-c04b-5000-3c2f-b89fe90955d1 MS-CV: oSKd+UvAAFA8L7if6QlV0Q.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=04bcab34-68f3-44a4-964d-ce4a652a6d4c&destinationEndpoint=Edge-Prod-MIA30r5a&frontEnd=AFD&RemoteIP=102.129.152.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: BA09BC71205C4E298FDC5D5E98809B4B Ref B: MIA301000101019 Ref C: 2024-04-25T23:59:00Z Date: Thu, 25 Apr 2024 23:59:00 GMT Connection: close
2024-04-25 23:59:00 UTC	706	IN	Data Raw: 32 62 62 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 2bbself._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2024-04-25 23:59:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:59:01 UTC	391	OUT	GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: netorgft11294697-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 23:59:01 UTC	1825	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,525568,0,29,2509558,0,525568 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: f99d22a1-d08a-5000-361b-5e911a982efa request-id: f99d22a1-d08a-5000-361b-5e911a982efa MS-CV: oSKd+YrQAFA2G16RGpgu+g.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=04bcab34-68f3-44a4-964d-ce4a652a6d4c&destinationEndpoint=Edge-Prod-MIA30r5d&frontEnd=AFD&RemoteIP=102.129.152.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: DCC5875819E8446997BBDCECC1BD0A76 Ref B: MIA301000107029 Ref C: 2024-04-25T23:59:01Z Date: Thu, 25 Apr 2024 23:59:01 GMT Connection: close
2024-04-25 23:59:01 UTC	706	IN	Data Raw: 32 62 62 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 2bbself._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2024-04-25 23:59:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:59:01 UTC	2266	OUT	POST /personal/damion_riverbrookcustomhomes_com/_api/v2.1/graphql HTTP/1.1 Host: netorgft11294697-my.sharepoint.com Connection: keep-alive Content-Length: 507 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json;odata=verbose Content-Type: application/json;odata=verbose X-ServiceWorker-Strategy: CacheFirst sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://netorgft11294697-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom%2FNew%20Document%2Epdf&parent=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=
2024-04-25 23:59:01 UTC	507	OUT	Data Raw: 7b 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 28 5c 6e 20 20 20 20 20 20 20 20 24 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 51 75 65 72 79 53 74 72 69 6e 67 3a 20 53 74 72 69 6e 67 21 5c 6e 20 20 20 20 20 20 20 20 29 5c 6e 20 20 20 20 20 20 7b 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 6c 65 67 61 63 79 20 7b 5c 6e 20 20 20 20 20 20 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 28 5c 6e 20 20 20 20 20 20 71 75 65 72 79 53 74 72 69 6e 67 3a 20 24 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 51 75 65 72 79 53 74 72 69 6e 67 5c 6e 20 20 20 20 20 20 29 20 20 20 20 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 5c 6e 20 20 70 65 72 66 20 7b 5c 6e 20 20 20 20 65 78 65 63 75 74 69 6f 6e 54 69 6d 65 5c 6e 20 Data Ascii: {"query":"query (\n $spoSuiteLinksQueryString: String!\n )\n {\n \n legacy {\n spoSuiteLinks(\n queryString: $spoSuiteLinksQueryString\n ) \n \n }\n \n \n perf {\n executionTime\n
2024-04-25 23:59:02 UTC	3021	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 17752 Content-Type: application/json P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=; path=/; SameSite=None; Partitioned; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,5717071,0,525568 X-SharePointHealthScore: 2 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: f99d22a1-009c-5000-361b-5f1a9dfe737e request-id: f99d22a1-009c-5000-361b-5f1a9dfe737e MS-CV: oSKd+ZwAAFA2G18anf5zfg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=04bcab34-68f3-44a4-964d-ce4a652a6d4c&destinationEndpoint=Edge-Prod-MIA30r5b&frontEnd=AFD&RemoteIP=102.129.152.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: AE495FD56D704301A4CFCD86395FB326 Ref B: MIA301000104011 Ref C: 2024-04-25T23:59:02Z Date: Thu, 25 Apr 2024 23:59:01 GMT Connection: close
