Edit tour

Windows Analysis Report
San Xavier District of the Tohono O#U2019odham Nation.pdf

Overview

General Information

Sample name:	San Xavier District of the Tohono O#U2019odham Nation.pdf renamed because original name is a hash value
Original sample name:	San Xavier District of the Tohono Oodham Nation.pdf
Analysis ID:	1500077
MD5:	e04af1af7f451ca7e8d4fe6c13d2f9fe
SHA1:	aab9b37a10fc9291c28ef044624d4129e6728f92
SHA256:	51f056df8dfcde11515753ca915517ce4d76972e6979247d9e0b33c28f8c4afe
Infos:

Detection

Score:	23
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Suspicious PDF detected (based on various text indicators)

Detected non-DNS traffic on DNS port

HTML page contains hidden javascript code

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 1492 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\San Xavier District of the Tohono O#U2019odham Nation.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7200 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1584,i,2345941670000869250,4026492604822404281,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 1628 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://baycitymi-my.sharepoint.com/:o:/g/personal/avogel_baycitymi_gov/Elmi9pmfBD9FsxTL7-oQ2IoBeHOG7eWvLU9bAnRZwDCz7Q?e=tcLUbt" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2008,i,17246115955249219125,14719809775228950345,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Boot Survival
• Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

Phishing

Suspicious PDF detected (based on various text indicators)

Source: Adobe Acrobat PDF

OCR Text: SECURE ONLINE DOCUMENT CLICK HERE TO ACCESS VIA MICROSOFT PDF READER

Source: https://baycitymi-my.sharepoint.com/personal/avogel_baycitymi_gov/_layouts/15/Doc.aspx?sourcedoc=%7B99f6a259-049f-453f-b314-cbefea10d88a%7D&action=default&slrid=08764aa1-8002-6000-4edd-0ec3c14769fb&originalPath=aHR0cHM6Ly9iYXljaXR5bWktbXkuc2hhcmVwb2ludC5jb20vOm86L2cvcGVyc29uYWwvYXZvZ2VsX2JheWNpdHltaV9nb3YvRWxtaTlwbWZCRDlGc3hUTDctb1EySW9CZUhPRzdlV3ZMVTliQW5SWndEQ3o3UT9ydGltZT02NUN2S2NyRzNFZw&CID=5e7c16d6-5e9c-424b-ad78-f90465cf4904&_SRM=0:G:111

HTTP Parser: Base64 decoded: {"typ":"JWT","alg":"RS256","x5t":"uXehQJPleVjNCbakUhGD6IyFQQk"}

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:50143 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:50146 version: TLS 1.2

Source:	Binary string: V.xd?this.sFd(V):!1}im(V){return V?T.T5&&!K.a(V)?(h.ULS.sendTraceTag(50963545,324,10,"get_type is not a function of graph node. Type: {0}",Object.getType(V).toString()),!1):19===V.type:!1}sFd(V){return V.Oa(J.a.f2)}Pdb(V){return V.ka(J.a.lNh,0)}uH(V){V=this.Pdb(V);return 0!==V&&3!==V}NYa(V){const ba=this.eKh(V),ca=!!V.ka(J.a.Eka,0),Z=this.Rgf(V),ia=this.uH(V);return 5===S.ImageReader.Xq(V)&&!ba&&!ca&&!Z&&!ia}eKh(V){const ba=V.ka(J.a.Ahf,!1);return V.ka(J.a.ahf,!1)\|\|ba}Rgf(V){const ba=!!V.ka(J.a.mBd, source: chromecache_318.9.dr, chromecache_310.9.dr
Source:	Binary string: ({width:C,height:W}=Oe.ImageReader.SKb(C));return{width:C,height:W}}Xq(C){return Oe.ImageReader.Xq(C)}Rfb(C){return Oe.ImageReader.Rfb(C)}im(C){return Oe.ImageReader.im(C)}Pdb(C){return Oe.ImageReader.Pdb(C)}uH(C){return Oe.ImageReader.uH(C)}NYa(C){return Oe.ImageReader.NYa(C)}lka(C){return Oe.ImageReader.lka(C)}kka(C){return Oe.ImageReader.kka(C)}gua(C,W,oa){return Oe.ImageReader.gua(C,W,oa)}fua(C,W){return Oe.ImageReader.fua(C,W)}nYb(C){return Oe.ImageReader.nYb(C)}Kgb(C){return Oe.ImageReader.Kgb(C)}Sta(C){return Oe.ImageReader.Sta(C)}B3(C, source: chromecache_318.9.dr, chromecache_310.9.dr
Source:	Binary string: d(77836);return fa.La.keyCode===Sys.UI.Key.enter&&"a"!==fa.$b.tagName.toLowerCase()?(aa.NXe&&this.Ieb&&this.wVa(this.pdb(this.Y4a),1),!0):!1}Q3h(fa,aa){if(fa.La.ctrlKey\|\|fa.La.altKey\|\|fa.La.keyCode>=H.a.apb&&fa.La.keyCode<=H.a.bpb)return!1;if(fa.eventName===I.a.Fd&&this.E0c){const X=fa.La.keyCode;X!==Sys.UI.Key.enter&&X!==Sys.UI.Key.space\|\|aa(fa);this.E0c=!1}fa.eventName===I.a.Ve&&(this.E0c=!0);return!0}Rzc(fa){if(fa){var aa=fa.target;fa.type===I.a.focus?Sys.UI.DomElement.addCssClass(aa.parentNode, source: chromecache_318.9.dr, chromecache_310.9.dr
Source:	Binary string: (this.kn.style.zIndex=String(fa.fa.DX)),this.ub.style.zIndex=String(fa.fa.HI),fa.fa.state=this.fPb?1:2,ea.vTc\|\|(ea.vTc=ea.Okc,fa.ma.ja(K.a.Okc,T.a.frame,ea.vTc)),fa.J&&fa.J.Z("AccessibleMovingDialogsEnabled")&&(ea.CTc\|\|(ea.CTc=this.kwi,fa.ma.ja(K.a.g1f,T.a.frame,ea.CTc)),ea.yTc\|\|(ea.yTc=this.qdh,fa.ma.ja(K.a.H8g,T.a.frame,ea.yTc))),this.D5());fa.alc();ea.eXf("hidden");this.H$i();this.nba();fa.fa&&fa.fa.Ha.B0f&&this.MV();this.Ieb&&this.IJa(this.pdb(this.Y4a));fa.fa&&!fa.fa.Ha.B0f&&this.MV()}D5(){if(J.FocusManager.Vr()){var fa= source: chromecache_318.9.dr, chromecache_310.9.dr
Source:	Binary string: t.Vc(8);for(A=t.Rc();A;){if(K.im(A)&&K.Uta(A.properties))return!0;A=t.$f()}return!1}static Pdb(t){return K.Sj.Pdb(t)}static uH(t){return K.Sj.uH(t)}static NYa(t){return K.Sj.NYa(t)}static zFd(t){return K.UXa()?t.ka(D.a.$uc,!1):3===K.Pdb(t)}static Xq(t){return K.Sj.Xq(t)}static yFa(t){return(t=K.vn(t))?K.Xq(t):0}static Doh(t){return(t=K.vn(t))?t.ka(D.a.ZRe,!1):!1}static t_h(t){return 5===K.yFa(t)}static r_h(t){return 10===K.yFa(t)}static s_h(t){return 48===K.yFa(t)}static pkd(t){return K.Doh(t)}static w_h(t){return 11=== source: chromecache_318.9.dr, chromecache_310.9.dr

Source: global traffic	TCP traffic: 192.168.2.5:50091 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:50159 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 20.141.12.34 20.141.12.34
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 20.140.56.69 20.140.56.69

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:50143 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 104.78.188.188
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=8dzolmfARCn+Aww&MD=6lVLXk7B HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /:o:/g/personal/avogel_baycitymi_gov/Elmi9pmfBD9FsxTL7-oQ2IoBeHOG7eWvLU9bAnRZwDCz7Q?e=tcLUbt HTTP/1.1Host: baycitymi-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/avogel_baycitymi_gov/_layouts/15/Doc.aspx?sourcedoc=%7B99f6a259-049f-453f-b314-cbefea10d88a%7D&action=default&slrid=08764aa1-8002-6000-4edd-0ec3c14769fb&originalPath=aHR0cHM6Ly9iYXljaXR5bWktbXkuc2hhcmVwb2ludC5jb20vOm86L2cvcGVyc29uYWwvYXZvZ2VsX2JheWNpdHltaV9nb3YvRWxtaTlwbWZCRDlGc3hUTDctb1EySW9CZUhPRzdlV3ZMVTliQW5SWndEQ3o3UT9ydGltZT02NUN2S2NyRzNFZw&CID=5e7c16d6-5e9c-424b-ad78-f90465cf4904&_SRM=0:G:111 HTTP/1.1Host: baycitymi-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzViMWNmMWY3YjBmYTE2ZGQzMGNmOTVmNjE1NmZhYTQyNzQyNTczOTIyMDNmODJlZDk3MGJkY2NiOGQ5ZWE4YzgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNWIxY2YxZjdiMGZhMTZkZDMwY2Y5NWY2MTU2ZmFhNDI3NDI1NzM5MjIwM2Y4MmVkOTcwYmRjY2I4ZDllYThjOCwxMzM2OTI1ODk3NjAwMDAwMDAsMCwxMzM2OTM0NTA3NjQzNjQyMjAsMC4wLjAuMCwyNTgsZjhiOTkyZTctYzYwYy00MWE1LTk3ZGItNWJjOWNkMWE5ODU0LCwsMDg3NjRhYTEtODAwMi02MDAwLTRlZGQtMGVjM2MxNDc2OWZiLDA4NzY0YWExLTgwMDItNjAwMC00ZWRkLTBlYzNjMTQ3NjlmYixwTkVCZWQvM2pFZTVlNHFIY2kzTFl3LDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIzMjcsLUg5ZzhtM01DREpWV2pVbHVlRmpFODRCdVpVLG5ab3dtNHhLQ1B0UWdGUTRYWlF6K015ZVgvS0o3dnVpQmEyU3FMSW1FdXNPOEZvL2JTZUZRVTJRU0NZcFZVTk9vU3Q5VVBQOHI3L2dCczJmaytQcTE4QkVZQ1FrNkV2RVFCaFlGMGcxcnIyVlhsNlN4bVFYbmVhcEFmb1pPem9VeGFwaFVrMFloUGFOYWduNEdRRnc5b243ZmVWK0FOUXVZa3BGdnVxUFhqa3FYY0VST1dmQXdRcUozWHRTY3BaSVNSSmEvS2ltdUVOYVFJdSt5QXJ2MHVqN1BTaEo5SXlHdEpZcDdFRFpvdzhyRXMzdVNPZk1TVVF4OTNzejdUbXJBS1VRWTBSd2hlcUlmT2g1M0tuc2RsL1VvYnlpVDJDSG1mcENURW1WdHI3UTcycElBUFkrUUYzRUlhbGlZckFaVUVYZFk4L3p5R1QydWdjZTNkTEdUZz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /wise/owl/owl.slim.b85bbf4e2366ca721a6f.js HTTP/1.1Host: wise.gcc.cdn.office.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://baycitymi-my.sharepoint.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://baycitymi-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wise/owl/onenote-boot.35885234f8e241512812.js HTTP/1.1Host: wise.gcc.cdn.office.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://baycitymi-my.sharepoint.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://baycitymi-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/odsp-web-prod_2024-08-09.009/wacowlhostwebpack/wacowlhostwebpack.js HTTP/1.1Host: res-1-gcc.cdn.office.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://baycitymi-my.sharepoint.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://baycitymi-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/odsp-web-prod_2024-08-09.009/wacowlhostwebpack/wacowlhostwebpack.js HTTP/1.1Host: res-1-gcc.cdn.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=8dzolmfARCn+Aww&MD=6lVLXk7B HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /files/odsp-web-prod_2024-08-09.009/wacowlhostwebpack/13.js HTTP/1.1Host: res-1-gcc.cdn.office.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://baycitymi-my.sharepoint.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://baycitymi-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/odsp-web-prod_2024-08-09.009/wacowlhostwebpack/13.js HTTP/1.1Host: res-1-gcc.cdn.office.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: baycitymi-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: gbc-common.online.office.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: onenoteonline.nel.measure.office.net

