Edit tour

Windows Analysis Report
https://1drv.ms:443/o/s!BH45_lCByG8fgpJ9gXzw1ulhl-qQkQ?e=yvEgUVzG9ES2PfoKuGIEfw&at=9

Overview

General Information

Sample URL:	https://1drv.ms:443/o/s!BH45_lCByG8fgpJ9gXzw1ulhl-qQkQ?e=yvEgUVzG9ES2PfoKuGIEfw&at=9
Analysis ID:	655224
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected HtmlPhish7

Antivirus detection for URL or domain

HTML body contains low number of good links

No HTML title found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2912 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://1drv.ms:443/o/s!BH45_lCByG8fgpJ9gXzw1ulhl-qQkQ?e=yvEgUVzG9ES2PfoKuGIEfw&at=9 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 5892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,9226078963959691659,2122446891408978629,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
38924.3.pages.csv	JoeSecurity_HtmlPhish_7	Yara detected HtmlPhish_7	Joe Security

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://onedrive.live.com/redir?resid=1F6FC88150FE397E%2135197&authkey=%21AoF88NbpYZfqkJE&page=View&wd=target%28Quick%20Notes.one%7C5d7d8a2d-e7c2-4f4c-8bbd-8958bcaab581%2FKinetre%20Inc%7C98a50910-a8d3-4348-9fa8-39684459cbc8%2F%29&wdorigin=NavigationUrl	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering
Source: https://verbena-woolly-clutch.glitch.me/toy.htm	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering
Source: https://onedrive.live.com/view.aspx?resid=1F6FC88150FE397E!35197&ithint=onenote&authkey=!AoF88NbpYZfqkJE	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Source: https://verbena-woolly-clutch.glitch.me/toy.htm	HTTP Parser: Number of links: 0
Source: https://verbena-woolly-clutch.glitch.me/toy.htm	HTTP Parser: Number of links: 0

Source: https://verbena-woolly-clutch.glitch.me/toy.htm	HTTP Parser: HTML title missing
Source: https://verbena-woolly-clutch.glitch.me/toy.htm	HTTP Parser: HTML title missing

Source: https://verbena-woolly-clutch.glitch.me/toy.htm	HTTP Parser: No <meta name="author".. found
Source: https://verbena-woolly-clutch.glitch.me/toy.htm	HTTP Parser: No <meta name="author".. found

Source: https://verbena-woolly-clutch.glitch.me/toy.htm	HTTP Parser: No <meta name="copyright".. found
Source: https://verbena-woolly-clutch.glitch.me/toy.htm	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic			Jump to behavior

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: global traffic	HTTP traffic detected: GET /o/s!BH45_lCByG8fgpJ9gXzw1ulhl-qQkQ?e=yvEgUVzG9ES2PfoKuGIEfw&at=9 HTTP/1.1Host: 1drv.msConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /o/GetImage.ashx?&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2F1F6FC88150FE397E%2135199&access_token=4wpOZfRrABcyXY4FJ0rgBz2V4z1L7vFQI10PJ%5FJNhBPOJfHXO%5FtxF5Xpte3oLpRjEw2j0n7aG1SmfzD1yTc5YUTbFU3TAQKAQRZpxLVZ%5FFGBPB17bmmVXmW8%2DXmT2g7MBJUd%5Fu4GMZmdWmWWaVsRfMEw&access_token_ttl=1658421761813&ObjectDataBlobId=%7B964778b5-12c8-4a0e-843d-7c7be63d40bc%7D%7B1%7D&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&build=16.0.15417.41022&waccluster=PNL1&wdwacuseragent=MSWACONSync&DataUrlEnabled=true HTTP/1.1Host: onenote.officeapps.live.comConnection: keep-alivehaep: 1X-WacFrontEnd: AM4PEPF00006B54X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030X-OfficeVersion: 16.0.15417.41022X-Key: 0XpfQFtLDrRv4UQM6v/1i8MVOATyWv5at1Jp1IgB+lw=,637922041630980967X-WacUserAgent: MSWACONSyncUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36X-Requested-With: XMLHttpRequestX-UserType: WOPIX-xhr: 1X-IsCoauthSession: trueX-WacCluster: PNL1Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-US&rs=en-US&hid=mnfhyzLCdkOTWRS%2FhUuNkA.0&wopisrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffolders%2F1F6FC88150FE397E!35197&wdo=2&sc=host%3D%26qt%3DDefault&wdp=7&uih=OneDrive&wdorigin=Unknown&wdhostclicktime=1656639760502&jsapi=1&jsapiver=v1&newsession=1&corrid=98985cba-b3dc-48e7-ae9f-7bbc12744030&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&sftc=1&readonly=1&wdredirectionreason=Force_SingleStepBootAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; xidseq=3; E=P:3UE7jbda2og=:JYdRP+n4EC7rku8IJu1vdQXlP/bseSGMwIgEJuQSe1c=:F; DcLcid=ui=1033&data=1033; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Source: global traffic	HTTP traffic detected: GET /o/App_Scripts/Acl/Acl1033.js HTTP/1.1Host: onenote.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-US&rs=en-US&hid=mnfhyzLCdkOTWRS%2FhUuNkA.0&wopisrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffolders%2F1F6FC88150FE397E!35197&wdo=2&sc=host%3D%26qt%3DDefault&wdp=7&uih=OneDrive&wdorigin=Unknown&wdhostclicktime=1656639760502&jsapi=1&jsapiver=v1&newsession=1&corrid=98985cba-b3dc-48e7-ae9f-7bbc12744030&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&sftc=1&readonly=1&wdredirectionreason=Force_SingleStepBootAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; xidseq=3; E=P:3UE7jbda2og=:JYdRP+n4EC7rku8IJu1vdQXlP/bseSGMwIgEJuQSe1c=:F; DcLcid=ui=1033&data=1033; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Source: global traffic	HTTP traffic detected: GET /me?partner=OneNoteOnline&version=10.21153.1&market=EN-US&wrapperId=suiteshell HTTP/1.1Host: amcdn.msftauth.netConnection: keep-aliveOrigin: https://onenote.officeapps.live.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.gif?DI=15347&wlxid=a94776a0-ee2a-458a-9854-05b95ebe50e6&reqid=002b179adb0&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRDE42AAC93A338%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AWac.view.F.U.%26PLT%3D17047%26IR%3D1%26EX%3D0%26L.h%3D1987%26L.bc%3D2132%26L.ac%3D2132%26L.f%3D2304%26L.sjs%3D16442%26L.ttg%3D10992%26C.st%3D1656639760502%26N.domIn%3D2304%26N.tcp%3D73%26N.req%3D1590%26N.resp%3D33%26N.navType%3D0%26N.redirectCount%3D0&r=0.26911081202565157&CtsSyncId=DA428D9AB9444AF192DAC7E040F48A7F&RedC=c.live.com&MXFR=210011B4A40D624F14CA0067A00D667C HTTP/1.1Host: c.bing.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /o/AddinServiceHandler.ashx?action=laststoreupdate&app=4&lc=EN-US&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffolders%2F1F6FC88150FE397E%2135197&access_token=4woSj1zDmD6jWmjHBN1xSC0lUNughcf1TW0FiCawbpLNwgYjE8pGOzrhQHssjdDTNK8Jn21CpZ1u3SbKIQsF%2DynTSOSveEi0XEaPSoAexqp7%2D12GLVzZG1WjgR%2DaZoeDjLwtY20zVT5%2DXDPGmWP14AVg&access_token_ttl=1658421761813 HTTP/1.1Host: onenote.officeapps.live.comConnection: keep-alivehaep: 1X-WacFrontEnd: AM4PEPF00006B54X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030X-OfficeVersion: 16.0.15417.41022X-Key: 0XpfQFtLDrRv4UQM6v/1i8MVOATyWv5at1Jp1IgB+lw=,637922041630980967X-WacUserAgent: MSWACONSyncUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36X-Requested-With: XMLHttpRequestX-UserType: WOPIX-xhr: 1X-IsCoauthSession: trueX-WacCluster: PNL1Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-US&rs=en-US&hid=mnfhyzLCdkOTWRS%2FhUuNkA.0&wopisrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffolders%2F1F6FC88150FE397E!35197&wdo=2&sc=host%3D%26qt%3DDefault&wdp=7&uih=OneDrive&wdorigin=Unknown&wdhostclicktime=1656639760502&jsapi=1&jsapiver=v1&newsession=1&corrid=98985cba-b3dc-48e7-ae9f-7bbc12744030&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&sftc=1&readonly=1&wdredirectionreason=Force_SingleStepBootAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; xidseq=3; E=P:3UE7jbda2og=:JYdRP+n4EC7rku8IJu1vdQXlP/bseSGMwIgEJuQSe1c=:F; DcLcid=ui=1033&data=1033; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; ShCLSessionID=1656639775607_0.6675230212797223; BP=l=SDX.Skydrive&FR=&ST=; MUID=210011B4A40D624F14CA0067A00D667C
Source: global traffic	HTTP traffic detected: GET /mydata/myprofile/expressionprofile/profilephoto:UserTileStatic,UserTileSmall/MeControlMediumUserTile?ck=1&ex=24&fofoff=1&sc=1656639779208 HTTP/1.1Host: storage.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onenote.officeapps.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; xidseq=3; E=P:3UE7jbda2og=:JYdRP+n4EC7rku8IJu1vdQXlP/bseSGMwIgEJuQSe1c=:F; BP=l=SDX.Skydrive&FR=&ST=; MUID=210011B4A40D624F14CA0067A00D667C
Source: global traffic	HTTP traffic detected: GET /o/error/error.html?aspxerrorpath=/o/OneNoteS2SHandler.ashx HTTP/1.1Host: onenote.officeapps.live.comConnection: keep-alivehaep: 1X-WacFrontEnd: AM4PEPF00006B54X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030X-OfficeVersion: 16.0.15417.41022X-Key: 0XpfQFtLDrRv4UQM6v/1i8MVOATyWv5at1Jp1IgB+lw=,637922041630980967X-WacUserAgent: MSWACONSyncUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36X-Requested-With: XMLHttpRequestX-UserType: WOPIX-xhr: 1X-IsCoauthSession: falseX-WacCluster: PNL1Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-US&rs=en-US&hid=mnfhyzLCdkOTWRS%2FhUuNkA.0&wopisrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffolders%2F1F6FC88150FE397E!35197&wdo=2&sc=host%3D%26qt%3DDefault&wdp=7&uih=OneDrive&wdorigin=Unknown&wdhostclicktime=1656639760502&jsapi=1&jsapiver=v1&newsession=1&corrid=98985cba-b3dc-48e7-ae9f-7bbc12744030&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&sftc=1&readonly=1&wdredirectionreason=Force_SingleStepBootAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; DcLcid=ui=1033&data=1033; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; ShCLSessionID=1656639775607_0.6675230212797223; BP=l=SDX.Skydrive&FR=&ST=; MUID=210011B4A40D624F14CA0067A00D667C; xidseq=4; E=P:tcNhmbda2og=:PJLCcxjKwQVUWFIETez3k69O9vOeDWpicKYwq8SBqKA=:F; wlidperf=latency=238
Source: global traffic	HTTP traffic detected: GET /toy.htm HTTP/1.1Host: verbena-woolly-clutch.glitch.meConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/hover.css HTTP/1.1Host: verbena-woolly-clutch.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://verbena-woolly-clutch.glitch.me/toy.htmAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://verbena-woolly-clutch.glitch.meUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://verbena-woolly-clutch.glitch.me/toy.htmAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://verbena-woolly-clutch.glitch.meUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://verbena-woolly-clutch.glitch.me/toy.htmAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://verbena-woolly-clutch.glitch.meUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://verbena-woolly-clutch.glitch.me/toy.htmAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/hover.css HTTP/1.1Host: verbena-woolly-clutch.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://verbena-woolly-clutch.glitch.me/toy.htmAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /toy.htm HTTP/1.1Host: verbena-woolly-clutch.glitch.meConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "49e28388e15f2554c9b456faf7eb2f27"If-Modified-Since: Tue, 28 Jun 2022 11:12:48 GMT
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: verbena-woolly-clutch.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://verbena-woolly-clutch.glitch.me/toy.htmAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /o/AppSettingsHandler.ashx?app=OneNote&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&build=16.0.15417.41022 HTTP/1.1Host: onenote.officeapps.live.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: /Origin: https://onedrive.live.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://onedrive.live.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/hover.css HTTP/1.1Host: verbena-woolly-clutch.glitch.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://verbena-woolly-clutch.glitch.me/toy.htmAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: Ruleset Data.0.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr, Ruleset Data.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenCache-Control: privateContent-Length: 1233Content-Type: text/htmlP3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"Set-Cookie: X-CorrelationId: 8c75f87c-e98a-45f3-a97f-6626d22dd69cX-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030Strict-Transport-Security: max-age=31536000Timing-Allow-Origin: *X-OfficeFE: AM4PEPF00006961X-OfficeVersion: 16.0.15417.41022X-OfficeCluster: PNL1X-OFFICEFD: AM4PEPF00006961X-Cache: CONFIG_NOCACHEX-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5X-MSEdge-Features: typeheadertest,afd_waccluster,afd_wacinfra4,afd_wacinfra5X-MSEdge-Ref: Ref A: 59A74E99FA8641E288D31293CEBB9B15 Ref B: AMS04EDGE2021 Ref C: 2022-06-30T16:42:58ZDate: Thu, 30 Jun 2022 16:42:58 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 30 Jun 2022 16:43:12 GMTContent-Length: 3672Connection: closeCache-Control: max-age=0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 30 Jun 2022 16:43:13 GMTContent-Length: 3672Connection: closeCache-Control: max-age=0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 30 Jun 2022 16:43:14 GMTContent-Length: 3672Connection: closeCache-Control: max-age=0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 30 Jun 2022 16:43:15 GMTContent-Length: 3672Connection: closeCache-Control: max-age=0