2024-04-25 23:59:02 UTC	1149	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6c 65 67 61 63 79 22 3a 7b 22 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 22 3a 7b 0a 20 22 53 50 53 75 69 74 65 56 65 72 73 69 6f 6e 22 3a 32 2c 0a 20 22 53 50 49 73 4d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 0a 20 22 43 73 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 68 61 72 65 64 2e 33 38 34 61 61 63 65 35 66 39 38 61 38 36 32 32 66 34 32 31 63 66 35 39 39 33 35 37 62 36 38 64 2e 63 73 73 22 2c 0a 20 22 4a 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 62 6f 6f 74 73 74 72 Data Ascii: {"data":{"legacy":{"spoSuiteLinks":{ "SPSuiteVersion":2, "SPIsMobile":false, "CssUrl":"https://res-1.cdn.office.net/shellux/suiteux.shell.shared.384aace5f98a8622f421cf599357b68d.css", "JsUrl":"https://res-1.cdn.office.net/shellux/suiteux.shell.bootstr
2024-04-25 23:59:02 UTC	8192	IN	Data Raw: 6d 65 74 72 79 53 65 72 76 65 72 52 65 71 75 65 73 74 49 6e 66 6c 75 78 43 6f 6e 74 72 6f 6c 5c 22 3a 35 2c 5c 22 41 72 69 61 54 65 6c 65 6d 65 74 72 79 54 65 6e 61 6e 74 54 6f 6b 65 6e 5c 22 3a 5c 22 63 36 63 31 39 30 61 31 62 37 33 63 34 61 36 33 62 62 61 38 39 38 33 35 64 35 34 36 63 66 32 38 2d 66 32 61 30 34 38 32 66 2d 61 30 30 64 2d 34 38 64 39 2d 38 32 32 65 2d 65 38 39 63 63 38 39 65 62 36 34 64 2d 37 36 38 38 5c 22 2c 5c 22 41 72 69 61 54 65 6c 65 6d 65 74 72 79 55 72 69 5c 22 3a 5c 22 5c 22 2c 5c 22 41 75 74 68 41 62 74 45 6e 61 62 6c 65 64 5c 22 3a 74 72 75 65 2c 5c 22 43 4c 53 49 44 5c 22 3a 5c 22 61 64 32 37 30 35 61 38 2d 35 64 61 36 2d 34 39 61 63 2d 38 65 36 64 2d 31 35 61 63 35 37 63 33 62 35 33 33 5c 22 2c 5c 22 43 50 4e 49 50 69 6e 45 Data Ascii: metryServerRequestInfluxControl\":5,\"AriaTelemetryTenantToken\":\"c6c190a1b73c4a63bba89835d546cf28-f2a0482f-a00d-48d9-822e-e89cc89eb64d-7688\",\"AriaTelemetryUri\":\"\",\"AuthAbtEnabled\":true,\"CLSID\":\"ad2705a8-5da6-49ac-8e6d-15ac57c3b533\",\"CPNIPinE
2024-04-25 23:59:02 UTC	4144	IN	Data Raw: 78 2e 62 62 66 38 63 38 30 63 35 64 63 34 63 39 36 31 38 39 61 65 2e 6a 73 5c 22 2c 5c 22 73 65 61 72 63 68 75 78 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 65 61 72 63 68 75 78 2e 66 34 65 37 37 33 30 64 30 33 36 32 38 30 63 32 38 62 61 36 2e 6a 73 5c 22 2c 5c 22 73 68 65 6c 6c 72 65 61 63 74 63 6f 6e 74 72 6f 6c 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 68 65 6c 6c 72 65 61 63 74 63 6f 6e 74 72 6f 6c 2e 39 62 34 63 63 31 38 36 31 39 34 31 33 32 30 33 37 35 38 62 2e 6a 73 5c 22 2c 5c 22 73 74 61 74 69 Data Ascii: x.bbf8c80c5dc4c96189ae.js\",\"searchux\":\"https://res-1.cdn.office.net/shellux/suiteux.shell.searchux.f4e7730d036280c28ba6.js\",\"shellreactcontrol\":\"https://res-1.cdn.office.net/shellux/suiteux.shell.shellreactcontrol.9b4cc18619413203758b.js\",\"stati
2024-04-25 23:59:02 UTC	4267	IN	Data Raw: 3a 22 65 6e 2d 55 53 22 2c 22 43 75 72 72 65 6e 74 4d 61 69 6e 4c 69 6e 6b 45 6c 65 6d 65 6e 74 49 44 22 3a 22 53 68 65 6c 6c 53 68 61 72 65 70 6f 69 6e 74 22 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 48 65 6c 70 53 75 62 4c 69 6e 6b 73 22 3a 6e 75 6c 6c 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 53 65 74 74 69 6e 67 73 4c 69 6e 6b 22 3a 6e 75 6c 6c 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 53 65 74 74 69 6e 67 73 53 75 62 4c 69 6e 6b 73 22 3a 6e 75 6c 6c 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 55 73 65 72 53 75 62 4c 69 6e 6b 73 22 3a 6e 75 6c 6c 2c 22 44 69 6d 65 6e 73 69 6f 6e 73 22 3a 7b 22 54 6f 70 22 3a 35 30 7d 2c 22 44 6f 77 6e 41 72 72 6f 77 49 6d 61 67 65 22 3a 6e 75 6c 6c 2c 22 44 6f 77 6e 57 68 69 74 65 41 Data Ascii: :"en-US","CurrentMainLinkElementID":"ShellSharepoint","CurrentWorkloadHelpSubLinks":null,"CurrentWorkloadSettingsLink":null,"CurrentWorkloadSettingsSubLinks":null,"CurrentWorkloadUserSubLinks":null,"Dimensions":{"Top":50},"DownArrowImage":null,"DownWhiteA