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F8008506.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_332.9.dr, chromecache_291.9.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: chromecache_310.9.dr	String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://1drv.ms
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://attributes.engagement.office-int.com
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://attributes.engagement.office.com
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://attributes.engagement.officeppe.com
Source: San Xavier District of the Tohono O#U2019odham Nation.pdf	String found in binary or memory: https://baycitymi-my.sharepoint.com/:o:/g/personal/avogel_baycitymi_gov/Elmi9pmfBD9FsxTL7-oQ2IoBeHOG
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://cdn.dev.fluidpreview.office.net
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://cdn.dev.fluidpreview.office.net/fluid/dev
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://cdn.dev.fluidpreview.office.net/fluid/stg
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://cdn.fluidpreview.office.net
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://cdn.fluidpreview.office.net/fluid/df
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://cdn.fluidpreview.office.net/fluid/gcc
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://cdn.fluidpreview.office.net/fluid/prod
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://contentstorage.osi.office.net/images/2f4febe2cca96f7f.gif
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://contentstorage.osi.office.net/images/eb14b3fe6a1e1671.png
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://ecs.office.com
Source: chromecache_310.9.dr	String found in binary or memory: https://fa000000096.resources.office.net
Source: chromecache_310.9.dr	String found in binary or memory: https://fa000000096.resources.office.net/f7024bdc-7caf-4ca8-807d-2908f09640d6/1.0.2210.23001/en-us_w
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://fa000000096.resources.office.net/f7024bdc-7caf-4ca8-807d-2908f09640d6/1.0.2401.26003/en-us_w
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://feross.org
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://feross.org/opensource
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: chromecache_291.9.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://res-dod.cdn.office.net
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://res-dod.cdn.office.net/fluid/dod
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://res-gcch.cdn.office.net
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://res-gcch.cdn.office.net/fluid/gcch
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://res-sdf.cdn.office.net
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://res.cdn.office.net
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://roaming.edog.officeapps.live.com/rs/v1/settings
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://roaming.officeapps.live.com/rs/v1/settings
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://roaming.officeapps.partner.office365.cn/rs/v1/settings
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://roaming.osi.apps.mil/rs/v1/settings
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://roaming.osi.office.de/rs/v1/settings
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://roaming.osi.office365.us/rs/v1/settings
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://support.office.com/article/7afcb4f3-4aa2-443a-9b08-125a5d692576
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://whiteboard.apps.mil
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://whiteboard.eaglex.ic.gov
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://whiteboard.microsoft.scloud
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://whiteboard.office.com/root/index.fluid.js
Source: chromecache_318.9.dr, chromecache_310.9.dr	String found in binary or memory: https://whiteboard.office365.us

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.5:50146 version: TLS 1.2

Source: chromecache_318.9.dr, chromecache_310.9.dr

Binary or memory string: new y.a(u.a.zd());const H=".3gp .aa .aac .aax .act .aiff .amr .ape .au .awb .dct .dss .dvf .flac .gsm .iklax .ivs .m4a .m4b .m4p .mmf .mp3 .mpc .msv .ogg .oga .mogg .opus .ra .rm .raw .sln .tta .vox .wav .webm .wma .wv".split(" ");for(const v of H)G.$7b.add(v)}return G.$7b}static rYh(H){return G.jGh().contains(H)}static i2h(H){H=x.drh(H);return""!==document.createElement("audio").canPlayType(H)}}G.$7b=null;(0,z.a)(G,"EmbeddedFileReaderUtils",null,[])},15047:function(z,O,d){d.d(O,{a:function(){return k}});

Source: classification engine

Classification label: sus23.phis.winPDF@45/122@24/12

Source: San Xavier District of the Tohono O#U2019odham Nation.pdf	Initial sample: https://baycitymi-my.sharepoint.com/:o:/g/personal/avogel_baycitymi_gov/Elmi9pmfBD9FsxTL7-oQ2IoBeHOG7eWvLU9bAnRZwDCz7Q?e=tcLUbt
Source: San Xavier District of the Tohono O#U2019odham Nation.pdf	Initial sample: https://baycitymi-my.sharepoint.com/:o:/g/personal/avogel_baycitymi_gov/elmi9pmfbd9fsxtl7-oq2iobehog7ewvlu9banrzwdcz7q?e=tclubt

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6644

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-08-27 14-57-29-334.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\San Xavier District of the Tohono O#U2019odham Nation.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1584,i,2345941670000869250,4026492604822404281,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://baycitymi-my.sharepoint.com/:o:/g/personal/avogel_baycitymi_gov/Elmi9pmfBD9FsxTL7-oQ2IoBeHOG7eWvLU9bAnRZwDCz7Q?e=tcLUbt"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2008,i,17246115955249219125,14719809775228950345,262144 /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1584,i,2345941670000869250,4026492604822404281,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2008,i,17246115955249219125,14719809775228950345,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: V.xd?this.sFd(V):!1}im(V){return V?T.T5&&!K.a(V)?(h.ULS.sendTraceTag(50963545,324,10,"get_type is not a function of graph node. Type: {0}",Object.getType(V).toString()),!1):19===V.type:!1}sFd(V){return V.Oa(J.a.f2)}Pdb(V){return V.ka(J.a.lNh,0)}uH(V){V=this.Pdb(V);return 0!==V&&3!==V}NYa(V){const ba=this.eKh(V),ca=!!V.ka(J.a.Eka,0),Z=this.Rgf(V),ia=this.uH(V);return 5===S.ImageReader.Xq(V)&&!ba&&!ca&&!Z&&!ia}eKh(V){const ba=V.ka(J.a.Ahf,!1);return V.ka(J.a.ahf,!1)\|\|ba}Rgf(V){const ba=!!V.ka(J.a.mBd, source: chromecache_318.9.dr, chromecache_310.9.dr
Source:	Binary string: ({width:C,height:W}=Oe.ImageReader.SKb(C));return{width:C,height:W}}Xq(C){return Oe.ImageReader.Xq(C)}Rfb(C){return Oe.ImageReader.Rfb(C)}im(C){return Oe.ImageReader.im(C)}Pdb(C){return Oe.ImageReader.Pdb(C)}uH(C){return Oe.ImageReader.uH(C)}NYa(C){return Oe.ImageReader.NYa(C)}lka(C){return Oe.ImageReader.lka(C)}kka(C){return Oe.ImageReader.kka(C)}gua(C,W,oa){return Oe.ImageReader.gua(C,W,oa)}fua(C,W){return Oe.ImageReader.fua(C,W)}nYb(C){return Oe.ImageReader.nYb(C)}Kgb(C){return Oe.ImageReader.Kgb(C)}Sta(C){return Oe.ImageReader.Sta(C)}B3(C, source: chromecache_318.9.dr, chromecache_310.9.dr
Source:	Binary string: d(77836);return fa.La.keyCode===Sys.UI.Key.enter&&"a"!==fa.$b.tagName.toLowerCase()?(aa.NXe&&this.Ieb&&this.wVa(this.pdb(this.Y4a),1),!0):!1}Q3h(fa,aa){if(fa.La.ctrlKey\|\|fa.La.altKey\|\|fa.La.keyCode>=H.a.apb&&fa.La.keyCode<=H.a.bpb)return!1;if(fa.eventName===I.a.Fd&&this.E0c){const X=fa.La.keyCode;X!==Sys.UI.Key.enter&&X!==Sys.UI.Key.space\|\|aa(fa);this.E0c=!1}fa.eventName===I.a.Ve&&(this.E0c=!0);return!0}Rzc(fa){if(fa){var aa=fa.target;fa.type===I.a.focus?Sys.UI.DomElement.addCssClass(aa.parentNode, source: chromecache_318.9.dr, chromecache_310.9.dr
Source:	Binary string: (this.kn.style.zIndex=String(fa.fa.DX)),this.ub.style.zIndex=String(fa.fa.HI),fa.fa.state=this.fPb?1:2,ea.vTc\|\|(ea.vTc=ea.Okc,fa.ma.ja(K.a.Okc,T.a.frame,ea.vTc)),fa.J&&fa.J.Z("AccessibleMovingDialogsEnabled")&&(ea.CTc\|\|(ea.CTc=this.kwi,fa.ma.ja(K.a.g1f,T.a.frame,ea.CTc)),ea.yTc\|\|(ea.yTc=this.qdh,fa.ma.ja(K.a.H8g,T.a.frame,ea.yTc))),this.D5());fa.alc();ea.eXf("hidden");this.H$i();this.nba();fa.fa&&fa.fa.Ha.B0f&&this.MV();this.Ieb&&this.IJa(this.pdb(this.Y4a));fa.fa&&!fa.fa.Ha.B0f&&this.MV()}D5(){if(J.FocusManager.Vr()){var fa= source: chromecache_318.9.dr, chromecache_310.9.dr
Source:	Binary string: t.Vc(8);for(A=t.Rc();A;){if(K.im(A)&&K.Uta(A.properties))return!0;A=t.$f()}return!1}static Pdb(t){return K.Sj.Pdb(t)}static uH(t){return K.Sj.uH(t)}static NYa(t){return K.Sj.NYa(t)}static zFd(t){return K.UXa()?t.ka(D.a.$uc,!1):3===K.Pdb(t)}static Xq(t){return K.Sj.Xq(t)}static yFa(t){return(t=K.vn(t))?K.Xq(t):0}static Doh(t){return(t=K.vn(t))?t.ka(D.a.ZRe,!1):!1}static t_h(t){return 5===K.yFa(t)}static r_h(t){return 10===K.yFa(t)}static s_h(t){return 48===K.yFa(t)}static pkd(t){return K.Doh(t)}static w_h(t){return 11=== source: chromecache_318.9.dr, chromecache_310.9.dr