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	3 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\2912_2145922573\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\2912_2145922573\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
b-0016.b-msedge.net	13.107.6.171	true	false	unknown
gstaticadssl.l.google.com	142.251.36.227	true	false	high
accounts.google.com	142.251.36.205	true	false	high
dual-a-0001.a-msedge.net	204.79.197.200	true	false	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	high
maxcdn.bootstrapcdn.com	104.18.11.207	true	false	high
clients.l.google.com	142.251.36.238	true	false	high
i-db3p-cor006.api.p001.1drv.com	13.104.208.165	true	false	high
part-0032.t-0009.fbs1-t-msedge.net	13.107.219.60	true	false	unknown
1drv.ms	13.107.42.12	true	false	high
verbena-woolly-clutch.glitch.me	52.22.91.148	true	false	high
onenoteonlinesync.onenote.com	unknown	unknown	false	high
ka-f.fontawesome.com	unknown	unknown	false	high
kit.fontawesome.com	unknown	unknown	false	high
c.live.com	unknown	unknown	false	high
storage.live.com	unknown	unknown	false	high
ajax.aspnetcdn.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
code.jquery.com	unknown	unknown	false	high
onedrive.live.com	unknown	unknown	false	high
p.sfx.ms	unknown	unknown	false	high
amcdn.msftauth.net	unknown	unknown	false	unknown
spoprod-a.akamaihd.net	unknown	unknown	false	high
www.onenote.com	unknown	unknown	false	high
messaging.engagement.office.com	unknown	unknown	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://dns.google	633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 6b006fd1-2d16-41e3-af96-3f08c2d9df9a.tmp.1.dr, df65693d-31b6-4c80-b26d-d65c02a3e5be.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	false		high
https://onedrive.live.com/redir?resid=1F6FC88150FE397E	History Provider Cache.0.dr	false		high
https://onedrive.live.com/view.aspx?resid=1F6FC88150FE397E	History Provider Cache.0.dr	false		high
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://easylist.to/)	LICENSE.txt.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json.0.dr	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr	false		high
https://creativecommons.org/compatiblelicenses	LICENSE.txt.0.dr	false		high
https://www.google.com	633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	false		high
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://github.com/easylist)	LICENSE.txt.0.dr	false		high
https://creativecommons.org/.	LICENSE.txt.0.dr	false		high
https://accounts.google.com	633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	false		high
https://1drv.ms/o/s	History Provider Cache.0.dr	false		high
https://clients2.googleusercontent.com	633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	false		high
https://apis.google.com	633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	false		high
https://spoprod-a.akamaihd.net	633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www.google.com/	manifest.json.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	false		high
https://clients2.google.com	633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.0.dr	false		high

Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: History Provider Cache.0.dr	String found in binary or memory: https://1drv.ms/o/s
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr	String found in binary or memory: https://ajax.googleapis.com
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 6b006fd1-2d16-41e3-af96-3f08c2d9df9a.tmp.1.dr, df65693d-31b6-4c80-b26d-d65c02a3e5be.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	String found in binary or memory: https://dns.google
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: History Provider Cache.0.dr	String found in binary or memory: https://onedrive.live.com/redir?resid=1F6FC88150FE397E
Source: History Provider Cache.0.dr	String found in binary or memory: https://onedrive.live.com/view.aspx?resid=1F6FC88150FE397E
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr	String found in binary or memory: https://r2---sn-4g5lznlz.gvt1.com
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr	String found in binary or memory: https://spoprod-a.akamaihd.net
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr	String found in binary or memory: https://storage.googleapis.com
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 633358e7-c7f3-4f89-8d83-94ce757453a9.tmp.1.dr, 539f4c29-0538-49fc-90ee-d20ac32635ba.tmp.1.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://1drv.ms:443/o/s!BH45_lCByG8fgpJ9gXzw1ulhl-qQkQ?e=yvEgUVzG9ES2PfoKuGIEfw&at=9
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,9226078963959691659,2122446891408978629,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,9226078963959691659,2122446891408978629,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1944 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source	Detection	Scanner	Label	Link
https://onedrive.live.com/redir?resid=1F6FC88150FE397E%2135197&authkey=%21AoF88NbpYZfqkJE&page=View&wd=target%28Quick%20Notes.one%7C5d7d8a2d-e7c2-4f4c-8bbd-8958bcaab581%2FKinetre%20Inc%7C98a50910-a8d3-4348-9fa8-39684459cbc8%2F%29&wdorigin=NavigationUrl	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://verbena-woolly-clutch.glitch.me/toy.htm	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://onedrive.live.com/view.aspx?resid=1F6FC88150FE397E!35197&ithint=onenote&authkey=!AoF88NbpYZfqkJE	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://dns.google	0%	URL Reputation	safe
https://amcdn.msftauth.net/me?partner=OneNoteOnline&version=10.21153.1&market=EN-US&wrapperId=suiteshell	0%	Virustotal		Browse
https://amcdn.msftauth.net/me?partner=OneNoteOnline&version=10.21153.1&market=EN-US&wrapperId=suiteshell	0%	Avira URL Cloud	safe

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.219.60	part-0032.t-0009.fbs1-t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.200	dual-a-0001.a-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.36.205	accounts.google.com	United States	15169	GOOGLEUS	false
142.251.36.227	gstaticadssl.l.google.com	United States	15169	GOOGLEUS	false
13.107.6.171	b-0016.b-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.104.208.165	i-db3p-cor006.api.p001.1drv.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.22.91.148	verbena-woolly-clutch.glitch.me	United States	14618	AMAZON-AESUS	false
142.251.36.238	clients.l.google.com	United States	15169	GOOGLEUS	false
104.18.11.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
13.107.42.12	1drv.ms	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	655224
Start date and time: 30/06/202218:41:32	2022-06-30 18:41:32 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://1drv.ms:443/o/s!BH45_lCByG8fgpJ9gXzw1ulhl-qQkQ?e=yvEgUVzG9ES2PfoKuGIEfw&at=9
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@32/119@21/14
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Browse: https://verbena-woolly-clutch.glitch.me/toy.htm

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	451603
Entropy (8bit):	5.009711072558331
Encrypted:	false
SSDEEP:	12288:ZHfRTyGZ6lup8Cfrvq4JBPKh+FBlESBw4p6:NfOCzvRKhGvwJ
MD5:	A78AD14E77147E7DE3647E61964C0335
SHA1:	CECC3DD41F4CEA0192B24300C71E1911BD4FCE45
SHA-256:	0D6803758FF8F87081FAFD62E90F0950DFB2DD7991E9607FE76A8F92D0E893FA
SHA-512:	DDE24D5AD50D68FC91E9E325D31E66EF8F624B6BB3A07D14FFED1104D3AB5F4EF1D7969A5CDE0DFBB19CB31C506F7DE97AF67C2F244F7E7E8E10648EA8321101
Malicious:	false
Reputation:	low
Preview:	BDic.... ....6...."..Z..4g....6.2...{/...3...5....AF 1363.AF nm.AF pt.AF n1.AF p.AF tc.AF SM.AF M.AF S.AF MS.AF MNR.AF GDS.AF MNT.AF MH.AF MR.AF SZMR.AF MJ.AF MT.AF MY.AF MRZ.AF MN.AF MG.AF RM.AF N.AF MV.AF XM.AF DSM.AF SD.AF G.AF R.AF MNX.AF MRS.AF MD.AF MNRB.AF B.AF ZSMR.AF PM.AF SMNGJ.AF SMN.AF ZMR.AF SMGB.AF MZR.AF GM.AF SMR.AF SMDG.AF RMZ.AF ZM.AF MDG.AF MDT.AF SMNXT.AF SDY.AF LSDG.AF LGDS.AF GLDS.AF UY.AF U.AF DSGNX.AF GNDSX.AF DSG.AF Y.AF GS.AF IEMS.AF YP.AF ZGDRS.AF XGNVDS.AF UT.AF GNDS.AF GVDS.AF MYPS.AF XGNDS.AF TPRY.AF MDSG.AF ZGSDR.AF DYSG.AF PMYTNS.AF AGDS.AF DRZGS.AF PY.AF GSPMDY.AF EGVDS.AF SL.AF GNXDS.AF DSBG.AF IM.AF I.AF MDGS.AF SMY.AF DSGN.AF DSLG.AF GMDS.AF MDSBG.AF SGD.AF IY.AF P.AF DSMG.AF BLZGDRS.AF TR.AF AGSD.AF ZGBDRSL.AF PTRY.AF ASDGV.AF ASM.AF ICANGSD.AF ICAM.AF IKY.AF AMS.AF PMYTRS.AF BZGVDRS.AF SDRBZG.AF GVMDS.AF PSM.AF DGLS.AF GNVXDS.AF AGDSL.AF DGS.AF XDSGNV.AF BZGDRS.AF AM.AF AS.AF A.AF LDSG.AF AGVDS.AF SDG.AF LDSMG.AF EDSMG.AF EY.AF DRSMZG.AF PRYT.AF LZ