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:59:02 UTC	417	OUT	GET /personal/damion_riverbrookcustomhomes_com/_api/v2.1/graphql HTTP/1.1 Host: netorgft11294697-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 23:59:02 UTC	1797	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 87 Content-Type: application/json P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,525568,0,0,118308,0,145980 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: f99d22a1-40cb-5000-361b-5085613b5367 request-id: f99d22a1-40cb-5000-361b-5085613b5367 MS-CV: oSKd+ctAAFA2G1CFYTtTZw.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-MIA30r5b&frontEnd=AFD&RemoteIP=102.129.152.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 8E74CD73ACB042D5A231CAE967C5F2C7 Ref B: MIA301000103037 Ref C: 2024-04-25T23:59:02Z Date: Thu, 25 Apr 2024 23:59:02 GMT Connection: close
2024-04-25 23:59:02 UTC	87	IN	Data Raw: 7b 22 65 72 72 6f 72 73 22 3a 5b 7b 22 6d 65 73 73 61 67 65 22 3a 22 41 20 71 75 65 72 79 20 69 73 20 72 65 71 75 69 72 65 64 2e 22 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 22 63 6f 64 65 22 3a 22 45 58 45 43 55 54 49 4f 4e 5f 45 52 52 4f 52 22 7d 7d 5d 7d Data Ascii: {"errors":[{"message":"A query is required.","extensions":{"code":"EXECUTION_ERROR"}}]}

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:59:09 UTC	2802	OUT	POST /personal/damion_riverbrookcustomhomes_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: netorgft11294697-my.sharepoint.com Connection: keep-alive Content-Length: 821 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" ScenarioType: AUO sec-ch-ua-mobile: ?0 Authorization: Bearer User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CollectSPPerfMetrics: SPSQLQueryCount Content-Type: application/json;odata=verbose accept: application/json;odata=verbose X-ClientService-ClientTag: ODB Web X-SP-REQUESTRESOURCES: listUrl=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments X-ServiceWorker-Strategy: CacheFirst x-requestdigest: 0x96D9D3458BAD7DBABD08FFB74DD25C143F8D07C04DD51573A25C4FDC8D793C24769E97B3DD57DA9585E748947499CF0EAC725BE69921A954E4AA96BB354D7842,25 Apr 2024 23:58:59 -0000 sec-ch-ua-platform: "Windows" Origin: https://netorgft11294697-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom%2FNew%20Document%2Epdf&parent=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=
2024-04-25 23:59:09 UTC	821	OUT	Data Raw: 7b 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 5f 5f 6d 65 74 61 64 61 74 61 22 3a 7b 22 74 79 70 65 22 3a 22 53 50 2e 52 65 6e 64 65 72 4c 69 73 74 44 61 74 61 50 61 72 61 6d 65 74 65 72 73 22 7d 2c 22 52 65 6e 64 65 72 4f 70 74 69 6f 6e 73 22 3a 31 30 35 32 36 37 39 2c 22 56 69 65 77 58 6d 6c 22 3a 22 3c 56 69 65 77 20 3e 3c 51 75 65 72 79 3e 3c 2f 51 75 65 72 79 3e 3c 56 69 65 77 46 69 65 6c 64 73 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 44 6f 63 49 63 6f 6e 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4c 69 6e 6b 46 69 6c 65 6e 61 6d 65 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4d 6f 64 69 66 69 65 64 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 45 64 69 74 6f 72 5c 22 2f 3e 3c 46 Data Ascii: {"parameters":{"__metadata":{"type":"SP.RenderListDataParameters"},"RenderOptions":1052679,"ViewXml":"<View ><Query></Query><ViewFields><FieldRef Name=\"DocIcon\"/><FieldRef Name=\"LinkFilename\"/><FieldRef Name=\"Modified\"/><FieldRef Name=\"Editor\"/><F
2024-04-25 23:59:09 UTC	3280	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Expires: Wed, 10 Apr 2024 23:59:09 GMT Last-Modified: Thu, 25 Apr 2024 23:59:09 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=; path=/; SameSite=None; Partitioned; secure; HttpOnly X-NetworkStatistics: 0,2102272,1672,147,772247,2102272,2102272 X-SharePointHealthScore: 0 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 113 SPRequestDuration: 114 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: fb9d22a1-c064-5000-3c2f-bde6feda8072 request-id: fb9d22a1-c064-5000-3c2f-bde6feda8072 MS-CV: oSKd+2TAAFA8L73m/tqAcg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=04bcab34-68f3-44a4-964d-ce4a652a6d4c&destinationEndpoint=Edge-Prod-MIA30r5d&frontEnd=AFD&RemoteIP=102.129.152.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 65E7308F0B824BBB8FDAED4F496872E8 Ref B: MIA301000107009 Ref C: 2024-04-25T23:59:09Z Date: Thu, 25 Apr 2024 23:59:09 GMT Connection: close