Source: San Xavier District of the Tohono O#U2019odham Nation.pdf	Initial sample: PDF keyword /JS count = 0
Source: San Xavier District of the Tohono O#U2019odham Nation.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: San Xavier District of the Tohono O#U2019odham Nation.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://fb.me/use-check-prop-types	0%	URL Reputation	safe
https://reactjs.org/link/react-polyfills	0%	URL Reputation	safe
https://feross.org	0%	URL Reputation	safe
https://feross.org/opensource	0%	URL Reputation	safe
https://roaming.officeapps.partner.office365.cn/rs/v1/settings	0%	Avira URL Cloud	safe
https://whiteboard.apps.mil	0%	Avira URL Cloud	safe
https://my.microsoftpersonalcontent.com	0%	Avira URL Cloud	safe
https://cdn.fluidpreview.office.net/fluid/prod	0%	Avira URL Cloud	safe
https://baycitymi-my.sharepoint.com/:o:/g/personal/avogel_baycitymi_gov/Elmi9pmfBD9FsxTL7-oQ2IoBeHOG7eWvLU9bAnRZwDCz7Q?e=tcLUbt	0%	Avira URL Cloud	safe
https://cdn.dev.fluidpreview.office.net/fluid/dev	0%	Avira URL Cloud	safe
https://whiteboard.office365.us	0%	Avira URL Cloud	safe
https://roaming.osi.office.de/rs/v1/settings	0%	Avira URL Cloud	safe
https://cdn.fluidpreview.office.net	0%	Avira URL Cloud	safe
https://whiteboard.microsoft.scloud	0%	Avira URL Cloud	safe
https://1drv.ms	0%	Avira URL Cloud	safe
https://attributes.engagement.officeppe.com	0%	Avira URL Cloud	safe
https://whiteboard.eaglex.ic.gov	0%	Avira URL Cloud	safe
https://roaming.osi.apps.mil/rs/v1/settings	0%	Avira URL Cloud	safe
https://fa000000096.resources.office.net	0%	Avira URL Cloud	safe
https://roaming.osi.office365.us/rs/v1/settings	0%	Avira URL Cloud	safe
https://cdn.dev.fluidpreview.office.net	0%	Avira URL Cloud	safe
https://cdn.fluidpreview.office.net/fluid/gcc	0%	Avira URL Cloud	safe
https://baycitymi-my.sharepoint.com/:o:/g/personal/avogel_baycitymi_gov/Elmi9pmfBD9FsxTL7-oQ2IoBeHOG	0%	Avira URL Cloud	safe
https://cdn.fluidpreview.office.net/fluid/df	0%	Avira URL Cloud	safe
https://attributes.engagement.office.com	0%	Avira URL Cloud	safe
https://fa000000096.resources.office.net/f7024bdc-7caf-4ca8-807d-2908f09640d6/1.0.2401.26003/en-us_w	0%	Avira URL Cloud	safe
https://whiteboard.office.com/root/index.fluid.js	0%	Avira URL Cloud	safe
https://cdn.dev.fluidpreview.office.net/fluid/stg	0%	Avira URL Cloud	safe
https://support.office.com/article/7afcb4f3-4aa2-443a-9b08-125a5d692576	0%	Avira URL Cloud	safe
https://attributes.engagement.office-int.com	0%	Avira URL Cloud	safe
https://github.com/uuidjs/uuid#getrandomvalues-not-supported	0%	Avira URL Cloud	safe
https://fa000000096.resources.office.net/f7024bdc-7caf-4ca8-807d-2908f09640d6/1.0.2210.23001/en-us_w	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
eafd-ffgov-phxr9b1-roxy-default-sni.aksroxy.azureedge.us	20.141.12.34	true	false	unknown
eafd-ffgov-snr9b1-roxy-default-sni.aksroxy.azureedge.us	20.140.56.69	true	false	unknown
mira-ssc.tm-4.office.com	52.107.243.70	true	false	unknown
www.google.com	142.250.185.164	true	false	unknown
eafd-ffgov-snr9b2-roxy-default-sni.aksroxy.azureedge.us	20.140.151.75	true	false	unknown
baycitymi-my.sharepoint.com	unknown	unknown	false	unknown
onenoteonline.nel.measure.office.net	unknown	unknown	false	unknown
gbc-common.online.office.com	unknown	unknown	false	unknown
m365cdn.nel.measure.office.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://baycitymi-my.sharepoint.com/:o:/g/personal/avogel_baycitymi_gov/Elmi9pmfBD9FsxTL7-oQ2IoBeHOG7eWvLU9bAnRZwDCz7Q?e=tcLUbt	false	Avira URL Cloud: safe	unknown
https://baycitymi-my.sharepoint.com/:o:/g/personal/avogel_baycitymi_gov/Elmi9pmfBD9FsxTL7-oQ2IoBeHOG7eWvLU9bAnRZwDCz7Q?rtime=65CvKcrG3Eg	false		unknown
https://baycitymi-my.sharepoint.com/personal/avogel_baycitymi_gov/_layouts/15/Doc.aspx?sourcedoc=%7B99f6a259-049f-453f-b314-cbefea10d88a%7D&action=default&slrid=08764aa1-8002-6000-4edd-0ec3c14769fb&originalPath=aHR0cHM6Ly9iYXljaXR5bWktbXkuc2hhcmVwb2ludC5jb20vOm86L2cvcGVyc29uYWwvYXZvZ2VsX2JheWNpdHltaV9nb3YvRWxtaTlwbWZCRDlGc3hUTDctb1EySW9CZUhPRzdlV3ZMVTliQW5SWndEQ3o3UT9ydGltZT02NUN2S2NyRzNFZw&CID=5e7c16d6-5e9c-424b-ad78-f90465cf4904&_SRM=0:G:111	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://roaming.officeapps.partner.office365.cn/rs/v1/settings	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://whiteboard.apps.mil	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://cdn.fluidpreview.office.net/fluid/prod	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://my.microsoftpersonalcontent.com	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://cdn.dev.fluidpreview.office.net/fluid/dev	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://cdn.fluidpreview.office.net	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://whiteboard.office365.us	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://roaming.osi.office.de/rs/v1/settings	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://whiteboard.microsoft.scloud	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
http://fb.me/use-check-prop-types	chromecache_332.9.dr, chromecache_291.9.dr	false	URL Reputation: safe	unknown
https://1drv.ms	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://attributes.engagement.officeppe.com	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://whiteboard.eaglex.ic.gov	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://roaming.osi.office365.us/rs/v1/settings	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://reactjs.org/link/react-polyfills	chromecache_291.9.dr	false	URL Reputation: safe	unknown
https://feross.org	chromecache_318.9.dr, chromecache_310.9.dr	false	URL Reputation: safe	unknown
https://feross.org/opensource	chromecache_318.9.dr, chromecache_310.9.dr	false	URL Reputation: safe	unknown
https://roaming.osi.apps.mil/rs/v1/settings	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://fa000000096.resources.office.net	chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://cdn.dev.fluidpreview.office.net	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://cdn.fluidpreview.office.net/fluid/gcc	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://baycitymi-my.sharepoint.com/:o:/g/personal/avogel_baycitymi_gov/Elmi9pmfBD9FsxTL7-oQ2IoBeHOG	San Xavier District of the Tohono O#U2019odham Nation.pdf	false	Avira URL Cloud: safe	unknown
https://cdn.fluidpreview.office.net/fluid/df	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://whiteboard.office.com/root/index.fluid.js	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://attributes.engagement.office.com	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://cdn.dev.fluidpreview.office.net/fluid/stg	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://fa000000096.resources.office.net/f7024bdc-7caf-4ca8-807d-2908f09640d6/1.0.2401.26003/en-us_w	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7afcb4f3-4aa2-443a-9b08-125a5d692576	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://attributes.engagement.office-int.com	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://fa000000096.resources.office.net/f7024bdc-7caf-4ca8-807d-2908f09640d6/1.0.2210.23001/en-us_w	chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown
https://github.com/uuidjs/uuid#getrandomvalues-not-supported	chromecache_318.9.dr, chromecache_310.9.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.107.243.70	mira-ssc.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.132	unknown	United States	15169	GOOGLEUS	false
20.140.151.75	eafd-ffgov-snr9b2-roxy-default-sni.aksroxy.azureedge.us	United States	8070	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.141.12.34	eafd-ffgov-phxr9b1-roxy-default-sni.aksroxy.azureedge.us	United States	8070	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.78.188.188	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.140.56.69	eafd-ffgov-snr9b1-roxy-default-sni.aksroxy.azureedge.us	United States	8070	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.17
192.168.2.16
192.168.2.18
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500077
Start date and time:	2024-08-27 20:56:36 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	San Xavier District of the Tohono O#U2019odham Nation.pdf renamed because original name is a hash value
Original Sample Name:	San Xavier District of the Tohono Oodham Nation.pdf
Detection:	SUS
Classification:	sus23.phis.winPDF@45/122@24/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 107.22.247.231, 18.207.85.246, 54.144.73.197, 34.193.227.236, 162.159.61.3, 172.64.41.3, 2.16.241.15, 2.16.241.13, 93.184.221.240, 23.46.15.9, 192.229.221.95, 142.250.185.67, 216.58.206.78, 66.102.1.84, 34.104.35.123, 23.38.98.104, 23.38.98.96, 52.108.66.1, 142.250.186.106, 172.217.18.106, 142.250.74.202, 142.250.185.106, 142.250.185.74, 216.58.206.42, 172.217.16.202, 142.250.184.234, 172.217.23.106, 142.250.185.202, 142.250.186.138, 142.250.185.138, 142.250.184.202, 142.250.185.170, 216.58.212.138, 142.250.186.170, 23.38.98.97, 23.38.98.84, 52.108.140.0, 2.19.126.143, 2.19.126.146, 23.60.216.210, 23.10.216.208, 20.189.173.18, 20.189.173.1, 142.250.184.227, 2.16.238.152, 2.16.238.149, 2.19.126.199, 2.19.126.200, 72.247.153.209, 72.247.153.153, 142.250.185.238, 23.38.189.26, 23.38.189.42, 104.208.16.91, 52.168.117.171
Excluded domains from analysis (whitelisted): onedscolprdwus00.westus.cloudapp.azure.com, slscr.update.microsoft.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, acroipm2.adobe.com, gbc-onenote-afd.officeapplf.live.com.akadns.net, onedscolprdcus17.centralus.cloudapp.azure.com, a1952.dscq.akamai.net, s1-onenote-15.cdn.office.net, clients2.google.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, wise.gcc.cdn.office.net, apps.identrust.com, wu-b-net.trafficmanager.net, wildcard.cdn.office.net.edgekey.net, res-2-gcc.cdn.office.net, fs.microsoft.com, identrust.edgesuite.net, acroipm2.adobe.com.edgesuite.net, res-1-gcc.cdn.office.net, edgedl.me.gvt1.com, nel.measure.office.net.edgesuite.net, clients.l.google.com, geo2.adobe.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, res-2-gcc.cdn.office.net.edgekey.net, e40491.dscd.akamaiedge.net, e7204.dspg.akamaiedge.net, a1894.dscb.akamai.net, onedsc
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: San Xavier District of the Tohono O#U2019odham Nation.pdf

Simulations

Behavior and APIs

Time	Type	Description
14:57:40	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.78.188.188	Murexltd Mail Security Update Required For gjohnson@murexltd.com.msg	Get hash	malicious	HTMLPhisher	Browse
	Secured Doc-[aAO-49313]-2.pdf	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	Aging Report-429053.pdf	Get hash	malicious	HTMLPhisher	Browse
	Integra Lifesciences Open Benefits Enrollment.pdf	Get hash	malicious	Unknown	Browse
239.255.255.250	New Document from Highland Township Building Department.html	Get hash	malicious	HTMLPhisher	Browse
	https://sysadmononnu.ru/BW0W/	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	http://www.coredc.com	Get hash	malicious	Unknown	Browse
	(No subject) (61).eml	Get hash	malicious	HTMLPhisher	Browse
	nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml	Get hash	malicious	Unknown	Browse
	https://netorgft13995914-my.sharepoint.com/:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK	Get hash	malicious	Unknown	Browse
	httpsworker-nameless-haze-86e5.berwieberwieberwieberwieberwie.workers.deveba=.htm	Get hash	malicious	HTMLPhisher	Browse
20.140.56.69	https://weblaunch.blifax.com/listener3/redirect?l=e6df36b9-5af1-4758-b7e4-83fbf7f30dfb&id=e0d346f1-f241-ee11-acc4-000c295a2555&u=%68%74%74%70%25%33%41heinleinarchives.net%2Fnew%2F80701%2F%2Fa3Jpc3RpbmUuc29yZW5zZW5AcmVkd2lyZXNwYWNlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse
	https://60787e6d.2d6833402ad75639fa4e0298.workers.dev/?email=kristine.sorensen@redwirespace.com	Get hash	malicious	HTMLPhisher	Browse
	https://gcc.dcv.ms/chg3kbw3tV	Get hash	malicious	HTMLPhisher	Browse
	https://gcv.microsoft.us/wf1HuXWFXi	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://gcv.microsoft.us/wf1HuXWFXi	Get hash	malicious	HTMLPhisher	Browse
20.141.12.34	https://gcc.dcv.ms/i8Kf7mgiA8	Get hash	malicious	HTMLPhisher	Browse
	https://gcv.microsoft.us/kgRWagmalJ	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://url.us.m.mimecastprotect.com/s/kyINCpYnk3FnPVPtPeQKH?domain=gcv.microsoft.us	Get hash	malicious	HTMLPhisher	Browse
	https://gcv.microsoft.us/ZaEjOQljje	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://usaf.dps.mil/teams/13569/info/SitePages/Home.aspx	Get hash	malicious	HTMLPhisher	Browse
20.140.151.75	https://weblaunch.blifax.com/listener3/redirect?l=e6df36b9-5af1-4758-b7e4-83fbf7f30dfb&id=e0d346f1-f241-ee11-acc4-000c295a2555&u=%68%74%74%70%25%33%41heinleinarchives.net%2Fnew%2F80701%2F%2Fa3Jpc3RpbmUuc29yZW5zZW5AcmVkd2lyZXNwYWNlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse
	https://60787e6d.2d6833402ad75639fa4e0298.workers.dev/?email=kristine.sorensen@redwirespace.com	Get hash	malicious	HTMLPhisher	Browse
	https://gcv.microsoft.us/kgRWagmalJ	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
eafd-ffgov-snr9b2-roxy-default-sni.aksroxy.azureedge.us	https://gcc.dcv.ms/i8Kf7mgiA8	Get hash	malicious	HTMLPhisher	Browse	20.140.151.75
	https://weblaunch.blifax.com/listener3/redirect?l=e6df36b9-5af1-4758-b7e4-83fbf7f30dfb&id=e0d346f1-f241-ee11-acc4-000c295a2555&u=%68%74%74%70%25%33%41heinleinarchives.net%2Fnew%2F80701%2F%2Fa3Jpc3RpbmUuc29yZW5zZW5AcmVkd2lyZXNwYWNlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	20.140.151.75
	https://60787e6d.2d6833402ad75639fa4e0298.workers.dev/?email=kristine.sorensen@redwirespace.com	Get hash	malicious	HTMLPhisher	Browse	20.140.151.75
mira-ssc.tm-4.office.com	https://12dec6c2-3c78-e425-b87e-b20197f5da10.powerappsportals.com/	Get hash	malicious	Unknown	Browse	52.107.243.88
	https://netorgft11904377-my.sharepoint.com/:f:/g/personal/diwakar_d_symnn_com/Egh8Wigk3RNLgYl4YHrmY3wBASQTPrx6Li13Cr10RMG6nw?e=sSQT2N&xsdata=MDV8MDJ8UGhpc2hBbGVydHNARGV3YmVycnkuY29tfDQ3YjZjYWZiY2FmYjRiYzE5NjVkMDhkY2M1ZmJhZTM5fDg0YjdmNTM3ZmI3NjQyYjJhYzFiNDE1YTU1OTc3NjZjfDB8MHw2Mzg2MDI5MzE5OTY5Mjk2MjF8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=Q1R4VGhVK20rVytvaVJPWVRueXdFcTdmNU5xL0huZ3dzcjNFeERIMEx6Zz0%3d	Get hash	malicious	HTMLPhisher	Browse	52.107.225.8
	Corp.AcctPayable Payment Update.pdf	Get hash	malicious	Unknown	Browse	52.107.243.68
	https://wyattstowingzjsj-my.sharepoint.com/:f:/g/personal/bjones_wyattstowing_com/EjzAIQ7mUctGs25S241fgvEBS3R7FD7Mq_44HVe6sUvcYA?e=pxK	Get hash	malicious	Unknown	Browse	52.107.225.1
	http://url.uk.m.mimecastprotect.com/s/Qb9MCZ4z4h5VrB0KizfxuBiFFP	Get hash	malicious	Unknown	Browse	52.107.243.152
	https://ridgecomm-my.sharepoint.com/:f:/g/personal/mike_dickson_ridgecommunicate_com/EoIXqm_rhmNPgUmdh9oGxVYBOC8z-wLp52vmISycophX2A?e=pxBR5z	Get hash	malicious	HTMLPhisher	Browse	52.107.243.82
	https://brandscapewi-my.sharepoint.com/:o:/g/personal/cbraetsch_brandscape-online_com/EtDyLXmKWHJNlBoShRvCzXUBKEezMY-wbCulj2Qta1nXig?e=5%3aBOxRAk&at=9	Get hash	malicious	Unknown	Browse	52.107.243.66
	https://deacerousa2-my.sharepoint.com/:o:/g/personal/eservice_huynhlaw_com/Ekv2F9Kc_pJJuB-bxZ7Z5QcBrNuZWh85OaRkXp9nQSqCiQ?e=5%3aD7eLEH&at=9	Get hash	malicious	HTMLPhisher	Browse	52.107.242.226
	(No subject) (28).eml	Get hash	malicious	Unknown	Browse	52.107.243.94
	https://corroboree-my.sharepoint.com/:o:/g/personal/jim_corroboreegroup_com_au/EhkrUZo0A7NAnvRNEtKnYx0Bi8APjQb6lXmXpqhr_dptBQ?e=5%3ajUyr76&at=9	Get hash	malicious	HTMLPhisher	Browse	52.107.243.71
eafd-ffgov-snr9b1-roxy-default-sni.aksroxy.azureedge.us	https://weblaunch.blifax.com/listener3/redirect?l=e6df36b9-5af1-4758-b7e4-83fbf7f30dfb&id=e0d346f1-f241-ee11-acc4-000c295a2555&u=%68%74%74%70%25%33%41heinleinarchives.net%2Fnew%2F80701%2F%2Fa3Jpc3RpbmUuc29yZW5zZW5AcmVkd2lyZXNwYWNlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	20.140.56.69
	https://60787e6d.2d6833402ad75639fa4e0298.workers.dev/?email=kristine.sorensen@redwirespace.com	Get hash	malicious	HTMLPhisher	Browse	20.140.56.69
	https://gcc.dcv.ms/chg3kbw3tV	Get hash	malicious	HTMLPhisher	Browse	20.140.56.69
eafd-ffgov-phxr9b1-roxy-default-sni.aksroxy.azureedge.us	https://gcc.dcv.ms/i8Kf7mgiA8	Get hash	malicious	HTMLPhisher	Browse	20.141.12.34