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 30, 2022 18:42:38.164534092 CEST	65358	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:42:38.168430090 CEST	49873	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:42:38.171451092 CEST	53802	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:42:38.185444117 CEST	53	49873	8.8.8.8	192.168.2.3
Jun 30, 2022 18:42:38.191809893 CEST	53	65358	8.8.8.8	192.168.2.3
Jun 30, 2022 18:42:38.196875095 CEST	53	53802	8.8.8.8	192.168.2.3
Jun 30, 2022 18:42:39.157346010 CEST	63548	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:42:41.987354040 CEST	61380	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:42:41.991329908 CEST	63146	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:42:43.303570032 CEST	58626	443	192.168.2.3	142.251.36.238
Jun 30, 2022 18:42:43.335694075 CEST	443	58626	142.251.36.238	192.168.2.3
Jun 30, 2022 18:42:43.338148117 CEST	58626	443	192.168.2.3	142.251.36.238
Jun 30, 2022 18:42:43.370574951 CEST	443	58626	142.251.36.238	192.168.2.3
Jun 30, 2022 18:42:43.370620012 CEST	443	58626	142.251.36.238	192.168.2.3
Jun 30, 2022 18:42:43.370657921 CEST	443	58626	142.251.36.238	192.168.2.3
Jun 30, 2022 18:42:43.370695114 CEST	443	58626	142.251.36.238	192.168.2.3
Jun 30, 2022 18:42:43.374321938 CEST	58626	443	192.168.2.3	142.251.36.238
Jun 30, 2022 18:42:43.375873089 CEST	58626	443	192.168.2.3	142.251.36.238
Jun 30, 2022 18:42:43.413094044 CEST	58626	443	192.168.2.3	142.251.36.238
Jun 30, 2022 18:42:43.413450956 CEST	58626	443	192.168.2.3	142.251.36.238
Jun 30, 2022 18:42:43.457186937 CEST	443	58626	142.251.36.238	192.168.2.3
Jun 30, 2022 18:42:43.459332943 CEST	443	58626	142.251.36.238	192.168.2.3
Jun 30, 2022 18:42:43.459487915 CEST	443	58626	142.251.36.238	192.168.2.3
Jun 30, 2022 18:42:43.469233990 CEST	58626	443	192.168.2.3	142.251.36.238
Jun 30, 2022 18:42:43.484523058 CEST	443	58626	142.251.36.238	192.168.2.3
Jun 30, 2022 18:42:43.485019922 CEST	443	58626	142.251.36.238	192.168.2.3
Jun 30, 2022 18:42:43.485053062 CEST	443	58626	142.251.36.238	192.168.2.3
Jun 30, 2022 18:42:43.485728979 CEST	58626	443	192.168.2.3	142.251.36.238
Jun 30, 2022 18:42:43.511033058 CEST	58626	443	192.168.2.3	142.251.36.238
Jun 30, 2022 18:42:43.587486029 CEST	52810	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:42:51.708564043 CEST	64996	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:42:57.199040890 CEST	63861	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:42:57.697922945 CEST	49723	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:42:58.218815088 CEST	52581	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:42:59.027538061 CEST	56639	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:42:59.199142933 CEST	50450	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:42:59.496953011 CEST	62724	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:43:11.410109997 CEST	61877	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:43:11.431724072 CEST	53	61877	8.8.8.8	192.168.2.3
Jun 30, 2022 18:43:12.546941042 CEST	64412	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:43:12.548346043 CEST	51779	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:43:12.550493956 CEST	54205	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:43:12.567298889 CEST	53	51779	8.8.8.8	192.168.2.3
Jun 30, 2022 18:43:12.853821039 CEST	58497	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:43:12.874304056 CEST	53	58497	8.8.8.8	192.168.2.3
Jun 30, 2022 18:43:12.920520067 CEST	62701	53	192.168.2.3	8.8.8.8
Jun 30, 2022 18:44:02.248027086 CEST	51994	53	192.168.2.3	8.8.8.8

Timestamp	kBytes transferred	Direction	Data
2022-06-30 16:42:39 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-30 16:42:39 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-06-30 16:42:39 UTC	4	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 30 Jun 2022 16:42:39 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-ddEZLQE_6QAY_1BUIonZIQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-ddEZLQE_6QAY_1BUIonZIQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-06-30 16:42:39 UTC	5	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-06-30 16:42:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-06-30 16:42:39 UTC	0	OUT	GET /o/s!BH45_lCByG8fgpJ9gXzw1ulhl-qQkQ?e=yvEgUVzG9ES2PfoKuGIEfw&at=9 HTTP/1.1 Host: 1drv.ms Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-30 16:42:39 UTC	3	IN	HTTP/1.1 301 Moved Permanently Location: https://onedrive.live.com/redir?resid=1F6FC88150FE397E!35197&authkey=!AoF88NbpYZfqkJE&ithint=onenote&e=yvEgUVzG9ES2PfoKuGIEfw&at=9 X-MSNSERVER: AM4PPF2F3C280BE Strict-Transport-Security: max-age=31536000; includeSubDomains MS-CV: BTY3lSiBDE26i9K3ynfdwg.0 X-AsmVersion: UNKNOWN; 19.946.620.2003 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 6727003FAD084753A3A3A3D81E131661 Ref B: FRAEDGE1312 Ref C: 2022-06-30T16:42:39Z Date: Thu, 30 Jun 2022 16:42:38 GMT Connection: close Content-Length: 0

Timestamp	kBytes transferred	Direction	Data
2022-06-30 16:42:44 UTC	278	OUT	POST /o/RemoteUls.ashx?build=16.0.15417.41022&waccluster=PNL1 HTTP/1.1 Host: onenote.officeapps.live.com Connection: keep-alive Content-Length: 0 X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 X-BrowserUlsBeacon: [{"Index":3,"MsSinceStart":862,"Value":"Get cells response received:200","Type":"BootLogs"}] Accept: / Origin: https://onenote.officeapps.live.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-US&rs=en-US&hid=mnfhyzLCdkOTWRS%2FhUuNkA.0&wopisrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffolders%2F1F6FC88150FE397E!35197&wdo=2&sc=host%3D%26qt%3DDefault&wdp=7&uih=OneDrive&wdorigin=Unknown&wdhostclicktime=1656639760502&jsapi=1&jsapiver=v1&newsession=1&corrid=98985cba-b3dc-48e7-ae9f-7bbc12744030&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&sftc=1&readonly=1&wdredirectionreason=Force_SingleStepBoot Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; xidseq=3; E=P:3UE7jbda2og=:JYdRP+n4EC7rku8IJu1vdQXlP/bseSGMwIgEJuQSe1c=:F; DcLcid=ui=1033&data=1033; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2022-06-30 16:42:44 UTC	279	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: X-CorrelationId: 36b96b5f-04a3-48f3-912c-635117821318 X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030 Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: * X-OfficeFE: AM4PEPF00006958 X-OfficeVersion: 16.0.15417.41022 X-OfficeCluster: PNL1 Access-Control-Allow-Origin: https://onenote.officeapps.live.com Access-Control-Expose-Headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-OFFICEFD: AM4PEPF00006958 X-Cache: CONFIG_NOCACHE X-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5 X-MSEdge-Features: typeheadertest,afd_waccluster,afd_wacinfra4,afd_wacinfra5 X-MSEdge-Ref: Ref A: 3BEC2611E3C14FBB8D94EEE1C47FC390 Ref B: AMS04EDGE2805 Ref C: 2022-06-30T16:42:44Z Date: Thu, 30 Jun 2022 16:42:43 GMT Connection: close Content-Length: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://1drv.ms:443/o/s!BH45_lCByG8fgpJ9gXzw1ulhl-qQkQ?e=yvEgUVzG9ES2PfoKuGIEfw&at=9

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic

C:\Users\user\AppData\Local\Google\Chrome\User Data\086dda27-f745-44b8-94ab-ba8b6ac61b32.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\30b0081c-bdb9-4e20-9da2-b9d71b90d53c.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5ecad9ab-3e42-45be-b945-e911d4b6f84f.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\6c6a0a2f-a887-4066-b512-65cb3e77fc9d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\731254e2-7898-4d5d-bb22-6d2909cf2801.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\94aae6bc-374c-4115-a4c7-edd0075d992b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1df751d8-d58f-4cc2-91af-afc1f2a0a7af.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\1f1d84e3-6e92-4d48-84d6-b3daf31d9a84.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\26c64c90-d440-4d06-992f-05567e6e720a.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\342d06f8-becd-4196-ae18-f29cd9961fb9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\539f4c29-0538-49fc-90ee-d20ac32635ba.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\62a275ec-5489-4b19-9458-c013e7b1974b.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\633358e7-c7f3-4f89-8d83-94ce757453a9.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\63b8ac16-cd70-47d8-9cc4-a2966b7e5414.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9e2b98f2-a0b2-49bb-a0bb-da60df2d9536.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_onenote.officeapps.live.com_0.indexeddb.leveldb\000001.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_onenote.officeapps.live.com_0.indexeddb.leveldb\CURRENT (copy)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_onenote.officeapps.live.com_0.indexeddb.leveldb\MANIFEST-000001

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

Windows Analysis Report
https://1drv.ms:443/o/s!BH45_lCByG8fgpJ9gXzw1ulhl-qQkQ?e=yvEgUVzG9ES2PfoKuGIEfw&at=9