2024-04-25 23:59:09 UTC	868	IN	Data Raw: 33 35 64 0d 0a 7b 22 77 70 71 22 3a 22 22 2c 22 54 65 6d 70 6c 61 74 65 73 22 3a 7b 7d 2c 22 4c 69 73 74 44 61 74 61 22 3a 7b 20 22 52 6f 77 22 20 3a 20 0a 5b 5d 2c 22 46 69 72 73 74 52 6f 77 22 20 3a 20 31 2c 0d 0a 22 46 6f 6c 64 65 72 50 65 72 6d 69 73 73 69 6f 6e 73 22 20 3a 20 22 30 78 33 30 30 38 30 31 31 30 30 30 22 0d 0a 2c 22 4c 61 73 74 52 6f 77 22 20 3a 20 30 2c 0d 0a 22 52 6f 77 4c 69 6d 69 74 22 20 3a 20 31 0d 0a 2c 22 46 69 6c 74 65 72 4c 69 6e 6b 22 20 3a 20 22 3f 22 0a 2c 22 46 6f 72 63 65 4e 6f 48 69 65 72 61 72 63 68 79 22 20 3a 20 22 31 22 0a 2c 22 48 69 65 72 61 72 63 68 79 48 61 73 49 6e 64 65 6e 74 69 6f 6e 22 20 3a 20 22 22 0a 2c 22 43 75 72 72 65 6e 74 46 6f 6c 64 65 72 50 72 69 6e 63 69 70 61 6c 43 6f 75 6e 74 22 20 3a 20 22 30 22 Data Ascii: 35d{"wpq":"","Templates":{},"ListData":{ "Row" : [],"FirstRow" : 1,"FolderPermissions" : "0x3008011000","LastRow" : 0,"RowLimit" : 1,"FilterLink" : "?","ForceNoHierarchy" : "1","HierarchyHasIndention" : "","CurrentFolderPrincipalCount" : "0"
2024-04-25 23:59:09 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 6d 65 22 2c 0a 22 49 44 22 3a 20 22 35 63 63 36 64 63 37 39 2d 33 37 31 30 2d 34 33 37 34 2d 62 34 33 33 2d 36 31 63 62 34 61 36 38 36 63 31 32 22 2c 0a 22 53 74 61 74 69 63 4e 61 6d 65 22 3a 20 22 4c 69 6e 6b 46 69 6c 65 6e 61 6d 65 22 2c 0a 22 43 6c 61 73 73 49 6e 66 6f 22 3a 20 22 4d 65 6e 75 22 2c 0a 22 72 6f 6c 65 22 3a 20 22 43 6f 6d 70 75 74 65 64 22 2c 0a 22 61 72 69 61 4c 61 62 65 6c 22 3a 20 22 4e 61 6d 65 22 2c 0a 22 46 72 6f 6d 42 61 73 65 54 79 70 65 22 3a 20 22 54 52 55 45 22 2c 0a 22 54 79 70 65 22 3a 20 22 43 6f 6d 70 75 74 65 64 22 2c 0a 22 46 69 6c 74 65 72 61 62 6c 65 22 3a 20 22 46 41 4c 53 45 22 2c 0a 22 6c 69 73 74 49 74 65 6d 4d 65 6e 75 22 3a 20 22 54 52 55 45 22 2c 0a 22 43 61 6c 6c 6f 75 74 4d 65 6e 75 22 3a 20 Data Ascii: 2000me","ID": "5cc6dc79-3710-4374-b433-61cb4a686c12","StaticName": "LinkFilename","ClassInfo": "Menu","role": "Computed","ariaLabel": "Name","FromBaseType": "TRUE","Type": "Computed","Filterable": "FALSE","listItemMenu": "TRUE","CalloutMenu":
2024-04-25 23:59:09 UTC	4175	IN	Data Raw: 31 30 34 37 0d 0a 4d 54 41 79 4c 6a 45 79 4f 53 34 78 4e 54 49 75 4d 6a 49 77 49 69 77 69 61 58 4e 73 62 32 39 77 59 6d 46 6a 61 79 49 36 49 6c 52 79 64 57 55 69 4c 43 4a 70 63 33 4d 69 4f 69 49 77 4d 44 41 77 4d 44 41 77 4d 79 30 77 4d 44 41 77 4c 54 42 6d 5a 6a 45 74 59 32 55 77 4d 43 30 77 4d 44 41 77 4d 44 41 77 4d 44 41 77 4d 44 41 69 4c 43 4a 70 63 33 56 7a 5a 58 49 69 4f 69 4a 30 63 6e 56 6c 49 69 77 69 62 6d 46 74 5a 57 6c 6b 49 6a 6f 69 4d 43 4d 75 5a 6e 78 74 5a 57 31 69 5a 58 4a 7a 61 47 6c 77 66 48 56 79 62 69 55 7a 59 58 4e 77 62 79 55 7a 59 57 46 75 62 32 34 6a 4e 54 67 79 4f 44 59 7a 4e 32 4d 77 5a 6a 56 68 59 7a 64 6a 4d 7a 67 35 4d 54 59 35 4f 54 45 32 59 54 46 68 5a 47 59 78 4e 32 4d 30 4e 7a 67 34 4f 47 59 35 4f 54 59 30 4d 32 51 33 59 Data Ascii: 1047MTAyLjEyOS4xNTIuMjIwIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3Y
2024-04-25 23:59:09 UTC	2208	IN	Data Raw: 38 39 39 0d 0a 64 65 22 3a 66 61 6c 73 65 2c 22 6c 69 73 74 54 65 6d 70 6c 61 74 65 22 3a 22 37 30 30 22 2c 22 6c 69 73 74 4e 61 6d 65 22 3a 22 7b 34 31 41 37 43 42 42 36 2d 30 38 38 37 2d 34 43 35 45 2d 41 46 44 30 2d 46 41 36 31 39 45 35 35 35 33 44 44 7d 22 2c 22 72 6f 6f 74 46 6f 6c 64 65 72 22 3a 22 22 2c 22 76 69 65 77 22 3a 22 7b 30 30 30 30 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 7d 22 2c 22 76 69 65 77 54 69 74 6c 65 22 3a 22 22 2c 22 6c 69 73 74 55 72 6c 44 69 72 22 3a 22 2f 70 65 72 73 6f 6e 61 6c 2f 64 61 6d 69 6f 6e 5f 72 69 76 65 72 62 72 6f 6f 6b 63 75 73 74 6f 6d 68 6f 6d 65 73 5f 63 6f 6d 2f 44 6f 63 75 6d 65 6e 74 73 22 2c 22 48 74 74 70 50 61 74 68 22 3a 22 68 74 74 70 73 3a 2f 2f Data Ascii: 899de":false,"listTemplate":"700","listName":"{41A7CBB6-0887-4C5E-AFD0-FA619E5553DD}","rootFolder":"","view":"{00000000-0000-0000-0000-000000000000}","viewTitle":"","listUrlDir":"/personal/damion_riverbrookcustomhomes_com/Documents","HttpPath":"https://