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://www.coredc.com	Get hash	malicious	Unknown	Browse	13.107.246.67
	(No subject) (61).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml	Get hash	malicious	Unknown	Browse	52.98.242.242
	https://netorgft13995914-my.sharepoint.com/:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK	Get hash	malicious	Unknown	Browse	40.99.150.18
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	(No subject) (60).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.65.28
	Madisonwellsmedia546.pdf	Get hash	malicious	HTMLPhisher	Browse	52.98.171.226
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://www.coredc.com	Get hash	malicious	Unknown	Browse	13.107.246.67
	(No subject) (61).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml	Get hash	malicious	Unknown	Browse	52.98.242.242
	https://netorgft13995914-my.sharepoint.com/:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK	Get hash	malicious	Unknown	Browse	40.99.150.18
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	(No subject) (60).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.65.28
	Madisonwellsmedia546.pdf	Get hash	malicious	HTMLPhisher	Browse	52.98.171.226
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://www.coredc.com	Get hash	malicious	Unknown	Browse	13.107.246.67
	(No subject) (61).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml	Get hash	malicious	Unknown	Browse	52.98.242.242
	https://netorgft13995914-my.sharepoint.com/:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK	Get hash	malicious	Unknown	Browse	40.99.150.18
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	(No subject) (60).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.65.28
	Madisonwellsmedia546.pdf	Get hash	malicious	HTMLPhisher	Browse	52.98.171.226

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	httpsworker-nameless-haze-86e5.berwieberwieberwieberwieberwie.workers.deveba=.htm	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	doc1.exe	Get hash	malicious	Clipboard Hijacker, Snake Keylogger	Browse	23.1.237.91
	http://email.e.quickshipping.com/c/eJxszLFSxCAQgOGnId1lYHchWFDY5D042JOdXGJkg45v72ht-88_X03gYiw8cXILUIjBeze1RKEwBLTBu5CDj2gBGWPMD-I7P9wkCSyQjRCcRwKcq1uWSEzW40spdTFkef4YUjZtcp5yvM3lfZ-eqV3XqQZfDawG1jtv0ud8ZeUmfc8b99_PwPp13uQoz1FZDaydq3QulwHUPatmQ3a079vQP7an_-pngp8AAAD__zWIRVU	Get hash	malicious	Unknown	Browse	23.1.237.91
	Status Update ECKY2.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.1.237.91
	Madisonwellsmedia546.pdf	Get hash	malicious	Unknown	Browse	23.1.237.91
	Inv-Info98.htm	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	ATT09876.htm	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFl8RKvJCjgfWXgpyGiQbouwIVFCzJZdO6C7IEJWnFiPmUdkD_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOJptL-2BsSl02HxRvbllikFuSJtHHDkVwyIj5AuFgiubBu9sTxc8j0-2BQG5wldcZa7WyDp4BZYdRmFKi1MU2RpCFoGVLX1rLVx-2BFFfe8ZtbBDm0OusvqG9hc8jycErQH9w4yo0iZBNb6ruS35AQpqe-2Bn9sSG0dYdsEjJuPPD68-2FQoiA15kbRIRZcVBuBtywmpClclGh64Ps2rLg6E3U3-2Ft-2B24zaJbCf8tvrjozgadicpaRwQ3KIy53pMZsOUCbTeEqGc-3D#bGFtYmVydC5nZW9yZ2lhQGFpZGIub3Jn	Get hash	malicious	Unknown	Browse	23.1.237.91
	Gov Annual Salary + Employer - Provided Benefits.pdf	Get hash	malicious	Phisher	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	New Document from Highland Township Building Department.html	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27
	https://sysadmononnu.ru/BW0W/	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	http://www.coredc.com	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	(No subject) (61).eml	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27
	nested-ConsultTrustNorth-payment Requisition #42 3L# 1414 18 Dock.pdf..eml	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://netorgft13995914-my.sharepoint.com/:f:/g/personal/joshg_tekton-builder_com1/Em3c3_jzJWtIg7W_bMwKbCgB2tM26D8KPHUEkttYIezrMg?e=3Aq2bK	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	httpsworker-nameless-haze-86e5.berwieberwieberwieberwieberwie.workers.deveba=.htm	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27
	(No subject) (60).eml	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.213924329945855
Encrypted:	false
SSDEEP:	6:N7IndL+q2P92nKuAl9OmbnIFUt887Inl1Zmw+87InzLVkwO92nKuAl9OmbjLJ:N7a+v4HAahFUt887e1/+87YV5LHAaSJ
MD5:	7D1B6C01574BA5A6E552527742CAA1E1
SHA1:	80CFFC56EEDBE13DFA3F60C483479D2AFFC16E6D
SHA-256:	09EF6969FC86EC2BE1E23F6E9AA7C3981024C4850B5B7CF03D27A31F79FCAF50
SHA-512:	7777276172B03EEB1F3A22B8873C29EF86E8E2CE4D6A843321B8E9C9A7B034F2926ED0042A3ED6B79F80516F76DA7D2B64EB74643655655D4BFBE7D450E7059B
Malicious:	false
Reputation:	low
Preview:	2024/08/27-14:57:27.087 87c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/08/27-14:57:27.089 87c Recovering log #3.2024/08/27-14:57:27.089 87c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	5074
Entropy (8bit):	7.873570030600911
Encrypted:	false
SSDEEP:	96:m3Rjcy7UMnDwqA4XSnl3xzHD8ciYkEMEpSu3UnANw98ZcYQGbNN5hh9qqEF3r:c49MnDnSBJDPhkr8iwo8ZNNf1RE1r
MD5:	EF5170D473FDC4620529500766D80D2A
SHA1:	B967D05D775C2B711F8B4F5D9F941F5B57AAC8AF
SHA-256:	2E60E371C11FB8B17F3DB90C9E66B35CE8C61C40226B64E919A08BD7D9A9346C
SHA-512:	37938D2DA1DEA2CFC3FB149BBEAD69795DA7620FF1D97E611641F0F767EFCDF3BFA8ACA038D5F774C0B96191553DB139E659DF4BA2F947D11AE823D0FFDB17D1
Malicious:	false
Preview:	Cr24....E.........0.."0....H.............0.........:.2.W.))...I...5_U(I7nz...2[.;..H...S.../...nb%Yx.6.]i.....u...PDF.i.LJK.?....l.....R...\|...j...C..j!.%'..s....[."...Gy...=l)..=.l\....4..Q!$e.=...C.1.%d..B...K.[.l,.....7......y...$7J..G&TT..W.-=jgs[...&.@/.j$....+...yk\|l^..Km)\Y..x..}OCXf.....A5s.7..8..o....L..(p[...^e......?&X..:~,.)..C..n...Hh.....<..N..0.....woa6....'&y....tH..7@..a.t.....F..YQU......<......m!..^.#f.'F".....lt..97U3f...WM....]Lw...)..x...)..Hy Z...l.a.)J~'.y.o.NS.#.,6.D.9UMW..l>.pa.WG.^..L,..B...."p.Y.....<..............s.'..k...-.%.B......r.y.....I.s.C....LD.....u.I.K...AOS.O.q....p.c...`.iQ..\...Z...Y....C...d^.[P...Vbl..>>..E....K...\%\|s....,.cF.h........&...rq:+...x.......w..<.zJd....i_.Pu..W...L.....W.%...\....A..}u...<T...?..=...e..N.,.^..Vu....}...."....uZ]c....DEN..W....)...L..W~.e9.o.Vh..xa.$.$..q.i..`}..?..C..}UC..p.,.1./..0..`$...+^9@..G..7....3.e..F_........)6....g......!....B1*..x.v.y+?.9.)`4-.(....<..Z`.