Timestamp	kBytes transferred	Direction	Data
2022-06-30 16:42:45 UTC	281	OUT	POST /o/RemoteUls.ashx?build=16.0.15417.41022&waccluster=PNL1 HTTP/1.1 Host: onenote.officeapps.live.com Connection: keep-alive Content-Length: 0 X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 X-BrowserUlsBeacon: [{"Index":4,"MsSinceStart":868,"Value":"Launching FastView from entry point WacBootGetCells","Type":"BootLogs"},{"Index":5,"MsSinceStart":871,"Value":"RecordContentDisplayed","Type":"BootPhaseCompleted"}] Accept: / Origin: https://onenote.officeapps.live.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-US&rs=en-US&hid=mnfhyzLCdkOTWRS%2FhUuNkA.0&wopisrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffolders%2F1F6FC88150FE397E!35197&wdo=2&sc=host%3D%26qt%3DDefault&wdp=7&uih=OneDrive&wdorigin=Unknown&wdhostclicktime=1656639760502&jsapi=1&jsapiver=v1&newsession=1&corrid=98985cba-b3dc-48e7-ae9f-7bbc12744030&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&sftc=1&readonly=1&wdredirectionreason=Force_SingleStepBoot Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; xidseq=3; E=P:3UE7jbda2og=:JYdRP+n4EC7rku8IJu1vdQXlP/bseSGMwIgEJuQSe1c=:F; DcLcid=ui=1033&data=1033; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2022-06-30 16:42:45 UTC	282	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: X-CorrelationId: 65d7507a-34f9-416c-a750-607ee768d286 X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030 Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: * X-OfficeFE: AM4PEPF0000695B X-OfficeVersion: 16.0.15417.41022 X-OfficeCluster: PNL1 Access-Control-Allow-Origin: https://onenote.officeapps.live.com Access-Control-Expose-Headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-OFFICEFD: AM4PEPF0000695B X-Cache: CONFIG_NOCACHE X-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5 X-MSEdge-Features: typeheadertest,afd_waccluster,afd_pptcapacity_control,afd_wacinfra4,afd_wacinfra5 X-MSEdge-Ref: Ref A: C75335508F5542B79C9E32589EB09EE7 Ref B: AM3EDGE0712 Ref C: 2022-06-30T16:42:45Z Date: Thu, 30 Jun 2022 16:42:44 GMT Connection: close Content-Length: 0

Timestamp	kBytes transferred	Direction	Data
2022-06-30 16:42:45 UTC	283	OUT	POST /o/OneNoteS2SHandler.ashx?action=educationuser&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffolders%2F1F6FC88150FE397E%2135197&access_token=4woSj1zDmD6jWmjHBN1xSC0lUNughcf1TW0FiCawbpLNwgYjE8pGOzrhQHssjdDTNK8Jn21CpZ1u3SbKIQsF%2DynTSOSveEi0XEaPSoAexqp7%2D12GLVzZG1WjgR%2DaZoeDjLwtY20zVT5%2DXDPGmWP14AVg&access_token_ttl=1658421761813 HTTP/1.1 Host: onenote.officeapps.live.com Connection: keep-alive Content-Length: 0 haep: 1 X-WacFrontEnd: AM4PEPF00006B54 X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030 X-OfficeVersion: 16.0.15417.41022 X-Key: 0XpfQFtLDrRv4UQM6v/1i8MVOATyWv5at1Jp1IgB+lw=,637922041630980967 X-WacUserAgent: MSWACONSync Content-Type: application/x-www-form-urlencoded; charset=UTF-8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 X-Requested-With: XMLHttpRequest X-UserType: WOPI X-xhr: 1 X-IsCoauthSession: false X-WacCluster: PNL1 Accept: / Origin: https://onenote.officeapps.live.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-US&rs=en-US&hid=mnfhyzLCdkOTWRS%2FhUuNkA.0&wopisrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffolders%2F1F6FC88150FE397E!35197&wdo=2&sc=host%3D%26qt%3DDefault&wdp=7&uih=OneDrive&wdorigin=Unknown&wdhostclicktime=1656639760502&jsapi=1&jsapiver=v1&newsession=1&corrid=98985cba-b3dc-48e7-ae9f-7bbc12744030&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&sftc=1&readonly=1&wdredirectionreason=Force_SingleStepBoot Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; xidseq=3; E=P:3UE7jbda2og=:JYdRP+n4EC7rku8IJu1vdQXlP/bseSGMwIgEJuQSe1c=:F; DcLcid=ui=1033&data=1033; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2022-06-30 16:43:04 UTC	465	IN	HTTP/1.1 302 Found Content-Length: 176 Content-Type: text/html; charset=utf-8 Location: /o/error/error.html?aspxerrorpath=/o/OneNoteS2SHandler.ashx P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: X-CorrelationId: 984887d4-7c38-4262-8056-bf72b9b5fe98 X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030 Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: * X-OfficeFE: AM4PEPF00006B52 X-OfficeVersion: 16.0.15417.41022 X-OfficeCluster: PNL1 X-OFFICEFD: AM4PEPF00006B52 X-Cache: CONFIG_NOCACHE X-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5 X-MSEdge-Features: typeheadertest,afd_waccluster,afd_visioslice_control,afd_wacinfra4,afd_wacinfra5 X-MSEdge-Ref: Ref A: 27A8A0749550490D8C3EB04AD86C79C0 Ref B: AMS04EDGE2715 Ref C: 2022-06-30T16:42:45Z Date: Thu, 30 Jun 2022 16:43:04 GMT Connection: close
2022-06-30 16:43:04 UTC	465	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 2f 6f 2f 65 72 72 6f 72 2f 65 72 72 6f 72 2e 68 74 6d 6c 3f 61 73 70 78 65 72 72 6f 72 70 61 74 68 3d 2f 6f 2f 4f 6e 65 4e 6f 74 65 53 32 53 48 61 6e 64 6c 65 72 2e 61 73 68 78 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="/o/error/error.html?aspxerrorpath=/o/OneNoteS2SHandler.ashx">here</a>.</h2></body></html>

Timestamp	kBytes transferred	Direction	Data
2022-06-30 16:42:51 UTC	288	OUT	GET /o/GetImage.ashx?&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2F1F6FC88150FE397E%2135199&access_token=4wpOZfRrABcyXY4FJ0rgBz2V4z1L7vFQI10PJ%5FJNhBPOJfHXO%5FtxF5Xpte3oLpRjEw2j0n7aG1SmfzD1yTc5YUTbFU3TAQKAQRZpxLVZ%5FFGBPB17bmmVXmW8%2DXmT2g7MBJUd%5Fu4GMZmdWmWWaVsRfMEw&access_token_ttl=1658421761813&ObjectDataBlobId=%7B964778b5-12c8-4a0e-843d-7c7be63d40bc%7D%7B1%7D&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&build=16.0.15417.41022&waccluster=PNL1&wdwacuseragent=MSWACONSync&DataUrlEnabled=true HTTP/1.1 Host: onenote.officeapps.live.com Connection: keep-alive haep: 1 X-WacFrontEnd: AM4PEPF00006B54 X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030 X-OfficeVersion: 16.0.15417.41022 X-Key: 0XpfQFtLDrRv4UQM6v/1i8MVOATyWv5at1Jp1IgB+lw=,637922041630980967 X-WacUserAgent: MSWACONSync User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 X-Requested-With: XMLHttpRequest X-UserType: WOPI X-xhr: 1 X-IsCoauthSession: true X-WacCluster: PNL1 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-US&rs=en-US&hid=mnfhyzLCdkOTWRS%2FhUuNkA.0&wopisrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffolders%2F1F6FC88150FE397E!35197&wdo=2&sc=host%3D%26qt%3DDefault&wdp=7&uih=OneDrive&wdorigin=Unknown&wdhostclicktime=1656639760502&jsapi=1&jsapiver=v1&newsession=1&corrid=98985cba-b3dc-48e7-ae9f-7bbc12744030&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&sftc=1&readonly=1&wdredirectionreason=Force_SingleStepBoot Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; xidseq=3; E=P:3UE7jbda2og=:JYdRP+n4EC7rku8IJu1vdQXlP/bseSGMwIgEJuQSe1c=:F; DcLcid=ui=1033&data=1033; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2022-06-30 16:43:10 UTC	509	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 14103 Content-Type: text/plain; charset=utf-8 Expires: Fri, 30 Jun 2023 16:43:10 GMT ETag: "WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2F1F6FC88150FE397E%2135199&access_token=4wpOZfRrABcyXY4FJ0rgBz2V4z1L7vFQI10PJ%5FJNhBPOJfHXO%5FtxF5Xpte3oLpRjEw2j0n7aG1SmfzD1yTc5YUTbFU3TAQKAQRZpxLVZ%5FFGBPB17bmmVXmW8%2DXmT2g7MBJUd%5Fu4GMZmdWmWWaVsRfMEw&access_token_ttl=1658421761813{964778b5-12c8-4a0e-843d-7c7be63d40bc}{1}" P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: X-CorrelationId: 8e231bff-471c-4b24-ac25-237f1e0f27bc X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030 Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: * X-OfficeFE: AM4PEPF00006B55 X-OfficeVersion: 16.0.15417.41022 X-OfficeCluster: PNL1 X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-OFFICEFD: AM4PEPF00006B55 X-Cache: CONFIG_NOCACHE X-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5 X-MSEdge-Features: typeheadertest,afd_waccluster,afd_pptcapacity,afd_wacinfra4,afd_wacinfra5 X-MSEdge-Ref: Ref A: 948FE2508AE14D3D8D006E55C53ACC94 Ref B: AMS04EDGE2718 Ref C: 2022-06-30T16:42:51Z Date: Thu, 30 Jun 2022 16:43:09 GMT Connection: close
2022-06-30 16:43:10 UTC	510	IN	Data Raw: 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 2f 39 6a 2f 34 41 41 51 53 6b 5a 4a 52 67 41 42 41 51 45 41 59 41 42 67 41 41 44 2f 32 77 42 44 41 41 4d 43 41 67 4d 43 41 67 4d 44 41 77 4d 45 41 77 4d 45 42 51 67 46 42 51 51 45 42 51 6f 48 42 77 59 49 44 41 6f 4d 44 41 73 4b 43 77 73 4e 44 68 49 51 44 51 34 52 44 67 73 4c 45 42 59 51 45 52 4d 55 46 52 55 56 44 41 38 58 47 42 59 55 47 42 49 55 46 52 54 2f 32 77 42 44 41 51 4d 45 42 41 55 45 42 51 6b 46 42 51 6b 55 44 51 73 4e 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 54 2f 77 41 41 52 43 41 44 68 41 4f 45 44 41 53 49 41 41 68 45 42 Data Ascii: data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEBQoHBwYIDAoMDAsKCwsNDhIQDQ4RDgsLEBYQERMUFRUVDA8XGBYUGBIUFRT/2wBDAQMEBAUEBQkFBQkUDQsNFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBT/wAARCADhAOEDASIAAhEB
2022-06-30 16:43:10 UTC	511	IN	Data Raw: 4e 58 69 37 78 4a 4e 34 78 38 55 61 31 72 4e 31 4c 35 74 31 66 33 4d 30 7a 66 56 6e 33 62 66 2f 41 42 37 62 2f 77 41 42 72 78 63 30 78 63 73 4e 43 4d 49 66 61 50 31 62 77 39 34 66 77 2b 63 34 79 72 69 4d 58 48 6d 68 53 35 66 64 2f 6d 6b 2f 68 76 35 61 4d 69 31 7a 78 4a 71 76 69 36 2b 6e 76 64 57 31 47 62 55 4c 36 54 37 38 30 31 79 58 50 36 2f 64 58 2f 5a 72 4f 70 31 46 66 46 50 58 56 6e 39 57 30 36 63 4b 56 4e 55 36 61 73 68 74 46 4f 6f 70 47 6f 32 69 6e 55 55 41 4e 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 44 70 2f 68 4c 38 66 64 64 2b 41 66 78 45 47 72 61 56 4e 39 70 30 75 66 79 30 76 74 4d 64 39 73 4d 38 58 2f 41 4c 4b 36 2f 77 41 50 39 33 2f 64 33 4c 58 36 6e 2f 44 48 34 71 36 46 38 57 76 42 31 6a 34 6b 30 43 37 45 74 6e 63 66 49 38 5a 47 4a 4c 64 Data Ascii: NXi7xJN4x8Ua1rN1L5t1f3M0zfVn3bf/AB7b/wABrxc0xcsNCMIfaP1bw94fw+c4yriMXHmhS5fd/mk/hv5aMi1zxJqvi6+nvdW1GbUL6T7801yXP6/dX/ZrOp1FfFPXVn9W06cKVNU6ashtFOopGo2inUUANooooAKKKKACiiigDp/hL8fdd+AfxEGraVN9p0ufy0vtMd9sM8X/ALK6/wAP93/d3LX6n/DH4q6F8WvB1j4k0C7EtncfI8ZGJLd
2022-06-30 16:43:10 UTC	519	IN	Data Raw: 4f 41 55 55 55 55 41 46 46 46 46 41 46 44 56 2f 2b 51 62 66 66 39 63 6d 2f 77 44 51 61 2f 44 46 37 36 48 37 52 2f 72 66 34 2f 38 41 32 61 76 33 4e 31 62 2f 41 4a 42 74 39 2f 31 78 62 2f 30 47 76 77 59 6b 2f 77 43 57 2f 77 44 77 4b 76 6b 4f 49 50 38 41 6c 31 38 2f 30 50 36 46 38 4a 36 6e 4a 48 47 2f 39 75 66 2b 33 47 76 39 75 67 2f 35 36 30 66 62 6f 50 38 41 6e 72 57 54 52 58 79 4a 2b 2f 38 41 74 35 6d 74 39 75 67 2f 35 36 30 66 62 6f 50 2b 65 74 5a 4e 4e 6f 44 36 31 49 32 50 74 30 48 2f 41 44 31 6f 2b 33 51 66 38 39 61 78 36 4b 42 2f 57 57 62 48 32 36 44 2f 41 4a 36 30 66 62 6f 50 2b 65 74 59 39 4f 6f 44 36 31 49 31 76 74 30 48 2f 50 57 6a 37 64 42 2f 7a 31 72 48 6f 6f 44 36 77 7a 59 2b 33 51 2f 38 39 66 38 41 30 4b 6a 37 64 44 2f 7a 31 2f 38 41 51 71 78 Data Ascii: OAUUUUAFFFFAFDV/+Qbff9cm/wDQa/DF76H7R/rf4/8A2av3N1b/AJBt9/1xb/0GvwYk/wCW/wDwKvkOIP8Al18/0P6F8J6nJHG/9uf+3Gv9ug/560fboP8AnrWTRXyJ+/8At5mt9ug/560fboP+etZNNoD61I2Pt0H/AD1o+3Qf89ax6KB/WWbH26D/AJ60fboP+etY9OoD61I1vt0H/PWj7dB/z1rHooD6wzY+3Q/89f8A0Kj7dD/z1/8AQqx