2024-04-25 23:59:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:59:09 UTC	2907	OUT	POST /personal/damion_riverbrookcustomhomes_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%27&RootFolder=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom&TryNewExperienceSingle=TRUE HTTP/1.1 Host: netorgft11294697-my.sharepoint.com Connection: keep-alive Content-Length: 201 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" ScenarioType: AUO Accept-Language: en-US sec-ch-ua-mobile: ?0 Authorization: Bearer User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json;odata=verbose CollectSPPerfMetrics: SPSQLQueryCount accept: application/json;odata=verbose X-ClientService-ClientTag: ODB Web X-SP-REQUESTRESOURCES: listUrl=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments X-ServiceWorker-Strategy: CacheFirst x-requestdigest: 0x96D9D3458BAD7DBABD08FFB74DD25C143F8D07C04DD51573A25C4FDC8D793C24769E97B3DD57DA9585E748947499CF0EAC725BE69921A954E4AA96BB354D7842,25 Apr 2024 23:58:59 -0000 sec-ch-ua-platform: "Windows" Origin: https://netorgft11294697-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom%2FNew%20Document%2Epdf&parent=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom&ga=1 Accept-Encoding: gzip, deflate, br Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=
2024-04-25 23:59:09 UTC	201	OUT	Data Raw: 7b 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 5f 5f 6d 65 74 61 64 61 74 61 22 3a 7b 22 74 79 70 65 22 3a 22 53 50 2e 52 65 6e 64 65 72 4c 69 73 74 44 61 74 61 50 61 72 61 6d 65 74 65 72 73 22 7d 2c 22 52 65 6e 64 65 72 4f 70 74 69 6f 6e 73 22 3a 35 34 34 35 33 38 33 2c 22 41 6c 6c 6f 77 4d 75 6c 74 69 70 6c 65 56 61 6c 75 65 46 69 6c 74 65 72 46 6f 72 54 61 78 6f 6e 6f 6d 79 46 69 65 6c 64 73 22 3a 74 72 75 65 2c 22 41 64 64 52 65 71 75 69 72 65 64 46 69 65 6c 64 73 22 3a 74 72 75 65 2c 22 52 65 71 75 69 72 65 46 6f 6c 64 65 72 43 6f 6c 6f 72 69 6e 67 46 69 65 6c 64 73 22 3a 74 72 75 65 7d 7d Data Ascii: {"parameters":{"__metadata":{"type":"SP.RenderListDataParameters"},"RenderOptions":5445383,"AllowMultipleValueFilterForTaxonomyFields":true,"AddRequiredFields":true,"RequireFolderColoringFields":true}}
2024-04-25 23:59:09 UTC	3265	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Expires: Wed, 10 Apr 2024 23:59:09 GMT Last-Modified: Thu, 25 Apr 2024 23:59:09 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=; path=/; SameSite=None; Partitioned; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,98736,0,35854 X-SharePointHealthScore: 2 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 103 SPRequestDuration: 104 X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: fb9d22a1-706d-5000-3c2f-b0385560abe0 request-id: fb9d22a1-706d-5000-3c2f-b0385560abe0 MS-CV: oSKd+21wAFA8L7A4VWCr4A.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=04bcab34-68f3-44a4-964d-ce4a652a6d4c&destinationEndpoint=Edge-Prod-MIA30r5a&frontEnd=AFD&RemoteIP=102.129.152.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 579A7118E91546498CBC9855A5C2F469 Ref B: MIA301000101033 Ref C: 2024-04-25T23:59:09Z Date: Thu, 25 Apr 2024 23:59:08 GMT Connection: close