File type:	PDF document, version 1.7, 1 pages
Entropy (8bit):	7.6224137457354075
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	San Xavier District of the Tohono O#U2019odham Nation.pdf
File size:	50'244 bytes
MD5:	e04af1af7f451ca7e8d4fe6c13d2f9fe
SHA1:	aab9b37a10fc9291c28ef044624d4129e6728f92
SHA256:	51f056df8dfcde11515753ca915517ce4d76972e6979247d9e0b33c28f8c4afe
SHA512:	c0abf7dc1a406ed5bd7b154e4abccc72b63fdab3524454cf7d105e962d945eb01c36f80115444d2029229e23c5bdea623e96bc89bd85b438653abefeec934dac
SSDEEP:	768:y2IDmH9ygQS2zm/qU+28kcwfaSc0j2qVJjF+c/6Bd3/sI80Orph0axXdIVltNVG:rygQlUb8vaaSMCFq/LzcXd21s
TLSH:	FC33C10389091BC2952D86E87E436E99AF56674CE8C56DEF34AF4E833B507331C0E55E
File Content Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 12 0 R/MarkInfo<</Marked true>>/Metadata 26 0 R/ViewerPreferences 27 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/A

General
Header:	%PDF-1.7
Total Entropy:	7.622414
Total Bytes:	50244
Stream Entropy:	7.625383
Stream Bytes:	46985
Entropy outside Streams:	5.425987
Bytes outside Streams:	3259
Number of EOF found:	2
Bytes after EOF:

Name	Count
obj	17
endobj	17
stream	6
endstream	6
xref	2
trailer	2
startxref	2
/Page	1
/Encrypt	0
/ObjStm	1
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 20:57:53.681799889 CEST	53715	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:57:53.681936979 CEST	60853	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:57:53.780936003 CEST	53	63580	1.1.1.1	192.168.2.5
Aug 27, 2024 20:57:53.781358004 CEST	53	49317	1.1.1.1	192.168.2.5
Aug 27, 2024 20:57:55.863356113 CEST	53	49449	1.1.1.1	192.168.2.5
Aug 27, 2024 20:57:58.292660952 CEST	57155	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:57:58.292932034 CEST	57536	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:57:58.301897049 CEST	53	57155	1.1.1.1	192.168.2.5
Aug 27, 2024 20:57:58.301913023 CEST	53	57536	1.1.1.1	192.168.2.5
Aug 27, 2024 20:57:58.520236969 CEST	53	52229	1.1.1.1	192.168.2.5
Aug 27, 2024 20:58:00.961445093 CEST	53	64753	1.1.1.1	192.168.2.5
Aug 27, 2024 20:58:01.643121004 CEST	58144	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:58:01.643265009 CEST	49463	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:58:01.665559053 CEST	53	49463	1.1.1.1	192.168.2.5
Aug 27, 2024 20:58:01.822829008 CEST	52551	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:58:01.823009014 CEST	65336	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:58:32.417428970 CEST	50517	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:58:32.417742968 CEST	62364	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:58:32.439389944 CEST	53	62364	1.1.1.1	192.168.2.5
Aug 27, 2024 20:58:53.508318901 CEST	53	55221	1.1.1.1	192.168.2.5
Aug 27, 2024 20:59:01.678874016 CEST	53	54973	1.1.1.1	192.168.2.5
Aug 27, 2024 20:59:01.825416088 CEST	52205	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:59:01.825901031 CEST	57981	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:59:01.827791929 CEST	62119	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:59:01.827964067 CEST	58463	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:59:01.828280926 CEST	62577	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:59:01.828422070 CEST	58680	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:59:02.781689882 CEST	56766	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:59:02.781824112 CEST	50150	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:59:58.404367924 CEST	55764	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:59:58.404544115 CEST	61865	53	192.168.2.5	1.1.1.1
Aug 27, 2024 20:59:58.411170006 CEST	53	55764	1.1.1.1	192.168.2.5
Aug 27, 2024 20:59:58.411396027 CEST	53	61865	1.1.1.1	192.168.2.5
Aug 27, 2024 21:00:02.970319986 CEST	53801	53	192.168.2.5	1.1.1.1
Aug 27, 2024 21:00:02.970917940 CEST	49755	53	192.168.2.5	1.1.1.1
Aug 27, 2024 21:00:32.049576044 CEST	52088	53	192.168.2.5	1.1.1.1
Aug 27, 2024 21:00:32.049959898 CEST	63560	53	192.168.2.5	1.1.1.1
Aug 27, 2024 21:00:32.771748066 CEST	53	63560	1.1.1.1	192.168.2.5

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 27, 2024 20:57:58.124574900 CEST	192.168.2.5	1.1.1.1	c283	(Port unreachable)	Destination Unreachable
Aug 27, 2024 20:58:00.468868971 CEST	192.168.2.5	1.1.1.1	c2a4	(Port unreachable)	Destination Unreachable
Aug 27, 2024 20:58:03.830136061 CEST	192.168.2.5	1.1.1.1	c285	(Port unreachable)	Destination Unreachable
Aug 27, 2024 20:58:04.708780050 CEST	192.168.2.5	1.1.1.1	c285	(Port unreachable)	Destination Unreachable
Aug 27, 2024 20:58:06.377238989 CEST	192.168.2.5	1.1.1.1	c2e6	(Port unreachable)	Destination Unreachable
Aug 27, 2024 20:58:08.897598982 CEST	192.168.2.5	1.1.1.1	c2e7	(Port unreachable)	Destination Unreachable
Aug 27, 2024 20:59:01.859405041 CEST	192.168.2.5	1.1.1.1	c28a	(Port unreachable)	Destination Unreachable
Aug 27, 2024 21:00:34.016540051 CEST	192.168.2.5	1.1.1.1	c2e6	(Port unreachable)	Destination Unreachable
Aug 27, 2024 21:00:36.761182070 CEST	192.168.2.5	1.1.1.1	c330	(Port unreachable)	Destination Unreachable
Aug 27, 2024 21:00:37.889528990 CEST	192.168.2.5	1.1.1.1	c2e6	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:57:34 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-27 18:57:34 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF17) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=74572 Date: Tue, 27 Aug 2024 18:57:34 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:57:35 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-27 18:57:35 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=78485 Date: Tue, 27 Aug 2024 18:57:35 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-27 18:57:35 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:57:41 UTC	475	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br If-None-Match: "78-5faa31cce96da" If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
2024-08-27 18:57:41 UTC	198	IN	HTTP/1.1 304 Not Modified Content-Type: text/plain; charset=UTF-8 Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Date: Tue, 27 Aug 2024 18:57:41 GMT Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:57:43 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=8dzolmfARCn+Aww&MD=6lVLXk7B HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-27 18:57:43 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 802d1723-38ec-45fd-924f-481c3a93c623 MS-RequestId: 8c6f3612-0864-4e2c-9611-11a777bfa4b6 MS-CV: pwcBjthT8EO47muB.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 27 Aug 2024 18:57:43 GMT Connection: close Content-Length: 24490
2024-08-27 18:57:43 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-27 18:57:43 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:57:55 UTC	761	OUT	GET /:o:/g/personal/avogel_baycitymi_gov/Elmi9pmfBD9FsxTL7-oQ2IoBeHOG7eWvLU9bAnRZwDCz7Q?e=tcLUbt HTTP/1.1 Host: baycitymi-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 18:57:56 UTC	3929	IN	HTTP/1.1 302 Cache-Control: private Content-Length: 584 Content-Type: text/html; charset=utf-8 Location: https://baycitymi-my.sharepoint.com/personal/avogel_baycitymi_gov/_layouts/15/Doc.aspx?sourcedoc=%7B99f6a259-049f-453f-b314-cbefea10d88a%7D&action=default&slrid=08764aa1-8002-6000-4edd-0ec3c14769fb&originalPath=aHR0cHM6Ly9iYXljaXR5bWktbXkuc2hhcmVwb2ludC5jb20vOm86L2cvcGVyc29uYWwvYXZvZ2VsX2JheWNpdHltaV9nb3YvRWxtaTlwbWZCRDlGc3hUTDctb1EySW9CZUhPRzdlV3ZMVTliQW5SWndEQ3o3UT9ydGltZT02NUN2S2NyRzNFZw&CID=5e7c16d6-5e9c-424b-ad78-f90465cf4904&_SRM=0:G:111 Server: Microsoft-IIS/10.0 request-id: 894f16a8-d7b3-6be6-3293-a9d770961e08 X-BackEndHttpStatus: 302 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzViMWNmMWY3YjBmYTE2ZGQzMGNmOTVmNjE1NmZhYTQyNzQyNTczOTIyMDNmODJlZDk3MGJkY2NiOGQ5ZWE4YzgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNWIxY2YxZjdiMGZhMTZkZDMwY2Y5NWY2MTU2ZmFhNDI3NDI1NzM5MjIwM2Y4MmVkOTcwYmRjY2I4ZDllYThjOCwxMzM2OTI1ODk3NjAwMDAwMDAsMCwxMzM2OTM0NTA3NjQzNjQyMjAsMC4wLjAuMCwyNTgsZjhiOTkyZTctYzYwYy00MWE1LTk3ZGItNWJjOWNkMWE5ODU0LCwsMDg3NjRhYTEtODAwMi02MDAwLTRlZGQtMGVjM2MxNDc2OWZiLDA4NzY0YWExLTgwMDItNjAwMC00ZWRkLTBlYzNjMTQ3NjlmYixwTkVCZWQvM2pFZTVlNHFIY2kzTFl3LDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIzMjcsLUg5ZzhtM01DREpWV2pVbHVlRmpFODRCdVpVLG5ab3dtNHhLQ1B0UWdGUTRYWlF6K015ZVgvS0o3dnVpQmEyU3FMSW1FdXNPOEZvL2JTZUZRVTJRU0NZcFZVTk9vU3Q5VVBQOHI3L2dCczJmaytQcTE4QkVZQ1FrNkV2RVFCaFlGMGcxcnIyVlhsNlN4bVFYbmVhcEFmb1pPem9VeGFwaFVrMFloUGFOYWduNEdRRnc5b243ZmVWK0FOUXVZa3BGdnVxUFhqa3FYY0VST1dmQXdRcUozWHRTY3BaSVNSSmEvS2ltdUVOYVFJdSt5QXJ2MHVqN1BTaEo5SXlHdEpZcDdFRFpvdzhyRXMzdVNPZk1T [TRUNCATED] x-networkstatistics: 0,525568,0,0,194,0,26280,88 x-sharepointhealthscore: 3 x-ms-spo-cookievalidator: nZowm4xKCPtQgFQ4XZQz+MyeX/KJ7vuiBa2SqLImEusO8Fo/bSeFQU2QSCYpVUNOoSt9UPP8r7/gBs2fk+Pq18BEYCQk6EvEQBhYF0g1rr2VXl6SxmQXneapAfoZOzoUxaphUk0YhPaNagn4GQFw9on7feV+ANQuYkpFvuqPXjkqXcEROWfAwQqJ3XtScpZISRJa/KimuENaQIu+yArv0uj7PShJ9IyGtJYp7EDZow8rEs3uSOfMSUQx93sz7TmrAKUQY0RwheqIfOh53Knsdl/UobyiT2CHmfpCTEmVtr7Q72pIAPY+QF3EIaliYrAZUEXdY8/zyGT2ugce3dLGTg== x-aspnet-version: 4.0.30319 x-databoundary: NONE x-1dscollectorurl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ x-ariacollectorurl: https://browser.pipe.aria.microsoft.com/Collector/3.0/ ms-cv: oUp2CAKAAGBO3Q7DwUdp+w.0 strict-transport-security: max-age=31536000 x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com; sprequestduration: 234 spiislatency: 3 microsoftsharepointteamservices: 16.0.0.25207 x-content-type-options: nosniff x-ms-invokeapp: 1; RequireReadOnly X-Proxy-RoutingCorrectness: 1 X-MSEdge-Ref: MIRA: 894f16a8-d7b3-6be6-3293-a9d770961e08 FR3P281CA0068 2024-08-27T18:57:55.971Z Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 SPRequestGuid: 08764aa1-8002-6000-4edd-0ec3c14769fb X-Proxy-BackendServerStatus: 302 X-FirstHopCafeEFZ: HHN X-FEProxyInfo: FR3P281CA0068.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: HHN X-Powered-By: ASP.NET X-FEServer: FR3P281CA0068 Date: Tue, 27 Aug 2024 18:57:55 GMT Connection: close
2024-08-27 18:57:56 UTC	584	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 61 79 63 69 74 79 6d 69 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 61 76 6f 67 65 6c 5f 62 61 79 63 69 74 79 6d 69 5f 67 6f 76 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 44 6f 63 2e 61 73 70 78 3f 73 6f 75 72 63 65 64 6f 63 3d 25 37 42 39 39 66 36 61 32 35 39 2d 30 34 39 66 2d 34 35 33 66 2d 62 33 31 34 2d 63 62 65 66 65 61 31 30 64 38 38 61 25 37 44 26 61 6d 70 3b 61 63 74 69 6f 6e 3d 64 65 66 61 75 6c 74 26 61 6d 70 3b 73 6c 72 69 64 3d 30 38 37 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://baycitymi-my.sharepoint.com/personal/avogel_baycitymi_gov/_layouts/15/Doc.aspx?sourcedoc=%7B99f6a259-049f-453f-b314-cbefea10d88a%7D&action=default&slrid=087