Timestamp	kBytes transferred	Direction	Data
2022-06-30 16:42:52 UTC	292	OUT	POST /o/RemoteTelemetry.ashx HTTP/1.1 Host: onenote.officeapps.live.com Connection: keep-alive Content-Length: 125 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://onedrive.live.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://onedrive.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; xidseq=3; E=P:3UE7jbda2og=:JYdRP+n4EC7rku8IJu1vdQXlP/bseSGMwIgEJuQSe1c=:F; DcLcid=ui=1033&data=1033; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2022-06-30 16:42:52 UTC	293	OUT	Data Raw: 7b 22 74 79 70 65 22 3a 22 4a 53 41 50 49 5f 53 54 41 54 45 22 2c 22 70 61 79 6c 6f 61 64 4a 73 6f 6e 22 3a 22 7b 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 5c 22 3a 5c 22 4f 6e 65 4e 6f 74 65 5c 22 2c 5c 22 62 75 69 6c 64 5c 22 3a 5c 22 31 36 2e 30 2e 31 35 34 31 37 2e 34 31 30 32 32 5c 22 2c 5c 22 73 74 61 74 65 5c 22 3a 5c 22 62 6f 6f 74 53 75 63 63 65 73 73 5c 22 7d 22 7d Data Ascii: {"type":"JSAPI_STATE","payloadJson":"{\"application\":\"OneNote\",\"build\":\"16.0.15417.41022\",\"state\":\"bootSuccess\"}"}
2022-06-30 16:42:52 UTC	293	IN	HTTP/1.1 200 OK Cache-Control: private P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: X-CorrelationId: 34db0931-5f9d-4adb-ba35-97c8b4b54e0c X-UserSessionId: 34db0931-5f9d-4adb-ba35-97c8b4b54e0c Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: * X-OfficeFE: AM4PEPF0000695C X-OfficeVersion: 16.0.15417.41022 X-OfficeCluster: PNL1 Access-Control-Allow-Origin: https://onedrive.live.com X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-OFFICEFD: AM4PEPF0000695C X-Cache: CONFIG_NOCACHE X-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5 X-MSEdge-Features: typeheadertest,afd_waccluster,afd_powerpointslice,afd_wacinfra4,afd_wacinfra5 X-MSEdge-Ref: Ref A: CB26FE7EBDAD489887683DE9E4F97714 Ref B: AMS04EDGE2806 Ref C: 2022-06-30T16:42:52Z Date: Thu, 30 Jun 2022 16:42:52 GMT Connection: close Content-Length: 0

Timestamp	kBytes transferred	Direction	Data
2022-06-30 16:42:53 UTC	294	OUT	POST /o/RemoteUls.ashx?build=16.0.15417.41022&waccluster=PNL1 HTTP/1.1 Host: onenote.officeapps.live.com Connection: keep-alive Content-Length: 15479 X-WacFrontEnd: AM4PEPF00006B54 X-OfficeVersion: 16.0.15417.41022 X-Key: 0XpfQFtLDrRv4UQM6v/1i8MVOATyWv5at1Jp1IgB+lw=,637922041630980967 X-WacUserAgent: MSWACONSync X-bULS-SuppressionETag: CA78EF8008219FD41B3BEECBDC5469C32D39C9D9 X-AccessTokenTtl: 1658421761813 X-Requested-With: XMLHttpRequest X-xhr: 1 haep: 1 X-AccessToken: 4woSj1zDmD6jWmjHBN1xSC0lUNughcf1TW0FiCawbpLNwgYjE8pGOzrhQHssjdDTNK8Jn21CpZ1u3SbKIQsF-ynTSOSveEi0XEaPSoAexqp7-12GLVzZG1WjgR-aZoeDjLwtY20zVT5-XDPGmWP14AVg X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-UserType: WOPI X-IsCoauthSession: true X-WacCluster: PNL1 Accept: / Origin: https://onenote.officeapps.live.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-US&rs=en-US&hid=mnfhyzLCdkOTWRS%2FhUuNkA.0&wopisrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffolders%2F1F6FC88150FE397E!35197&wdo=2&sc=host%3D%26qt%3DDefault&wdp=7&uih=OneDrive&wdorigin=Unknown&wdhostclicktime=1656639760502&jsapi=1&jsapiver=v1&newsession=1&corrid=98985cba-b3dc-48e7-ae9f-7bbc12744030&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&sftc=1&readonly=1&wdredirectionreason=Force_SingleStepBoot Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; xidseq=3; E=P:3UE7jbda2og=:JYdRP+n4EC7rku8IJu1vdQXlP/bseSGMwIgEJuQSe1c=:F; DcLcid=ui=1033&data=1033; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2022-06-30 16:42:53 UTC	296	OUT	Data Raw: 7b 22 54 22 3a 31 36 35 36 36 33 39 37 36 35 39 36 32 2c 22 4c 22 3a 5b 7b 22 47 22 3a 32 30 30 32 35 36 37 39 2c 22 54 22 3a 2d 33 32 32 2c 22 4d 22 3a 22 53 65 74 41 70 70 49 6e 69 74 69 61 6c 69 7a 61 74 69 6f 6e 53 74 61 74 75 73 3a 20 61 70 70 43 74 6f 72 53 74 61 72 74 69 6e 67 22 2c 22 43 22 3a 33 30 36 2c 22 44 22 3a 35 30 7d 2c 7b 22 47 22 3a 35 39 32 34 38 37 38 39 32 2c 22 54 22 3a 2d 32 35 33 2c 22 4d 22 3a 22 49 73 48 6f 73 74 46 72 61 6d 65 54 72 75 73 74 65 64 3a 32 22 2c 22 43 22 3a 33 30 36 2c 22 44 22 3a 35 30 7d 2c 7b 22 47 22 3a 33 39 30 38 39 31 31 33 2c 22 54 22 3a 2d 32 34 36 2c 22 4d 22 3a 22 53 53 45 44 3a 73 74 61 72 74 73 65 73 73 69 6f 6e 20 69 6e 66 6f 20 73 65 6e 74 20 74 6f 20 4f 74 65 6c 22 2c 22 43 22 3a 33 30 36 2c 22 44 Data Ascii: {"T":1656639765962,"L":[{"G":20025679,"T":-322,"M":"SetAppInitializationStatus: appCtorStarting","C":306,"D":50},{"G":592487892,"T":-253,"M":"IsHostFrameTrusted:2","C":306,"D":50},{"G":39089113,"T":-246,"M":"SSED:startsession info sent to Otel","C":306,"D
2022-06-30 16:42:53 UTC	311	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: X-CorrelationId: 5d61ba41-3754-446c-9c60-aed51533a092 X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030 Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: * X-OfficeFE: AM4PEPF00006021 X-OfficeVersion: 16.0.15417.41022 X-OfficeCluster: PNL1 Access-Control-Allow-Origin: https://onenote.officeapps.live.com Access-Control-Expose-Headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags Cross-Origin-Resource-Policy: cross-origin X-bULS-SuppressionETag: CA78EF8008219FD41B3BEECBDC5469C32D39C9D9 X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-OFFICEFD: AM4PEPF00006021 X-Cache: CONFIG_NOCACHE X-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5 X-MSEdge-Features: typeheadertest,afd_waccluster,afd_visioslice,afd_wacinfra4,afd_wacinfra5 X-MSEdge-Ref: Ref A: 3327F7E3739D4CD0A8C6327764CE0AB0 Ref B: AMS04EDGE2911 Ref C: 2022-06-30T16:42:53Z Date: Thu, 30 Jun 2022 16:42:52 GMT Connection: close Content-Length: 0