2024-04-25 23:59:09 UTC	3608	IN	Data Raw: 65 31 31 0d 0a 7b 22 77 70 71 22 3a 22 22 2c 22 54 65 6d 70 6c 61 74 65 73 22 3a 7b 7d 2c 22 4c 69 73 74 44 61 74 61 22 3a 7b 20 22 52 6f 77 22 20 3a 20 0a 5b 7b 0d 0a 22 49 44 22 3a 20 22 31 34 22 2c 0d 0a 22 50 65 72 6d 4d 61 73 6b 22 3a 20 22 30 78 31 30 30 33 30 30 38 30 33 31 30 30 31 22 2c 0d 0a 22 46 53 4f 62 6a 54 79 70 65 22 3a 20 22 30 22 2c 0d 0a 22 48 54 4d 4c 5f 78 30 30 32 30 5f 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 22 3a 20 22 22 2c 0d 0a 22 55 6e 69 71 75 65 49 64 22 3a 20 22 7b 32 46 36 38 45 44 43 38 2d 36 37 42 36 2d 34 33 34 36 2d 38 39 44 32 2d 42 35 36 38 43 45 38 44 34 45 42 32 7d 22 2c 0d 0a 22 50 72 6f 67 49 64 22 3a 20 22 22 2c 0d 0a 22 4e 6f 45 78 65 63 75 74 65 22 3a 20 22 31 22 2c 0d 0a 22 43 6f 6e 74 65 6e 74 54 79 70 Data Ascii: e11{"wpq":"","Templates":{},"ListData":{ "Row" : [{"ID": "14","PermMask": "0x1003008031001","FSObjType": "0","HTML_x0020_File_x0020_Type": "","UniqueId": "{2F68EDC8-67B6-4346-89D2-B568CE8D4EB2}","ProgId": "","NoExecute": "1","ContentTyp
2024-04-25 23:59:09 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 72 74 7a 55 5a 66 66 63 63 47 52 46 45 52 36 64 50 73 38 4a 43 63 64 62 47 74 62 57 32 79 36 64 42 68 77 68 65 54 4b 5f 51 2d 6d 47 65 56 56 50 64 5c 75 30 30 32 66 69 74 65 6d 73 5c 75 30 30 32 66 30 31 35 34 37 42 55 46 47 49 35 56 55 43 37 4e 54 48 49 5a 42 59 54 55 56 56 4e 44 48 49 32 54 56 53 3f 76 65 72 73 69 6f 6e 3d 50 75 62 6c 69 73 68 65 64 22 2c 0d 0a 22 2e 66 69 6c 65 54 79 70 65 22 3a 20 22 70 64 66 22 2c 0d 0a 22 2e 68 61 73 54 68 75 6d 62 6e 61 69 6c 22 3a 20 22 54 72 75 65 22 2c 0d 0a 22 2e 68 61 73 56 69 64 65 6f 4d 61 6e 69 66 65 73 74 22 3a 20 22 46 61 6c 73 65 22 2c 0d 0a 22 2e 68 61 73 50 64 66 22 3a 20 22 46 61 6c 73 65 22 2c 0d 0a 22 2e 68 61 73 4f 66 66 69 63 65 50 72 65 76 69 65 77 22 3a 20 22 46 61 6c 73 65 22 Data Ascii: 2000rtzUZffccGRFER6dPs8JCcdbGtbW2y6dBhwheTK_Q-mGeVVPd\u002fitems\u002f01547BUFGI5VUC7NTHIZBYTUVVNDHI2TVS?version=Published",".fileType": "pdf",".hasThumbnail": "True",".hasVideoManifest": "False",".hasPdf": "False",".hasOfficePreview": "False"
2024-04-25 23:59:09 UTC	1449	IN	Data Raw: 35 61 32 0d 0a 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 64 61 6d 69 6f 6e 5f 72 69 76 65 72 62 72 6f 6f 6b 63 75 73 74 6f 6d 68 6f 6d 65 73 5f 63 6f 6d 2f 44 6f 63 75 6d 65 6e 74 73 2f 46 6f 72 6d 73 2f 74 65 6d 70 6c 61 74 65 2e 64 6f 74 78 22 2c 22 63 6f 6e 74 65 6e 74 54 79 70 65 49 64 22 3a 22 30 78 30 31 30 31 30 30 31 42 31 32 44 30 34 35 42 36 32 31 43 35 34 31 42 31 45 35 42 43 39 39 46 46 30 41 42 31 35 34 22 2c 22 69 63 6f 6e 55 72 6c 22 3a 22 69 63 64 6f 74 78 2e 70 6e 67 22 2c 22 64 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 44 6f 63 75 6d 65 6e 74 22 2c 22 43 6c 69 65 6e 74 46 6f 72 6d 43 75 73 74 6f 6d 46 6f 72 6d 61 74 74 65 72 22 3a 22 22 2c 22 46 69 65 6c 64 73 22 3a 22 43 6f 6e 74 65 6e 74 54 79 70 65 2c 53 65 6c 65 63 74 46 69 6c 65 Data Ascii: 5a2nt.com/personal/damion_riverbrookcustomhomes_com/Documents/Forms/template.dotx","contentTypeId":"0x0101001B12D045B621C541B1E5BC99FF0AB154","iconUrl":"icdotx.png","displayName":"Document","ClientFormCustomFormatter":"","Fields":"ContentType,SelectFile
2024-04-25 23:59:09 UTC	4136	IN	Data Raw: 31 30 32 30 0d 0a 69 65 77 3d 5c 22 54 52 55 45 5c 22 20 4d 6f 62 69 6c 65 44 65 66 61 75 6c 74 56 69 65 77 3d 5c 22 54 52 55 45 5c 22 20 54 79 70 65 3d 5c 22 48 54 4d 4c 5c 22 20 52 65 61 64 4f 6e 6c 79 3d 5c 22 54 52 55 45 5c 22 20 44 69 73 70 6c 61 79 4e 61 6d 65 3d 5c 22 41 6c 6c 5c 22 20 55 72 6c 3d 5c 22 2f 70 65 72 73 6f 6e 61 6c 2f 64 61 6d 69 6f 6e 5f 72 69 76 65 72 62 72 6f 6f 6b 63 75 73 74 6f 6d 68 6f 6d 65 73 5f 63 6f 6d 2f 44 6f 63 75 6d 65 6e 74 73 2f 46 6f 72 6d 73 2f 41 6c 6c 2e 61 73 70 78 5c 22 20 4c 65 76 65 6c 3d 5c 22 31 5c 22 20 42 61 73 65 56 69 65 77 49 44 3d 5c 22 35 31 5c 22 20 43 6f 6e 74 65 6e 74 54 79 70 65 49 44 3d 5c 22 30 78 5c 22 20 49 6d 61 67 65 55 72 6c 3d 5c 22 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 69 6d 61 67 65 73 Data Ascii: 1020iew=\"TRUE\" MobileDefaultView=\"TRUE\" Type=\"HTML\" ReadOnly=\"TRUE\" DisplayName=\"All\" Url=\"/personal/damion_riverbrookcustomhomes_com/Documents/Forms/All.aspx\" Level=\"1\" BaseViewID=\"51\" ContentTypeID=\"0x\" ImageUrl=\"/_layouts/15/images