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:57:57 UTC	2243	OUT	GET /personal/avogel_baycitymi_gov/_layouts/15/Doc.aspx?sourcedoc=%7B99f6a259-049f-453f-b314-cbefea10d88a%7D&action=default&slrid=08764aa1-8002-6000-4edd-0ec3c14769fb&originalPath=aHR0cHM6Ly9iYXljaXR5bWktbXkuc2hhcmVwb2ludC5jb20vOm86L2cvcGVyc29uYWwvYXZvZ2VsX2JheWNpdHltaV9nb3YvRWxtaTlwbWZCRDlGc3hUTDctb1EySW9CZUhPRzdlV3ZMVTliQW5SWndEQ3o3UT9ydGltZT02NUN2S2NyRzNFZw&CID=5e7c16d6-5e9c-424b-ad78-f90465cf4904&_SRM=0:G:111 HTTP/1.1 Host: baycitymi-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzViMWNmMWY3YjBmYTE2ZGQzMGNmOTVmNjE1NmZhYTQyNzQyNTczOTIyMDNmODJlZDk3MGJkY2NiOGQ5ZWE4YzgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNWIxY2YxZjdiMGZhMTZkZDMwY2Y5NWY2MTU2ZmFhNDI3NDI1NzM5MjIwM2Y4MmVkOTcwYmRjY2I4ZDllYThjOCwxMzM2OTI1ODk3NjAwMDAwMDAsMCwxMzM2OTM0NTA3NjQzNjQyMjAsMC4wLjAuMCwyNTgsZjhiOTkyZTctYzYwYy00MWE1LTk3ZGItNWJjOWNkMWE5ODU0LCwsMDg3NjRhYTEtODAwMi02MDAwLTRlZGQtMGVjM2MxNDc2OWZiLDA4NzY0YWExLTgwMDItNjAwMC00ZWRkLTBlYzNjMTQ3NjlmYixwTkVCZWQvM2pFZTVlNHFIY2kzTFl3LDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIzMjcsLUg5ZzhtM01DREpWV2pVbHVlRmpFODRCdVpVLG5ab3dtNHhLQ1B0UWdGUTRYWlF6K015ZVgvS0o3dnVpQmEyU3FMSW1FdXNPOEZvL2JTZUZRVTJRU0NZcFZVTk9vU3Q5VVBQOHI3L2dCczJmaytQcTE4QkVZQ1FrNkV2RVFCaFlGMGcxcnIyVlhsNlN4bVFYbmVhcEFmb1pPem9VeGFwaFVrMFloUGFOYWduNEdRRnc5b243ZmVWK0FOUXVZa3BGdnVxUFhqa3FYY0VST1dmQXdRcUozWHRTY3BaSVNSSmEvS2ltdUVOYVFJdSt5QXJ2MHVqN1BTaEo5SXlHdEpZcDdFRFpvdzhyRXMzdVNPZk1TVVF4 [TRUNCATED]
2024-08-27 18:57:57 UTC	3224	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store Pragma: no-cache Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 request-id: 713bd5e9-534b-96b9-8629-399b9489187b X-BackEndHttpStatus: 200 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzViMWNmMWY3YjBmYTE2ZGQzMGNmOTVmNjE1NmZhYTQyNzQyNTczOTIyMDNmODJlZDk3MGJkY2NiOGQ5ZWE4YzgsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jNWIxY2YxZjdiMGZhMTZkZDMwY2Y5NWY2MTU2ZmFhNDI3NDI1NzM5MjIwM2Y4MmVkOTcwYmRjY2I4ZDllYThjOCwxMzM2OTI1ODk3NjAwMDAwMDAsMCwxMzM2OTM0NTA3NjQzNjQyMjAsMC4wLjAuMCwyNTgsZjhiOTkyZTctYzYwYy00MWE1LTk3ZGItNWJjOWNkMWE5ODU0LCwsMDg3NjRhYTEtODAwMi02MDAwLTRlZGQtMGVjM2MxNDc2OWZiLDA4NzY0YWExLTgwMDItNjAwMC00ZWRkLTBlYzNjMTQ3NjlmYixwTkVCZWQvM2pFZTVlNHFIY2kzTFl3LDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTIzMjcsLUg5ZzhtM01DREpWV2pVbHVlRmpFODRCdVpVLG5ab3dtNHhLQ1B0UWdGUTRYWlF6K015ZVgvS0o3dnVpQmEyU3FMSW1FdXNPOEZvL2JTZUZRVTJRU0NZcFZVTk9vU3Q5VVBQOHI3L2dCczJmaytQcTE4QkVZQ1FrNkV2RVFCaFlGMGcxcnIyVlhsNlN4bVFYbmVhcEFmb1pPem9VeGFwaFVrMFloUGFOYWduNEdRRnc5b243ZmVWK0FOUXVZa3BGdnVxUFhqa3FYY0VST1dmQXdRcUozWHRTY3BaSVNSSmEvS2ltdUVOYVFJdSt5QXJ2MHVqN1BTaEo5SXlHdEpZcDdFRFpvdzhyRXMzdVNPZk1T [TRUNCATED] x-networkstatistics: 0,525568,0,0,1546,0,29772,98 x-sharepointhealthscore: 2 referrer-policy: no-referrer, strict-origin-when-cross-origin server-timing: LT; desc=0, RS; desc=G, RD; dur=111 x-aspnet-version: 4.0.30319 x-databoundary: NONE x-1dscollectorurl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ x-ariacollectorurl: https://browser.pipe.aria.microsoft.com/Collector/3.0/ ms-cv: oUp2CFdwAGBO3Qt2jn9CuA.0 strict-transport-security: max-age=31536000 x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com *.onedrive.live.com securebroker.sharepointonline.com; microsoftsharepointteamservices: 16.0.0.25207 x-content-type-options: nosniff x-ms-invokeapp: 1; RequireReadOnly X-Proxy-RoutingCorrectness: 1 X-MSEdge-Ref: MIRA: 713bd5e9-534b-96b9-8629-399b9489187b FR3P281CA0068 2024-08-27T18:57:57.565Z Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 SPRequestGuid: 08764aa1-7057-6000-4edd-0b768e7f42b8 X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: HHN X-FEProxyInfo: FR3P281CA0068.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: HHN X-Powered-By: ASP.NET X-FEServer: FR3P281CA0068 Date: Tue, 27 Aug 2024 18:57:57 GMT Connection: close
2024-08-27 18:57:57 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 09 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0d 0a 09 3c 6d 65 74 61 0d 0a 09 09 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0d 0a 09 09 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e Data Ascii: 2000<!DOCTYPE html><html lang="en-us" dir="ltr"><head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><metaname="viewport"content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=n
2024-08-27 18:57:57 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 61 61 64 54 65 6e 61 6e 74 49 64 22 3a 22 66 38 62 39 39 32 65 37 2d 63 36 30 63 2d 34 31 61 35 2d 39 37 64 62 2d 35 62 63 39 63 64 31 61 39 38 35 34 22 2c 22 69 73 53 50 4f 22 3a 74 72 75 65 2c 22 73 65 72 76 65 72 54 69 6d 65 22 3a 22 32 30 32 34 2d 30 38 2d 32 37 54 31 38 3a 35 37 3a 35 37 2e 36 35 35 32 35 31 34 5a 22 2c 22 45 78 70 46 65 61 74 75 72 65 73 22 3a 5b 2d 31 39 31 30 35 33 38 32 34 30 2c 31 30 37 39 33 31 31 31 30 35 2c 38 33 39 37 35 32 33 32 2c 36 33 38 35 32 35 34 36 38 2c 38 35 38 39 38 32 32 30 30 2c 2d 31 37 39 39 30 37 37 32 34 38 2c 38 30 32 36 39 33 31 34 2c 35 35 35 38 35 38 32 31 2c 32 37 33 32 Data Ascii: 2000":"https://login.microsoftonline.com","aadTenantId":"f8b992e7-c60c-41a5-97db-5bc9cd1a9854","isSPO":true,"serverTime":"2024-08-27T18:57:57.6552514Z","ExpFeatures":[-1910538240,1079311105,83975232,638525468,858982200,-1799077248,80269314,55585821,2732
2024-08-27 18:57:57 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 45 35 43 43 42 41 35 39 22 3a 31 2c 22 44 38 42 38 43 32 33 36 2d 42 36 42 41 2d 34 30 41 42 2d 41 30 46 41 2d 37 38 43 35 31 31 34 36 37 37 44 39 22 3a 31 2c 22 44 38 30 38 44 41 45 35 2d 32 38 37 43 2d 34 43 46 30 2d 42 36 44 37 2d 44 39 35 45 41 43 37 43 34 38 44 41 22 3a 31 2c 22 36 42 45 39 36 43 41 45 2d 38 34 45 34 2d 34 38 35 38 2d 39 31 32 35 2d 34 41 32 39 41 32 37 30 31 41 43 45 22 3a 31 2c 22 44 34 41 41 37 45 44 30 2d 31 30 35 30 2d 34 38 38 43 2d 42 33 46 39 2d 31 35 46 42 44 35 30 42 44 43 39 35 22 3a 31 2c 22 34 44 33 38 44 36 32 36 2d 33 32 38 42 2d 34 39 41 45 2d 39 34 32 41 2d 44 33 37 46 46 46 33 46 30 37 34 41 22 3a 31 2c 22 36 30 32 34 44 38 45 45 2d 38 33 41 39 2d 34 42 43 46 2d 39 34 43 30 2d 31 36 46 35 30 43 39 Data Ascii: 2000E5CCBA59":1,"D8B8C236-B6BA-40AB-A0FA-78C5114677D9":1,"D808DAE5-287C-4CF0-B6D7-D95EAC7C48DA":1,"6BE96CAE-84E4-4858-9125-4A29A2701ACE":1,"D4AA7ED0-1050-488C-B3F9-15FBD50BDC95":1,"4D38D626-328B-49AE-942A-D37FFF3F074A":1,"6024D8EE-83A9-4BCF-94C0-16F50C9
2024-08-27 18:57:57 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 46 45 39 2d 36 36 33 46 36 31 37 41 35 35 43 46 22 3a 31 2c 22 39 43 35 30 41 36 46 36 2d 32 34 38 37 2d 34 32 31 39 2d 38 44 36 31 2d 42 31 33 32 43 38 31 31 37 41 39 38 22 3a 31 2c 22 46 42 41 46 46 46 39 34 2d 38 33 46 46 2d 34 30 44 43 2d 41 33 33 32 2d 31 39 44 38 45 39 34 41 34 34 45 38 22 3a 31 2c 22 31 37 31 33 45 36 42 46 2d 36 33 37 32 2d 34 39 37 32 2d 39 43 36 31 2d 34 44 45 42 42 38 39 36 30 46 31 39 22 3a 31 2c 22 43 46 36 37 34 30 42 37 2d 42 39 41 36 2d 34 45 43 35 2d 42 44 31 36 2d 44 42 38 37 33 34 32 36 36 30 38 36 22 3a 31 2c 22 32 32 43 39 39 36 46 34 2d 30 30 32 37 2d 34 36 37 41 2d 41 30 46 37 2d 31 43 33 44 36 43 36 36 41 37 30 33 22 3a 31 2c 22 43 31 43 38 45 38 32 32 2d 38 42 39 42 2d 34 32 33 43 2d 39 35 35 31 Data Ascii: 2000FE9-663F617A55CF":1,"9C50A6F6-2487-4219-8D61-B132C8117A98":1,"FBAFFF94-83FF-40DC-A332-19D8E94A44E8":1,"1713E6BF-6372-4972-9C61-4DEBB8960F19":1,"CF6740B7-B9A6-4EC5-BD16-DB8734266086":1,"22C996F4-0027-467A-A0F7-1C3D6C66A703":1,"C1C8E822-8B9B-423C-9551