Timestamp	kBytes transferred	Direction	Data
2022-06-30 16:42:53 UTC	313	OUT	POST /o/RemoteUls.ashx?usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&officeserverversion=16.0.15417.41022 HTTP/1.1 Host: onenote.officeapps.live.com Connection: keep-alive Content-Length: 4871 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://onedrive.live.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://onedrive.live.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; xidseq=3; E=P:3UE7jbda2og=:JYdRP+n4EC7rku8IJu1vdQXlP/bseSGMwIgEJuQSe1c=:F; DcLcid=ui=1033&data=1033; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2022-06-30 16:42:53 UTC	313	OUT	Data Raw: 7b 22 54 22 3a 31 36 35 36 36 33 39 37 36 33 31 30 35 2c 22 4c 22 3a 5b 7b 22 47 22 3a 35 39 35 37 31 34 37 31 35 2c 22 54 22 3a 32 36 36 2c 22 4d 22 3a 22 52 65 63 65 69 76 65 64 20 6d 65 73 73 61 67 65 49 64 3a 20 57 61 63 5f 41 70 70 42 6f 6f 74 53 74 61 74 65 2c 20 63 6f 72 72 65 6c 61 74 69 6f 6e 3a 20 75 6e 64 65 66 69 6e 65 64 22 2c 22 43 22 3a 33 37 39 2c 22 44 22 3a 35 30 7d 2c 7b 22 47 22 3a 35 39 36 34 36 34 32 38 38 2c 22 54 22 3a 32 36 36 2c 22 4d 22 3a 22 50 72 6f 63 65 73 73 69 6e 67 20 6d 65 73 73 61 67 65 3a 20 57 61 63 5f 41 70 70 42 6f 6f 74 53 74 61 74 65 22 2c 22 43 22 3a 33 37 39 2c 22 44 22 3a 35 30 7d 2c 7b 22 47 22 3a 35 39 35 37 31 34 32 37 31 2c 22 54 22 3a 32 36 36 2c 22 4d 22 3a 22 57 41 43 20 42 6f 6f 74 20 41 70 70 20 73 74 Data Ascii: {"T":1656639763105,"L":[{"G":595714715,"T":266,"M":"Received messageId: Wac_AppBootState, correlation: undefined","C":379,"D":50},{"G":596464288,"T":266,"M":"Processing message: Wac_AppBootState","C":379,"D":50},{"G":595714271,"T":266,"M":"WAC Boot App st
2022-06-30 16:42:53 UTC	318	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: X-CorrelationId: e8620c19-d6c3-4234-8cab-125659b7a70a X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030 Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: * X-OfficeFE: AM4PEPF00006B53 X-OfficeVersion: 16.0.15417.41022 X-OfficeCluster: PNL1 Access-Control-Allow-Origin: https://onedrive.live.com Access-Control-Expose-Headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags Cross-Origin-Resource-Policy: cross-origin X-bULS-SuppressionETag: CA78EF8008219FD41B3BEECBDC5469C32D39C9D9 X-bULS-SuppressedTags: 378069,1671813,2209344,3290144,4298965,4298968,4298969,4751696,5306497,5904476,6375195,6572226,6948167,7463498,17085210,17085216,17162522,17358857,19743902,21627712,21631370,22401293,22410500,22558617,22598977,22680210,22680213,22680214,22836558,22946650,23909858,24401375,24462656,24515087,25514973,33592839,34388130,35682372,36472266,36546380,36546381,36546382,36569418,36708451,36773964,36791688,36811158,36811159,36963655,37288035,37876293,37876294,37889309,38293640,38535900,38543496,38580697,38637954,38922202,39076766,39076767,39105358,39408129,39613840,39966341,40437001,40935455,40957978,40957979,41003225,41207258,41502555,41711299,41952657,41964821,41964885,42272991,42496725,42513088,42815875,42857251,50406866,50431969,50619726,50622685,50622687,51451613,51504083,51667010,306230939,524883107,524883136,524883138,537159499,538542792,538543587,539874723,540378699,540378700,542700237,542994947,545783884,557077970,557322386,557389507,557670930,558735363,559423838,559424262,559486496,559760215,559760216,570507662,571549507,571786073,571786074,574468116,575157663,575157664,575157665,575157666,575157667,575157696,575157697,575157698,575157699,575157700,575157701,575157702,577295376,577626581,577831138,578164000,587862985,591684683,591729363,592259104,592556551,592843145,593780815,593838232,593862981,594134597,594396706,594830612,595137156,595714715,595895774,596115913,596444186,596464289,845836083,845836084,845836085,846166132,876178018,963472182,1630679666,1630679667,1633958006,1647605351,1664576567,1698260075,1718235956,1765045358,1802139698,1986689397,1986689633,1986689647,1986748791,1986748793,1986749030,1986749288,1986749546,2004443760,2004444278,2004448354 X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-OFFICEFD: AM4PEPF00006B53 X-Cache: CONFIG_NOCACHE X-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5 X-MSEdge-Features: typeheadertest,afd_waccluster,afd_wacinfra4,afd_wacinfra5 X-MSEdge-Ref: Ref A: 734DF6E750CE4818B55BB4DAB68246A3 Ref B: AM3EDGE0410 Ref C: 2022-06-30T16:42:53Z Date: Thu, 30 Jun 2022 16:42:52 GMT Connection: close Content-Length: 0

Timestamp	kBytes transferred	Direction	Data
2022-06-30 16:42:54 UTC	321	OUT	GET /o/App_Scripts/Acl/Acl1033.js HTTP/1.1 Host: onenote.officeapps.live.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-US&rs=en-US&hid=mnfhyzLCdkOTWRS%2FhUuNkA.0&wopisrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffolders%2F1F6FC88150FE397E!35197&wdo=2&sc=host%3D%26qt%3DDefault&wdp=7&uih=OneDrive&wdorigin=Unknown&wdhostclicktime=1656639760502&jsapi=1&jsapiver=v1&newsession=1&corrid=98985cba-b3dc-48e7-ae9f-7bbc12744030&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&sftc=1&readonly=1&wdredirectionreason=Force_SingleStepBoot Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; xidseq=3; E=P:3UE7jbda2og=:JYdRP+n4EC7rku8IJu1vdQXlP/bseSGMwIgEJuQSe1c=:F; DcLcid=ui=1033&data=1033; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2022-06-30 16:42:54 UTC	322	IN	HTTP/1.1 200 OK Cache-Control: public,max-age=31536000 Content-Length: 19181 Content-Type: application/javascript Last-Modified: Fri, 13 May 2022 18:06:33 GMT Accept-Ranges: bytes ETag: "dd48cd2df466d81:0" P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: X-CorrelationId: 5daba825-4b0b-4985-a0a1-5a67dd64739f X-UserSessionId: 5daba825-4b0b-4985-a0a1-5a67dd64739f Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: * X-OfficeFE: AM4PEPF00006020 X-OfficeVersion: 16.0.15417.41022 X-OfficeCluster: PNL1 X-OFFICEFD: AM4PEPF00006020 X-Cache: CONFIG_NOCACHE X-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5 X-MSEdge-Features: typeheadertest,afd_waccluster,afd_wacinfra4,afd_wacinfra5 X-MSEdge-Ref: Ref A: 04E062B7B0BF4C5EB4B679695BFFE7C0 Ref B: AM3EDGE0817 Ref C: 2022-06-30T16:42:54Z Date: Thu, 30 Jun 2022 16:42:54 GMT Connection: close
2022-06-30 16:42:54 UTC	323	IN	Data Raw: ef bb bf 76 61 72 20 41 75 74 6f 43 6f 72 72 65 63 74 4c 69 73 74 3d 7b 22 28 63 29 22 3a 22 c2 a9 22 2c 22 28 72 29 22 3a 22 c2 ae 22 2c 22 28 74 6d 29 22 3a 22 e2 84 a2 22 2c 22 2e 2e 2e 22 3a 22 e2 80 a6 22 2c 22 61 62 62 6f 75 74 22 3a 22 61 62 6f 75 74 22 2c 22 61 62 6f 74 75 22 3a 22 61 62 6f 75 74 22 2c 22 61 62 6f 75 74 61 22 3a 22 61 62 6f 75 74 20 61 22 2c 22 61 62 6f 75 74 69 74 22 3a 22 61 62 6f 75 74 20 69 74 22 2c 22 61 62 6f 75 74 74 68 65 22 3a 22 61 62 6f 75 74 20 74 68 65 22 2c 22 61 62 73 63 65 6e 63 65 22 3a 22 61 62 73 65 6e 63 65 22 2c 22 61 63 63 65 73 6f 72 69 65 73 22 3a 22 61 63 63 65 73 73 6f 72 69 65 73 22 2c 22 61 63 63 69 64 61 6e 74 22 3a 22 61 63 63 69 64 65 6e 74 22 2c 22 61 63 63 6f 6d 6f 64 61 74 65 22 3a 22 61 63 63 6f Data Ascii: var AutoCorrectList={"(c)":"","(r)":"","(tm)":"","...":"","abbout":"about","abotu":"about","abouta":"about a","aboutit":"about it","aboutthe":"about the","abscence":"absence","accesories":"accessories","accidant":"accident","accomodate":"acco
2022-06-30 16:42:54 UTC	325	IN	Data Raw: 22 2c 22 62 65 67 69 6e 69 6e 67 22 3a 22 62 65 67 69 6e 6e 69 6e 67 22 2c 22 62 65 67 69 6e 69 6e 69 6e 67 22 3a 22 62 65 67 69 6e 6e 69 6e 67 22 2c 22 62 65 6c 65 69 65 76 22 3a 22 62 65 6c 69 65 76 65 22 2c 22 62 65 6c 65 69 65 76 65 22 3a 22 62 65 6c 69 65 76 65 22 2c 22 62 65 6c 65 69 66 22 3a 22 62 65 6c 69 65 66 22 2c 22 62 65 6c 65 69 76 65 22 3a 22 62 65 6c 69 65 76 65 22 2c 22 62 65 6c 65 69 76 65 64 22 3a 22 62 65 6c 69 65 76 65 64 22 2c 22 62 65 6c 65 69 76 65 73 22 3a 22 62 65 6c 69 65 76 65 73 22 2c 22 62 65 6e 69 66 69 74 22 3a 22 62 65 6e 65 66 69 74 22 2c 22 62 65 6e 69 66 69 74 73 22 3a 22 62 65 6e 65 66 69 74 73 22 2c 22 62 65 74 77 65 6e 22 3a 22 62 65 74 77 65 65 6e 22 2c 22 62 65 75 74 69 66 75 6c 22 3a 22 62 65 61 75 74 69 66 75 6c Data Ascii: ","begining":"beginning","beginining":"beginning","beleiev":"believe","beleieve":"believe","beleif":"belief","beleive":"believe","beleived":"believed","beleives":"believes","benifit":"benefit","benifits":"benefits","betwen":"between","beutiful":"beautiful
2022-06-30 16:42:54 UTC	333	IN	Data Raw: 6c 69 74 74 74 6c 65 22 3a 22 6c 69 74 74 6c 65 22 2c 22 6c 69 75 6b 65 22 3a 22 6c 69 6b 65 22 2c 22 6c 69 76 65 69 6e 67 22 3a 22 6c 69 76 69 6e 67 22 2c 22 6c 6f 65 76 22 3a 22 6c 6f 76 65 22 2c 22 6c 6f 6e 6c 79 22 3a 22 6c 6f 6e 65 6c 79 22 2c 22 6c 6f 6f 6b 69 67 6e 22 3a 22 6c 6f 6f 6b 69 6e 67 22 2c 22 6d 61 69 6e 74 65 6e 65 6e 63 65 22 3a 22 6d 61 69 6e 74 65 6e 61 6e 63 65 22 2c 22 6d 61 6b 65 69 6e 67 22 3a 22 6d 61 6b 69 6e 67 22 2c 22 6d 61 6e 61 67 6d 65 6e 74 22 3a 22 6d 61 6e 61 67 65 6d 65 6e 74 22 2c 22 6d 61 6e 74 61 69 6e 22 3a 22 6d 61 69 6e 74 61 69 6e 22 2c 22 6d 61 72 72 61 69 67 65 22 3a 22 6d 61 72 72 69 61 67 65 22 2c 22 6d 61 79 20 6f 66 20 62 65 65 6e 22 3a 22 6d 61 79 20 68 61 76 65 20 62 65 65 6e 22 2c 22 6d 61 79 20 6f 66 Data Ascii: litttle":"little","liuke":"like","liveing":"living","loev":"love","lonly":"lonely","lookign":"looking","maintenence":"maintenance","makeing":"making","managment":"management","mantain":"maintain","marraige":"marriage","may of been":"may have been","may of
2022-06-30 16:42:54 UTC	338	IN	Data Raw: 66 69 63 69 65 6e 74 22 2c 22 73 75 70 6f 73 65 64 22 3a 22 73 75 70 70 6f 73 65 64 22 2c 22 73 75 70 70 6f 73 73 65 64 22 3a 22 73 75 70 70 6f 73 65 64 22 2c 22 73 75 70 72 69 73 65 22 3a 22 73 75 72 70 72 69 73 65 22 2c 22 73 75 70 72 69 73 65 64 22 3a 22 73 75 72 70 72 69 73 65 64 22 2c 22 73 77 69 6d 69 6e 67 22 3a 22 73 77 69 6d 6d 69 6e 67 22 2c 22 74 61 68 6e 22 3a 22 74 68 61 6e 22 2c 22 74 61 68 74 22 3a 22 74 68 61 74 22 2c 22 74 61 6c 65 6b 64 22 3a 22 74 61 6c 6b 65 64 22 2c 22 74 61 6c 6b 69 67 6e 22 3a 22 74 61 6c 6b 69 6e 67 22 2c 22 74 61 74 68 22 3a 22 74 68 61 74 22 2c 22 74 65 63 6e 69 63 61 6c 22 3a 22 74 65 63 68 6e 69 63 61 6c 22 2c 22 74 65 68 22 3a 22 74 68 65 22 2c 22 74 65 68 79 22 3a 22 74 68 65 79 22 2c 22 74 65 6c 6c 74 20 68 Data Ascii: ficient","suposed":"supposed","suppossed":"supposed","suprise":"surprise","suprised":"surprised","swiming":"swimming","tahn":"than","taht":"that","talekd":"talked","talkign":"talking","tath":"that","tecnical":"technical","teh":"the","tehy":"they","tellt h