2024-04-25 23:59:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:59:09 UTC	2126	OUT	GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1 Host: netorgft11294697-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://netorgft11294697-my.sharepoint.com/personal/damion_riverbrookcustomhomes_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom%2FNew%20Document%2Epdf&parent=%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%2Fnetorgft13782%2Dmy%2Esharepoint%2Ecom&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=
2024-04-25 23:59:09 UTC	1900	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Thu, 18 Apr 2024 04:03:45 GMT Accept-Ranges: bytes ETag: "80a654684591da1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzU4Mjg2MzdjMGY1YWM3YzM4OTE2OTkxNmExYWRmMTdjNDc4ODhmOTk2NDNkN2M2NmEwNjUxYjVhYjE3OGQxNTYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNTgyODYzN2MwZjVhYzdjMzg5MTY5OTE2YTFhZGYxN2M0Nzg4OGY5OTY0M2Q3YzY2YTA2NTFiNWFiMTc4ZDE1NiwxMzM1ODU2MzQzODAwMDAwMDAsMCwxMzM1ODY0OTUzODY0ODA4NDQsMC4wLjAuMCwyNTgsMDRiY2FiMzQtNjhmMy00NGE0LTk2NGQtY2U0YTY1MmE2ZDRjLCwsZjg5ZDIyYTEtMzBhOC01MDAwLTNjMmYtYjVmMGIzZmE4ZjQ3LGY4OWQyMmExLTMwYTgtNTAwMC0zYzJmLWI1ZjBiM2ZhOGY0NyxsNEU0UkxpVklrMmhCY2M3T29hdThBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE3NzEsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LFQ4NFNxL3c1Nk41NDVKU1BobDFBZXhKcWNxQzhPNGFYaXo3bDZCb0NrUVNLNGdudUhFUVBQaGhTYzBzbFluME9Mam9NRlFHcFRsYjFKK05YSnpyUzZjQjQ5dGEweU5seXpSNEJjbTVRZC91aUZWbE92L2UxOTJoVHhxWjRXZ1lPcVczM0hWTlVrM0lKakJpTkcrM3dTbWtZMjIyekpkdlVhVXVmMmEwM204bWNVTGtoTmRBeFZuTGw3aC8vejlTYkxncnB5S3lKekk4YTZWbVRrbDlGQm1tLzhoOUtUd2srK3o3NCtrWkYyM055UFdCeUlieVpvZ1ptbEpsUHNxd1Q3KzU0V0djR291OFBIYWU4VnFuOGtSeFBBZExXM1VUTGZLb2xVcVNpbmFoK3VtNE9UeDJPK25HU01DZUVWRVMvZXIxVDluZE83ODZzUXEyb1VpNG9VQT09PC9TUD4=; path=/; SameSite=None; Partitioned; secure; HttpOnly SPRequestDuration: 16 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: EBAD0F97FDE74AF5BF729E4069E72D3A Ref B: MIA301000102029 Ref C: 2024-04-25T23:59:09Z Date: Thu, 25 Apr 2024 23:59:09 GMT Connection: close
2024-04-25 23:59:09 UTC	234	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @
2024-04-25 23:59:09 UTC	7652	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:59:10 UTC	565	OUT	GET /personal/damion_riverbrookcustomhomes_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: netorgft11294697-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 23:59:10 UTC	2776	IN	HTTP/1.1 403 Forbidden Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/xml;charset=utf-8 Expires: Wed, 10 Apr 2024 23:59:10 GMT Last-Modified: Thu, 25 Apr 2024 23:59:10 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,2102272,88587,303,2097957,0,2102272 X-SharePointHealthScore: 3 X-Forms_Based_Auth_Required: https://netorgft11294697-my.sharepoint.com/_forms/default.aspx?ReturnUrl=/_layouts/15/error.aspx&Source=%2f_vti_bin%2fclient.svc%2fweb%2fGetListUsingPath(DecodedUrl%3d%40a1)%2fRenderListDataAsStream%3f%40a1%3d%2527%252Fpersonal%252Fdamion%255Friverbrookcustomhomes%255Fcom%252FDocuments%2527%26TryNewExperienceSingle%3dTRUE X-Forms_Based_Auth_Return_Url: https://netorgft11294697-my.sharepoint.com/_layouts/15/error.aspx X-MSDAVEXT_Error: 917656; Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically. DATASERVICEVERSION: 3.0 X-SubStatusCode: 16 X-AspNet-Version: 4.0.30319 X-IDCRL_AUTH_PARAMS_V1: IDCRL Type="BPOSIDCRL", EndPoint="/personal/damion_riverbrookcustomhomes_com/_vti_bin/idcrl.svc/", RootDomain="sharepoint.com", Policy="MBI" X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: fb9d22a1-3097-5000-361b-57f71aede9b1 request-id: fb9d22a1-3097-5000-361b-57f71aede9b1 MS-CV: oSKd+5cwAFA2G1f3Gu3psQ.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=04bcab34-68f3-44a4-964d-ce4a652a6d4c&destinationEndpoint=Edge-Prod-MIA30r5c&frontEnd=AFD&RemoteIP=102.129.152.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 72B2BF42CA724ACCB9396A066A8D02BA Ref B: MIA301000105051 Ref C: 2024-04-25T23:59:10Z Date: Thu, 25 Apr 2024 23:59:09 GMT Connection: close