2024-08-27 18:57:57 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 30 2d 34 44 36 42 2d 39 39 35 43 2d 36 42 35 32 46 31 43 38 45 34 35 35 22 3a 31 2c 22 45 43 37 42 30 35 43 33 2d 41 34 42 33 2d 34 42 45 46 2d 42 33 46 39 2d 35 42 44 43 44 46 30 46 33 46 36 42 22 3a 31 2c 22 36 44 34 38 30 37 45 45 2d 34 32 38 31 2d 34 42 34 32 2d 39 30 36 32 2d 38 31 46 38 39 37 42 33 30 38 34 42 22 3a 31 2c 22 35 35 32 33 43 43 30 36 2d 31 36 43 43 2d 34 34 43 35 2d 41 33 43 43 2d 42 42 30 34 30 34 45 38 36 39 45 38 22 3a 31 2c 22 39 43 43 33 42 32 35 41 2d 38 38 38 34 2d 34 36 44 30 2d 39 31 35 31 2d 36 35 46 41 39 30 33 39 30 31 35 45 22 3a 31 2c 22 46 35 31 44 38 45 37 33 2d 38 30 37 30 2d 34 32 43 34 2d 41 46 33 34 2d 46 42 31 32 33 45 36 37 44 37 44 38 22 3a 31 2c 22 30 42 39 46 42 45 36 37 2d 39 33 36 41 2d 34 Data Ascii: 20000-4D6B-995C-6B52F1C8E455":1,"EC7B05C3-A4B3-4BEF-B3F9-5BDCDF0F3F6B":1,"6D4807EE-4281-4B42-9062-81F897B3084B":1,"5523CC06-16CC-44C5-A3CC-BB0404E869E8":1,"9CC3B25A-8884-46D0-9151-65FA9039015E":1,"F51D8E73-8070-42C4-AF34-FB123E67D7D8":1,"0B9FBE67-936A-4
2024-08-27 18:57:57 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 33 32 42 43 2d 30 33 33 34 2d 34 41 43 38 2d 38 35 34 35 2d 46 34 36 36 34 31 46 41 36 34 46 45 22 3a 31 2c 22 41 34 41 43 45 46 37 36 2d 33 38 42 30 2d 34 30 38 44 2d 42 45 43 37 2d 44 36 45 34 45 36 43 34 34 36 33 36 22 3a 31 2c 22 44 46 37 30 38 30 46 35 2d 37 32 45 33 2d 34 41 38 38 2d 41 38 44 35 2d 42 31 42 36 30 36 32 34 33 44 30 37 22 3a 31 2c 22 32 35 38 45 34 36 30 31 2d 39 41 39 39 2d 34 39 42 30 2d 42 36 35 41 2d 42 42 33 34 32 33 34 42 36 45 36 36 22 3a 31 2c 22 33 44 39 42 38 38 44 41 2d 34 45 30 43 2d 34 42 44 45 2d 39 30 35 34 2d 45 44 31 38 30 33 42 41 44 31 37 43 22 3a 31 2c 22 44 32 39 36 31 37 37 38 2d 43 38 45 37 2d 34 41 34 35 2d 38 35 35 32 2d 44 31 30 31 44 34 32 38 39 39 44 44 22 3a 31 2c 22 33 36 32 35 42 31 33 Data Ascii: 200032BC-0334-4AC8-8545-F46641FA64FE":1,"A4ACEF76-38B0-408D-BEC7-D6E4E6C44636":1,"DF7080F5-72E3-4A88-A8D5-B1B606243D07":1,"258E4601-9A99-49B0-B65A-BB34234B6E66":1,"3D9B88DA-4E0C-4BDE-9054-ED1803BAD17C":1,"D2961778-C8E7-4A45-8552-D101D42899DD":1,"3625B13
2024-08-27 18:57:57 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 3a 31 2c 22 35 41 43 35 33 34 35 46 2d 32 44 38 45 2d 34 38 35 35 2d 39 31 34 36 2d 46 46 46 31 41 30 32 32 31 39 32 39 22 3a 31 2c 22 34 44 30 42 46 32 33 41 2d 33 32 37 30 2d 34 34 43 42 2d 39 41 38 42 2d 30 38 34 45 30 41 33 36 41 42 42 41 22 3a 31 2c 22 38 44 32 45 44 32 32 32 2d 44 42 41 43 2d 34 43 38 32 2d 42 43 33 45 2d 32 34 42 34 44 35 39 30 37 46 31 30 22 3a 31 2c 22 45 33 36 43 35 38 37 34 2d 46 31 42 31 2d 34 31 30 35 2d 42 46 44 35 2d 44 36 44 43 35 36 30 34 41 34 42 32 22 3a 31 2c 22 35 41 43 30 32 33 43 39 2d 34 46 45 37 2d 34 37 42 34 2d 41 32 32 45 2d 32 44 38 34 45 35 35 31 32 43 31 33 22 3a 31 2c 22 44 37 46 46 44 44 44 36 2d 43 44 45 44 2d 34 44 45 32 2d 42 41 33 32 2d 42 36 42 33 31 31 44 36 46 39 33 36 22 3a 31 2c Data Ascii: 2000:1,"5AC5345F-2D8E-4855-9146-FFF1A0221929":1,"4D0BF23A-3270-44CB-9A8B-084E0A36ABBA":1,"8D2ED222-DBAC-4C82-BC3E-24B4D5907F10":1,"E36C5874-F1B1-4105-BFD5-D6DC5604A4B2":1,"5AC023C9-4FE7-47B4-A22E-2D84E5512C13":1,"D7FFDDD6-CDED-4DE2-BA32-B6B311D6F936":1,
2024-08-27 18:57:57 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 38 42 43 32 36 38 32 22 3a 31 2c 22 38 43 37 31 44 41 31 33 2d 30 39 44 31 2d 34 39 46 39 2d 38 38 41 35 2d 44 32 41 42 41 39 42 41 35 37 37 37 22 3a 31 2c 22 42 39 39 30 39 44 36 37 2d 37 32 34 37 2d 34 32 42 30 2d 41 42 39 46 2d 31 44 36 37 34 36 38 32 35 30 43 37 22 3a 31 2c 22 41 45 30 37 44 39 46 33 2d 31 46 31 39 2d 34 41 43 41 2d 38 41 38 32 2d 43 39 42 38 43 44 41 45 45 45 38 37 22 3a 31 2c 22 38 39 35 41 38 33 30 38 2d 38 36 46 42 2d 34 41 43 37 2d 38 46 31 43 2d 37 34 44 46 31 46 30 31 34 45 33 32 22 3a 31 2c 22 30 35 43 42 39 37 34 46 2d 30 33 39 35 2d 34 33 38 37 2d 41 30 39 38 2d 44 45 43 43 34 39 43 39 42 36 34 39 22 3a 31 2c 22 46 39 30 30 33 33 35 39 2d 31 42 42 46 2d 34 33 38 41 2d 41 41 41 43 2d 36 45 44 46 39 31 31 41 Data Ascii: 20008BC2682":1,"8C71DA13-09D1-49F9-88A5-D2ABA9BA5777":1,"B9909D67-7247-42B0-AB9F-1D67468250C7":1,"AE07D9F3-1F19-4ACA-8A82-C9B8CDAEEE87":1,"895A8308-86FB-4AC7-8F1C-74DF1F014E32":1,"05CB974F-0395-4387-A098-DECC49C9B649":1,"F9003359-1BBF-438A-AAAC-6EDF911A
2024-08-27 18:57:57 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 45 31 2d 35 46 32 39 31 44 30 44 39 37 38 35 22 3a 31 2c 22 33 43 31 37 45 35 41 33 2d 44 42 45 43 2d 34 30 43 38 2d 42 41 43 44 2d 35 41 33 32 36 34 42 32 36 37 34 31 22 3a 31 2c 22 32 31 36 46 34 32 33 45 2d 37 33 46 34 2d 34 38 46 30 2d 41 39 30 35 2d 39 30 42 43 45 38 37 31 43 35 36 34 22 3a 31 2c 22 44 33 44 30 35 41 30 38 2d 37 45 30 34 2d 34 37 44 31 2d 39 44 38 41 2d 36 35 38 46 45 36 34 34 42 37 42 46 22 3a 31 2c 22 43 37 37 41 41 35 38 33 2d 33 45 30 41 2d 34 32 39 31 2d 41 46 34 42 2d 39 35 43 33 32 30 41 36 31 35 45 43 22 3a 31 2c 22 34 45 41 32 31 38 32 32 2d 36 44 45 34 2d 34 39 31 45 2d 41 39 38 44 2d 39 41 44 31 30 30 31 45 46 36 43 34 22 3a 31 2c 22 38 46 46 46 41 41 32 35 2d 34 33 42 38 2d 34 42 30 46 2d 39 44 44 37 2d Data Ascii: 2000E1-5F291D0D9785":1,"3C17E5A3-DBEC-40C8-BACD-5A3264B26741":1,"216F423E-73F4-48F0-A905-90BCE871C564":1,"D3D05A08-7E04-47D1-9D8A-658FE644B7BF":1,"C77AA583-3E0A-4291-AF4B-95C320A615EC":1,"4EA21822-6DE4-491E-A98D-9AD1001EF6C4":1,"8FFFAA25-43B8-4B0F-9DD7-
2024-08-27 18:57:57 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 2d 34 36 46 39 2d 38 45 30 34 2d 34 45 43 31 33 30 45 44 42 43 45 43 22 3a 31 2c 22 43 34 38 39 37 45 45 37 2d 43 30 30 35 2d 34 43 35 43 2d 38 38 37 30 2d 45 46 42 37 35 33 44 35 44 39 31 42 22 3a 31 2c 22 36 42 33 35 37 45 38 38 2d 31 31 37 46 2d 34 46 44 36 2d 38 33 43 31 2d 33 32 43 35 44 35 32 46 42 42 41 35 22 3a 31 2c 22 43 35 43 39 45 45 34 43 2d 32 44 45 39 2d 34 32 42 41 2d 42 38 30 35 2d 42 39 36 34 39 35 44 44 38 34 39 36 22 3a 31 2c 22 32 36 30 39 36 37 42 38 2d 37 35 36 44 2d 34 38 31 42 2d 42 37 32 35 2d 43 30 38 35 43 46 34 44 46 45 32 38 22 3a 31 2c 22 37 33 32 36 38 45 32 34 2d 31 31 41 35 2d 34 34 43 32 2d 41 43 39 38 2d 45 33 44 43 38 39 43 46 30 45 46 45 22 3a 31 2c 22 34 34 30 32 42 33 36 46 2d 30 36 37 46 2d 34 32 Data Ascii: 2000-46F9-8E04-4EC130EDBCEC":1,"C4897EE7-C005-4C5C-8870-EFB753D5D91B":1,"6B357E88-117F-4FD6-83C1-32C5D52FBBA5":1,"C5C9EE4C-2DE9-42BA-B805-B96495DD8496":1,"260967B8-756D-481B-B725-C085CF4DFE28":1,"73268E24-11A5-44C2-AC98-E3DC89CF0EFE":1,"4402B36F-067F-42