Timestamp	kBytes transferred	Direction	Data
2022-06-30 16:42:39 UTC	1	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2022-06-30 16:42:39 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-aJbZGsmIZ_8p602p-Mgkxg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 30 Jun 2022 16:42:39 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5659 X-Daystart: 34959 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-06-30 16:42:39 UTC	2	IN	Data Raw: 33 31 61 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 35 39 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 34 39 35 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 31a<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5659" elapsed_seconds="34959"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-06-30 16:42:39 UTC	3	IN	Data Raw: 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 70 Data Ascii: mhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><ap
2022-06-30 16:42:39 UTC	3	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2022-06-30 16:42:57 UTC	342	OUT	POST /o/RemoteTelemetry.ashx HTTP/1.1 Host: onenote.officeapps.live.com Connection: keep-alive Content-Length: 27992 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://onenote.officeapps.live.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-US&rs=en-US&hid=mnfhyzLCdkOTWRS%2FhUuNkA.0&wopisrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffolders%2F1F6FC88150FE397E!35197&wdo=2&sc=host%3D%26qt%3DDefault&wdp=7&uih=OneDrive&wdorigin=Unknown&wdhostclicktime=1656639760502&jsapi=1&jsapiver=v1&newsession=1&corrid=98985cba-b3dc-48e7-ae9f-7bbc12744030&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&sftc=1&readonly=1&wdredirectionreason=Force_SingleStepBoot Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; xidseq=3; E=P:3UE7jbda2og=:JYdRP+n4EC7rku8IJu1vdQXlP/bseSGMwIgEJuQSe1c=:F; DcLcid=ui=1033&data=1033; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; ShCLSessionID=1656639775607_0.6675230212797223; BP=l=SDX.Skydrive&FR=&ST=
2022-06-30 16:42:57 UTC	343	OUT	Data Raw: 7b 22 64 22 3a 7b 22 61 22 3a 22 4f 6e 65 4e 6f 74 65 22 2c 22 62 22 3a 22 65 6e 2d 55 53 22 2c 22 63 22 3a 22 56 69 65 77 22 2c 22 64 22 3a 22 56 49 45 57 22 2c 22 65 22 3a 22 31 36 2e 30 2e 31 35 34 31 37 2e 34 31 30 32 32 22 2c 22 66 22 3a 22 43 68 72 6f 6d 65 22 2c 22 67 22 3a 22 65 6e 2d 55 53 22 2c 22 68 22 3a 22 38 35 22 2c 22 69 22 3a 22 38 35 2e 30 2e 34 31 38 33 22 2c 22 6a 22 3a 22 31 36 2e 30 2e 31 35 34 31 37 2e 34 31 30 32 32 22 2c 22 6b 22 3a 22 50 4e 4c 31 22 2c 22 6c 22 3a 22 65 6e 2d 55 53 22 2c 22 6d 22 3a 22 5c 22 5a 51 76 55 73 58 67 33 36 6c 4b 6c 48 45 4d 63 39 4a 6f 2b 77 67 6f 34 58 5a 41 34 68 36 77 59 73 4f 30 2f 6a 42 5a 5a 61 6f 49 3d 5c 22 22 2c 22 6e 22 3a 22 4f 6e 65 44 72 69 76 65 57 4f 50 49 22 2c 22 6f 22 3a 74 72 75 65 Data Ascii: {"d":{"a":"OneNote","b":"en-US","c":"View","d":"VIEW","e":"16.0.15417.41022","f":"Chrome","g":"en-US","h":"85","i":"85.0.4183","j":"16.0.15417.41022","k":"PNL1","l":"en-US","m":"\"ZQvUsXg36lKlHEMc9Jo+wgo4XZA4h6wYsO0/jBZZaoI=\"","n":"OneDriveWOPI","o":true
2022-06-30 16:42:57 UTC	359	OUT	Data Raw: 6f 74 65 45 6e 64 6e 6f 74 65 43 6f 6e 74 61 69 6e 65 72 5c 22 3a 30 2c 5c 22 48 65 61 64 65 72 46 6f 6f 74 65 72 5c 22 3a 30 2c 5c 22 48 65 61 64 65 72 46 6f 6f 74 65 72 43 6f 6e 74 61 69 6e 65 72 5c 22 3a 30 2c 5c 22 49 6d 61 67 65 5c 22 3a 31 2c 5c 22 4e 6f 74 65 54 61 67 5c 22 3a 30 2c 5c 22 4e 6f 74 65 54 61 67 43 6f 6e 74 61 69 6e 65 72 5c 22 3a 30 2c 5c 22 4e 75 6d 62 65 72 4c 69 73 74 5c 22 3a 30 2c 5c 22 4f 75 74 6c 69 6e 65 5c 22 3a 33 2c 5c 22 4f 75 74 6c 69 6e 65 45 6c 65 6d 65 6e 74 5c 22 3a 35 2c 5c 22 4f 75 74 6c 69 6e 65 47 72 6f 75 70 5c 22 3a 30 2c 5c 22 50 61 67 65 43 6f 6e 74 65 6e 74 5c 22 3a 31 2c 5c 22 50 61 67 65 4d 61 6e 69 66 65 73 74 5c 22 3a 30 2c 5c 22 50 61 72 61 67 72 61 70 68 5c 22 3a 34 2c 5c 22 54 61 62 6c 65 73 5c 22 3a Data Ascii: oteEndnoteContainer\":0,\"HeaderFooter\":0,\"HeaderFooterContainer\":0,\"Image\":1,\"NoteTag\":0,\"NoteTagContainer\":0,\"NumberList\":0,\"Outline\":3,\"OutlineElement\":5,\"OutlineGroup\":0,\"PageContent\":1,\"PageManifest\":0,\"Paragraph\":4,\"Tables\":
2022-06-30 16:42:57 UTC	371	IN	HTTP/1.1 200 OK Cache-Control: private P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: X-CorrelationId: 8109ac1b-f00b-4d98-8cb6-adaf735265a3 X-UserSessionId: 8109ac1b-f00b-4d98-8cb6-adaf735265a3 Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: * X-OfficeFE: AM4PEPF0000695D X-OfficeVersion: 16.0.15417.41022 X-OfficeCluster: PNL1 Access-Control-Allow-Origin: https://onenote.officeapps.live.com X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-OFFICEFD: AM4PEPF0000695D X-Cache: CONFIG_NOCACHE X-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5 X-MSEdge-Features: typeheadertest,afd_waccluster,afd_visioslice_control,afd_wacinfra4,afd_wacinfra5 X-MSEdge-Ref: Ref A: 611505D991EC49209EBF35C3DB7D7637 Ref B: AMS04EDGE2620 Ref C: 2022-06-30T16:42:57Z Date: Thu, 30 Jun 2022 16:42:56 GMT Connection: close Content-Length: 0