2024-04-25 23:59:10 UTC	288	IN	Data Raw: 31 31 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 6d 3a 65 72 72 6f 72 20 78 6d 6c 6e 73 3a 6d 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 61 64 6f 2f 32 30 30 37 2f 30 38 2f 64 61 74 61 73 65 72 76 69 63 65 73 2f 6d 65 74 61 64 61 74 61 22 3e 3c 6d 3a 63 6f 64 65 3e 2d 32 31 34 37 30 32 34 38 39 31 2c 20 53 79 73 74 65 6d 2e 55 6e 61 75 74 68 6f 72 69 7a 65 64 41 63 63 65 73 73 45 78 63 65 70 74 69 6f 6e 3c 2f 6d 3a 63 6f 64 65 3e 3c 6d 3a 6d 65 73 73 61 67 65 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 41 74 74 65 6d 70 74 65 64 20 74 6f 20 70 65 72 66 6f 72 6d 20 61 6e 20 75 6e 61 75 74 68 6f 72 69 7a 65 64 20 6f Data Ascii: 119<?xml version="1.0" encoding="utf-8"?><m:error xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata"><m:code>-2147024891, System.UnauthorizedAccessException</m:code><m:message xml:lang="en-US">Attempted to perform an unauthorized o
2024-04-25 23:59:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-25 23:59:11 UTC	565	OUT	GET /personal/damion_riverbrookcustomhomes_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fdamion%5Friverbrookcustomhomes%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: netorgft11294697-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 23:59:11 UTC	2767	IN	HTTP/1.1 403 Forbidden Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/xml;charset=utf-8 Expires: Wed, 10 Apr 2024 23:59:11 GMT Last-Modified: Thu, 25 Apr 2024 23:59:11 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,525568,0,0,781628,0,221819 X-SharePointHealthScore: 0 X-Forms_Based_Auth_Required: https://netorgft11294697-my.sharepoint.com/_forms/default.aspx?ReturnUrl=/_layouts/15/error.aspx&Source=%2f_vti_bin%2fclient.svc%2fweb%2fGetListUsingPath(DecodedUrl%3d%40a1)%2fRenderListDataAsStream%3f%40a1%3d%2527%252Fpersonal%252Fdamion%255Friverbrookcustomhomes%255Fcom%252FDocuments%2527%26TryNewExperienceSingle%3dTRUE X-Forms_Based_Auth_Return_Url: https://netorgft11294697-my.sharepoint.com/_layouts/15/error.aspx X-MSDAVEXT_Error: 917656; Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically. DATASERVICEVERSION: 3.0 X-SubStatusCode: 16 X-AspNet-Version: 4.0.30319 X-IDCRL_AUTH_PARAMS_V1: IDCRL Type="BPOSIDCRL", EndPoint="/personal/damion_riverbrookcustomhomes_com/_vti_bin/idcrl.svc/", RootDomain="sharepoint.com", Policy="MBI" X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: fb9d22a1-30e1-5000-3c2f-bbc04eb42c1a request-id: fb9d22a1-30e1-5000-3c2f-bbc04eb42c1a MS-CV: oSKd++EwAFA8L7vATrQsGg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=04bcab34-68f3-44a4-964d-ce4a652a6d4c&destinationEndpoint=Edge-Prod-MIA30r5d&frontEnd=AFD&RemoteIP=102.129.152.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: B7D251381FF6408E8929FF9E51882E3F Ref B: MIA301000108045 Ref C: 2024-04-25T23:59:11Z Date: Thu, 25 Apr 2024 23:59:10 GMT Connection: close
2024-04-25 23:59:11 UTC	288	IN	Data Raw: 31 31 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 6d 3a 65 72 72 6f 72 20 78 6d 6c 6e 73 3a 6d 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 61 64 6f 2f 32 30 30 37 2f 30 38 2f 64 61 74 61 73 65 72 76 69 63 65 73 2f 6d 65 74 61 64 61 74 61 22 3e 3c 6d 3a 63 6f 64 65 3e 2d 32 31 34 37 30 32 34 38 39 31 2c 20 53 79 73 74 65 6d 2e 55 6e 61 75 74 68 6f 72 69 7a 65 64 41 63 63 65 73 73 45 78 63 65 70 74 69 6f 6e 3c 2f 6d 3a 63 6f 64 65 3e 3c 6d 3a 6d 65 73 73 61 67 65 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 41 74 74 65 6d 70 74 65 64 20 74 6f 20 70 65 72 66 6f 72 6d 20 61 6e 20 75 6e 61 75 74 68 6f 72 69 7a 65 64 20 6f Data Ascii: 119<?xml version="1.0" encoding="utf-8"?><m:error xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata"><m:code>-2147024891, System.UnauthorizedAccessException</m:code><m:message xml:lang="en-US">Attempted to perform an unauthorized o
2024-04-25 23:59:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0