Timestamp	kBytes transferred	Direction	Data
2022-06-30 16:42:58 UTC	372	OUT	POST /o/RemoteUls.ashx?build=16.0.15417.41022&waccluster=PNL1 HTTP/1.1 Host: onenote.officeapps.live.com Connection: keep-alive Content-Length: 52564 X-WacFrontEnd: AM4PEPF00006B54 X-OfficeVersion: 16.0.15417.41022 X-Key: 0XpfQFtLDrRv4UQM6v/1i8MVOATyWv5at1Jp1IgB+lw=,637922041630980967 X-WacUserAgent: MSWACONSync X-bULS-SuppressionETag: CA78EF8008219FD41B3BEECBDC5469C32D39C9D9 X-AccessTokenTtl: 1658421761813 X-Requested-With: XMLHttpRequest X-xhr: 1 haep: 1 X-AccessToken: 4woSj1zDmD6jWmjHBN1xSC0lUNughcf1TW0FiCawbpLNwgYjE8pGOzrhQHssjdDTNK8Jn21CpZ1u3SbKIQsF-ynTSOSveEi0XEaPSoAexqp7-12GLVzZG1WjgR-aZoeDjLwtY20zVT5-XDPGmWP14AVg X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-UserType: WOPI X-IsCoauthSession: true X-WacCluster: PNL1 Accept: / Origin: https://onenote.officeapps.live.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://onenote.officeapps.live.com/o/onenoteframe.aspx?edit=0&ui=en-US&rs=en-US&hid=mnfhyzLCdkOTWRS%2FhUuNkA.0&wopisrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffolders%2F1F6FC88150FE397E!35197&wdo=2&sc=host%3D%26qt%3DDefault&wdp=7&uih=OneDrive&wdorigin=Unknown&wdhostclicktime=1656639760502&jsapi=1&jsapiver=v1&newsession=1&corrid=98985cba-b3dc-48e7-ae9f-7bbc12744030&usid=98985cba-b3dc-48e7-ae9f-7bbc12744030&sftc=1&readonly=1&wdredirectionreason=Force_SingleStepBoot Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: xid=a94776a0-ee2a-458a-9854-05b95ebe50e6&&RDE42AAC93A332&222; wla42=; mkt=en-US; xidseq=3; E=P:3UE7jbda2og=:JYdRP+n4EC7rku8IJu1vdQXlP/bseSGMwIgEJuQSe1c=:F; DcLcid=ui=1033&data=1033; BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; ShCLSessionID=1656639775607_0.6675230212797223; BP=l=SDX.Skydrive&FR=&ST=
2022-06-30 16:42:58 UTC	373	OUT	Data Raw: 7b 22 54 22 3a 31 36 35 36 36 33 39 37 37 33 31 38 34 2c 22 4c 22 3a 5b 7b 22 47 22 3a 34 31 35 34 33 33 38 30 2c 22 54 22 3a 33 34 2c 22 4d 22 3a 22 46 69 6e 69 73 68 65 64 20 72 65 6e 64 65 72 69 6e 67 20 64 65 6c 61 79 65 64 20 6f 75 74 6c 69 6e 65 73 20 70 6f 73 74 2d 62 6f 6f 74 22 2c 22 43 22 3a 33 33 39 2c 22 44 22 3a 35 30 7d 2c 7b 22 47 22 3a 35 31 34 30 31 38 30 32 2c 22 54 22 3a 33 35 2c 22 4d 22 3a 22 52 65 73 70 6f 6e 73 65 20 72 65 61 64 79 20 66 6f 72 20 68 74 74 70 73 3a 2f 2f 6f 66 66 69 63 65 63 6c 69 65 6e 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 63 6f 6e 66 69 67 31 36 3f 66 6c 69 67 68 74 73 3d 43 6c 69 65 6e 74 2e 52 65 73 6f 75 72 63 65 53 65 72 76 69 63 65 34 48 69 64 64 65 6e 56 32 26 73 65 72 76 69 63 65 73 3d 52 65 73 6f Data Ascii: {"T":1656639773184,"L":[{"G":41543380,"T":34,"M":"Finished rendering delayed outlines post-boot","C":339,"D":50},{"G":51401802,"T":35,"M":"Response ready for https://officeclient.microsoft.com/config16?flights=Client.ResourceService4HiddenV2&services=Reso
2022-06-30 16:42:58 UTC	389	OUT	Data Raw: 65 6e 74 5c 22 2c 5c 22 6b 65 79 5c 22 3a 5c 22 53 75 69 74 65 48 65 61 64 65 72 3a 46 69 72 73 74 52 65 6e 64 65 72 2d 53 75 69 74 65 48 65 61 64 65 72 3a 43 6f 6e 73 74 72 75 63 74 6f 72 5c 22 2c 5c 22 73 74 61 72 74 54 69 6d 65 5c 22 3a 31 31 39 31 36 2e 38 33 35 30 30 30 30 30 30 30 30 36 2c 5c 22 65 6e 64 54 69 6d 65 5c 22 3a 31 33 30 30 30 2e 35 39 30 30 30 30 30 30 30 30 30 32 2c 5c 22 64 75 72 61 74 69 6f 6e 4d 73 5c 22 3a 31 30 38 34 7d 22 2c 22 43 22 3a 33 34 30 2c 22 44 22 3a 35 30 7d 2c 7b 22 47 22 3a 35 39 35 38 35 35 31 38 32 2c 22 54 22 3a 32 39 32 31 2c 22 4d 22 3a 22 52 65 61 63 74 48 65 61 64 65 72 20 66 69 72 73 74 20 72 65 6e 64 65 72 20 74 69 6d 65 3a 20 31 30 38 34 20 6d 73 22 2c 22 43 22 3a 33 34 30 2c 22 44 22 3a 35 30 7d 2c 7b 22 Data Ascii: ent\",\"key\":\"SuiteHeader:FirstRender-SuiteHeader:Constructor\",\"startTime\":11916.835000000006,\"endTime\":13000.590000000002,\"durationMs\":1084}","C":340,"D":50},{"G":595855182,"T":2921,"M":"ReactHeader first render time: 1084 ms","C":340,"D":50},{"
2022-06-30 16:42:58 UTC	405	OUT	Data Raw: 74 61 72 74 5c 22 3a 5c 22 30 5c 22 2c 5c 22 52 65 64 69 72 65 63 74 45 6e 64 5c 22 3a 5c 22 30 5c 22 2c 5c 22 46 65 74 63 68 53 74 61 72 74 5c 22 3a 5c 22 32 39 34 32 2e 33 39 5c 22 2c 5c 22 44 6f 6d 61 69 6e 4c 6f 6f 6b 75 70 53 74 61 72 74 5c 22 3a 5c 22 33 37 38 33 2e 33 5c 22 2c 5c 22 44 6f 6d 61 69 6e 4c 6f 6f 6b 75 70 45 6e 64 5c 22 3a 5c 22 33 37 38 33 2e 33 32 5c 22 2c 5c 22 43 6f 6e 6e 65 63 74 53 74 61 72 74 5c 22 3a 5c 22 33 37 38 33 2e 33 32 5c 22 2c 5c 22 43 6f 6e 6e 65 63 74 45 6e 64 5c 22 3a 5c 22 34 33 34 36 2e 32 31 5c 22 2c 5c 22 53 65 63 75 72 65 43 6f 6e 6e 65 63 74 69 6f 6e 53 74 61 72 74 5c 22 3a 5c 22 33 37 38 36 2e 30 33 5c 22 2c 5c 22 52 65 71 75 65 73 74 53 74 61 72 74 5c 22 3a 5c 22 34 33 34 37 2e 33 34 35 5c 22 2c 5c 22 52 65 Data Ascii: tart\":\"0\",\"RedirectEnd\":\"0\",\"FetchStart\":\"2942.39\",\"DomainLookupStart\":\"3783.3\",\"DomainLookupEnd\":\"3783.32\",\"ConnectStart\":\"3783.32\",\"ConnectEnd\":\"4346.21\",\"SecureConnectionStart\":\"3786.03\",\"RequestStart\":\"4347.345\",\"Re
2022-06-30 16:42:58 UTC	421	OUT	Data Raw: 65 76 69 65 77 43 72 69 74 69 71 75 65 73 46 69 6c 74 65 72 2e 46 69 6c 74 65 72 69 6e 67 42 65 66 6f 72 65 49 6e 69 74 69 61 6c 69 7a 61 74 69 6f 6e 2c 4f 66 66 69 63 65 2e 44 6f 63 73 2e 53 68 61 72 65 64 43 6f 6d 6d 65 6e 74 73 2e 43 6f 6d 6d 69 74 43 6f 6d 6d 65 6e 74 2c 4f 66 66 69 63 65 2e 44 6f 63 73 2e 53 68 61 72 65 64 43 6f 6d 6d 65 6e 74 73 2e 44 69 73 63 61 72 64 44 72 61 66 74 41 73 79 6e 63 5c 22 2c 5c 22 74 61 73 6b 44 75 72 61 74 69 6f 6e 4c 6f 67 46 72 65 71 75 65 6e 63 79 5c 22 3a 32 30 2c 5c 22 74 61 73 6b 44 75 72 61 74 69 6f 6e 4c 6f 67 54 68 72 65 73 68 6f 6c 64 5c 22 3a 31 30 30 2c 5c 22 72 65 70 6f 72 74 54 61 73 6b 44 65 74 61 69 6c 73 5c 22 3a 66 61 6c 73 65 7d 22 2c 22 43 22 3a 32 32 35 2c 22 44 22 3a 35 30 7d 2c 7b 22 47 22 3a Data Ascii: eviewCritiquesFilter.FilteringBeforeInitialization,Office.Docs.SharedComments.CommitComment,Office.Docs.SharedComments.DiscardDraftAsync\",\"taskDurationLogFrequency\":20,\"taskDurationLogThreshold\":100,\"reportTaskDetails\":false}","C":225,"D":50},{"G":
2022-06-30 16:42:58 UTC	425	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/plain P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR" Set-Cookie: X-CorrelationId: 32889ec7-d3f4-42c7-9f27-43f9ee517248 X-UserSessionId: 98985cba-b3dc-48e7-ae9f-7bbc12744030 Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: * X-OfficeFE: AM4PEPF00006B53 X-OfficeVersion: 16.0.15417.41022 X-OfficeCluster: PNL1 Access-Control-Allow-Origin: https://onenote.officeapps.live.com Access-Control-Expose-Headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags Cross-Origin-Resource-Policy: cross-origin X-bULS-SuppressionETag: CA78EF8008219FD41B3BEECBDC5469C32D39C9D9 X-Content-Type-Options: nosniff X-Download-Options: noopen Content-Disposition: attachment X-OFFICEFD: AM4PEPF00006B53 X-Cache: CONFIG_NOCACHE X-MSEdge-Flight: 2i49=afd_wacinfra4,2i4a=afd_wacinfra5 X-MSEdge-Features: typeheadertest,afd_waccluster,afd_wacinfra4,afd_wacinfra5 X-MSEdge-Ref: Ref A: B46F706468DC4F608C3BD047912E3CCC Ref B: AM3EDGE0321 Ref C: 2022-06-30T16:42:58Z Date: Thu, 30 Jun 2022 16:42:57 GMT Connection: close Content-Length: 0