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:58:00 UTC	617	OUT	GET /wise/owl/owl.slim.b85bbf4e2366ca721a6f.js HTTP/1.1 Host: wise.gcc.cdn.office.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://baycitymi-my.sharepoint.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://baycitymi-my.sharepoint.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 18:58:01 UTC	1107	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:58:01 GMT Content-Type: application/javascript Content-Length: 175722 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=31536000 Last-Modified: Thu, 22 Aug 2024 20:45:25 GMT x-ms-request-id: 60b61bfc-b01e-006e-6fb3-f80f13000000 x-azure-ref: 20240827T185800Z-16b9bbc45895kwx6e8hubbdzvs00000006e0000000004vaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Strict-Transport-Security: max-age=31536000; includeSubDomains Timing-Allow-Origin: * X-CDN-Provider: Azure X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Expose-Headers: date,X-Cdn-Provider,X-Ms-Request-Id Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET,HEAD,OPTIONS NEL: {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Report-To: {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AzureCDNGCC"}],"include_subdomains":true} Accept-Ranges: bytes
2024-08-27 18:58:01 UTC	15277	IN	Data Raw: 76 61 72 20 4d 69 63 72 6f 73 6f 66 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 2c 65 2c 6e 2c 6f 2c 69 3d 7b 36 38 37 32 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 6e 2e 64 28 65 2c 7b 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7d 7d 29 3b 76 61 72 20 6f 3d 6e 28 36 36 34 31 31 29 2c 69 3d 6e 28 33 38 32 31 37 29 2c 72 3d 6e 28 38 30 33 36 34 29 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 76 61 72 20 65 3d 6e 75 6c 6c 21 3d 3d 74 26 26 74 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7c 7c 74 68 69 73 3b 72 65 74 75 72 6e 20 65 2e 76 61 6c 75 65 3d 6e 75 6c 6c 2c 65 2e 68 61 73 4e 65 78 74 3d 21 31 2c 65 2e 68 61 Data Ascii: var Microsoft;!function(){"use strict";var t,e,n,o,i={68725:function(t,e,n){n.d(e,{h:function(){return s}});var o=n(66411),i=n(38217),r=n(80364),s=function(t){function e(){var e=null!==t&&t.apply(this,arguments)\|\|this;return e.value=null,e.hasNext=!1,e.ha
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 2e 69 6e 64 65 78 2b 2b 3b 74 72 79 7b 65 3d 74 68 69 73 2e 70 72 6f 6a 65 63 74 28 74 2c 6e 29 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 74 68 69 73 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2e 65 72 72 6f 72 28 74 29 7d 74 68 69 73 2e 61 63 74 69 76 65 2b 2b 2c 74 68 69 73 2e 68 74 28 65 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 68 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 6e 65 77 20 73 2e 7a 41 28 74 68 69 73 29 2c 6e 3d 74 68 69 73 2e 64 65 73 74 69 6e 61 74 69 6f 6e 3b 6e 2e 61 64 64 28 65 29 3b 76 61 72 20 6f 3d 28 30 2c 73 2e 74 53 29 28 74 2c 65 29 3b 6f 21 3d 3d 65 26 26 6e 2e 61 64 64 28 6f 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 68 61 73 43 6f Data Ascii: .index++;try{e=this.project(t,n)}catch(t){return void this.destination.error(t)}this.active++,this.ht(e)},e.prototype.ht=function(t){var e=new s.zA(this),n=this.destination;n.add(e);var o=(0,s.tS)(t,e);o!==e&&n.add(o)},e.prototype.nt=function(){this.hasCo
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 55 4d 42 45 52 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 20 6f 2e 42 55 49 4c 44 5f 4e 55 4d 42 45 52 7d 7d 7d 2c 33 30 32 30 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 6e 2e 64 28 65 2c 7b 4f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 6f 3d 6e 28 34 30 35 36 30 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 63 6f 6e 73 74 20 74 3d 6e 65 77 20 55 69 6e 74 38 41 72 72 61 79 28 33 31 29 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 63 6f 6e 73 74 20 65 3d 7b 63 72 79 70 74 6f 3a 21 31 2c 70 65 72 66 4e 6f 77 3a 21 31 2c 65 78 63 65 70 74 69 6f 6e 73 3a 5b 5d 7d 2c 6e 3d 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 7c 7c 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3b 69 66 28 6e 29 7b 65 2e 63 72 79 70 74 6f Data Ascii: UMBER}catch(t){return o.BUILD_NUMBER}}},30200:function(t,e,n){n.d(e,{O:function(){return i}});var o=n(40560);function i(){const t=new Uint8Array(31),e=function(t){const e={crypto:!1,perfNow:!1,exceptions:[]},n=window.crypto\|\|window.msCrypto;if(n){e.crypto
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 30 2c 74 68 69 73 2e 49 6e 3d 30 7d 2c 74 68 69 73 2e 70 6e 3d 28 29 3d 3e 7b 74 72 79 7b 69 66 28 74 68 69 73 2e 48 6e 3c 3d 30 29 72 65 74 75 72 6e 3b 63 6f 6e 73 74 20 74 3d 74 68 69 73 2e 52 6e 28 29 3b 74 68 69 73 2e 57 6e 28 74 2c 74 68 69 73 2e 5f 65 2c 74 68 69 73 2e 77 65 2e 45 65 29 2c 74 68 69 73 2e 46 6e 28 29 7d 63 61 74 63 68 28 74 29 7b 7d 7d 2c 74 68 69 73 2e 52 6e 3d 28 29 3d 3e 28 7b 64 3a 74 68 69 73 2e 67 65 2c 61 3a 74 68 69 73 2e 44 6e 28 29 2c 62 3a 74 68 69 73 2e 76 6e 2c 65 3a 74 68 69 73 2e 55 6e 2c 68 3a 74 68 69 73 2e 43 6e 2c 71 3a 74 68 69 73 2e 79 6e 2c 6b 3a 74 68 69 73 2e 41 6e 2c 6c 3a 74 68 69 73 2e 50 6e 2c 74 79 70 65 3a 22 68 5f 76 32 22 7d 29 2c 74 68 69 73 2e 44 6e 3d 28 29 3d 3e 74 68 69 73 2e 77 65 2e 48 65 26 26 Data Ascii: 0,this.In=0},this.pn=()=>{try{if(this.Hn<=0)return;const t=this.Rn();this.Wn(t,this._e,this.we.Ee),this.Fn()}catch(t){}},this.Rn=()=>({d:this.ge,a:this.Dn(),b:this.vn,e:this.Un,h:this.Cn,q:this.yn,k:this.An,l:this.Pn,type:"h_v2"}),this.Dn=()=>this.we.He&&
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 2c 65 3f 2e 63 6f 6e 76 65 72 73 61 74 69 6f 6e 42 75 74 74 6f 6e 45 6e 61 62 6c 65 64 2c 6e 3f 2e 61 64 64 69 74 69 6f 6e 61 6c 41 70 70 6c 69 63 61 74 69 6f 6e 50 61 72 61 6d 65 74 65 72 73 29 2c 43 3d 28 30 2c 72 2e 75 5f 29 28 29 3b 6a 3f 2e 55 4c 53 2e 73 65 6e 64 54 72 61 63 65 54 61 67 28 35 37 36 35 37 38 35 38 33 2c 6f 2e 6e 2e 52 6f 2c 69 2e 6b 2e 49 6e 66 6f 2c 22 42 6f 6f 74 53 74 72 61 70 46 69 6c 65 3a 20 41 62 6f 75 74 20 74 6f 20 63 61 6c 6c 20 49 6e 69 74 69 61 6c 69 7a 65 57 6f 70 69 50 65 6e 64 69 6e 67 22 29 3b 63 6f 6e 73 74 20 55 3d 28 30 2c 66 2e 53 49 29 28 66 2e 64 54 2e 46 65 61 74 75 72 65 47 61 74 65 5f 4f 77 6c 50 6f 73 74 57 61 63 54 6f 6b 65 6e 46 6f 72 54 65 61 6d 73 48 6f 73 74 73 2c 65 3f 2e 66 65 61 74 75 72 65 47 61 74 Data Ascii: ,e?.conversationButtonEnabled,n?.additionalApplicationParameters),C=(0,r.u_)();j?.ULS.sendTraceTag(576578583,o.n.Ro,i.k.Info,"BootStrapFile: About to call InitializeWopiPending");const U=(0,f.SI)(f.dT.FeatureGate_OwlPostWacTokenForTeamsHosts,e?.featureGat
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 66 61 75 6c 74 3a 22 76 69 65 77 22 3d 3d 3d 6f 7d 3a 7b 46 69 6c 65 4e 61 6d 65 3a 6e 2c 49 73 4e 65 77 46 69 6c 65 3a 21 30 2c 2e 2e 2e 74 26 26 7b 44 6f 63 55 6e 69 71 75 65 49 64 3a 74 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 77 28 74 29 7b 72 65 74 75 72 6e 7b 57 6f 70 69 53 72 63 3a 74 2e 77 6f 70 69 53 72 63 2c 41 63 63 65 73 73 54 6f 6b 65 6e 3a 74 2e 61 63 63 65 73 73 54 6f 6b 65 6e 2c 41 63 63 65 73 73 54 6f 6b 65 6e 45 78 70 69 72 79 3a 6e 65 77 20 44 61 74 65 28 70 61 72 73 65 49 6e 74 28 74 2e 61 63 63 65 73 73 54 6f 6b 65 6e 45 78 70 69 72 79 2c 31 30 29 29 2c 57 61 63 54 6f 6b 65 6e 3a 74 2e 77 61 63 54 6f 6b 65 6e 7d 7d 66 75 6e 63 74 69 6f 6e 20 67 28 74 29 7b 73 77 69 74 63 68 28 28 30 2c 63 2e 72 41 29 28 74 29 29 7b 63 61 73 65 20 63 2e 5f Data Ascii: fault:"view"===o}:{FileName:n,IsNewFile:!0,...t&&{DocUniqueId:t}}}function w(t){return{WopiSrc:t.wopiSrc,AccessToken:t.accessToken,AccessTokenExpiry:new Date(parseInt(t.accessTokenExpiry,10)),WacToken:t.wacToken}}function g(t){switch((0,c.rA)(t)){case c._
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 74 2e 4f 6e 4c 6f 61 64 54 69 6d 65 73 74 61 6d 70 3d 22 4f 6e 4c 6f 61 64 54 69 6d 65 73 74 61 6d 70 22 2c 74 2e 4f 6e 45 72 72 6f 72 54 69 6d 65 73 74 61 6d 70 3d 22 4f 6e 45 72 72 6f 72 54 69 6d 65 73 74 61 6d 70 22 2c 74 2e 4f 72 69 67 69 6e 61 6c 52 65 64 69 72 65 63 74 53 65 73 73 69 6f 6e 49 64 3d 22 4f 72 69 67 69 6e 61 6c 52 65 64 69 72 65 63 74 53 65 73 73 69 6f 6e 49 64 22 7d 28 69 7c 7c 28 69 3d 7b 7d 29 29 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 50 72 69 6e 74 50 44 46 3d 22 50 72 69 6e 74 50 44 46 22 2c 74 2e 4f 74 68 65 72 3d 22 4f 74 68 65 72 22 7d 28 72 7c 7c 28 72 3d 7b 7d 29 29 7d 2c 32 33 36 34 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 6e 2e 64 28 65 2c 7b 24 43 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 Data Ascii: t.OnLoadTimestamp="OnLoadTimestamp",t.OnErrorTimestamp="OnErrorTimestamp",t.OriginalRedirectSessionId="OriginalRedirectSessionId"}(i\|\|(i={})),function(t){t.PrintPDF="PrintPDF",t.Other="Other"}(r\|\|(r={}))},23644:function(t,e,n){n.d(e,{$C:function(){return
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 63 6f 6e 73 74 7b 64 6f 63 75 6d 65 6e 74 52 65 62 6f 6f 74 48 61 6e 64 6c 65 72 3a 69 2c 72 65 6e 61 6d 65 48 61 6e 64 6c 65 72 3a 72 2c 73 65 73 73 69 6f 6e 52 65 66 72 65 73 68 49 6e 66 6f 48 61 6e 64 6c 65 72 3a 73 2c 73 68 61 72 65 48 61 6e 64 6c 65 72 3a 61 2c 75 73 65 72 41 63 63 65 73 73 48 61 6e 64 6c 65 72 3a 75 2c 75 73 65 72 41 63 74 69 76 69 74 79 48 61 6e 64 6c 65 72 3a 66 2c 63 72 65 61 74 65 4e 65 77 48 61 6e 64 6c 65 72 3a 68 2c 67 65 74 41 75 74 68 54 6f 6b 65 6e 48 61 6e 64 6c 65 72 3a 70 2c 73 65 6e 64 43 6f 6e 76 65 72 73 61 74 69 6f 6e 49 64 48 61 6e 64 6c 65 72 3a 6d 2c 63 6c 6f 73 65 54 65 61 6d 73 43 6f 6e 76 65 72 73 61 74 69 6f 6e 48 61 6e 64 6c 65 72 3a 77 2c 6e 61 76 69 67 61 74 65 42 61 63 6b 54 6f 48 6f 73 74 48 61 6e 64 6c Data Ascii: const{documentRebootHandler:i,renameHandler:r,sessionRefreshInfoHandler:s,shareHandler:a,userAccessHandler:u,userActivityHandler:f,createNewHandler:h,getAuthTokenHandler:p,sendConversationIdHandler:m,closeTeamsConversationHandler:w,navigateBackToHostHandl
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 52 65 62 6f 6f 74 3d 22 52 45 42 4f 4f 54 22 7d 28 6c 7c 7c 28 6c 3d 7b 7d 29 29 7d 2c 31 33 30 39 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 6e 2e 64 28 65 2c 7b 42 4b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 42 7d 2c 59 33 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 63 76 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 78 7d 2c 67 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6a 7d 2c 67 76 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4c 7d 2c 6a 57 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 55 7d 7d 29 3b 76 61 72 20 6f 3d 6e 28 34 35 31 31 38 29 2c 69 3d 6e 28 39 37 36 34 33 29 2c 72 3d 6e 28 32 32 34 37 35 29 2c 73 3d 6e 28 33 30 32 30 30 29 2c 61 3d 6e 28 37 31 34 37 32 29 2c Data Ascii: Reboot="REBOOT"}(l\|\|(l={}))},13091:function(t,e,n){n.d(e,{BK:function(){return B},Y3:function(){},cv:function(){return x},gp:function(){return j},gv:function(){return L},jW:function(){return U}});var o=n(45118),i=n(97643),r=n(22475),s=n(30200),a=n(71472),
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 69 74 68 28 22 2f 74 65 73 74 22 29 2e 74 6f 53 74 72 69 6e 67 28 29 29 2c 28 30 2c 73 2e 50 71 29 28 29 3f 48 2e 61 64 64 51 6f 73 50 69 6c 6c 61 72 28 22 49 6e 74 65 72 72 75 70 74 69 6f 6e 73 22 29 3a 48 2e 61 64 64 51 6f 73 50 69 6c 6c 61 72 28 22 4f 70 65 6e 22 29 2c 48 3b 76 3f 2e 55 4c 53 2e 73 65 6e 64 54 72 61 63 65 54 61 67 28 35 30 37 33 34 30 30 36 34 2c 6f 2e 6e 2e 52 6f 2c 69 2e 6b 2e 57 61 72 6e 69 6e 67 2c 22 46 61 69 6c 65 64 20 74 6f 20 69 6e 69 74 69 61 6c 69 7a 65 20 68 65 61 6c 74 68 20 6c 6f 67 67 65 72 2e 22 29 7d 28 61 2c 6e 2c 74 2e 64 6f 63 75 6d 65 6e 74 42 6f 6f 74 49 6e 66 6f 2e 66 69 6c 65 54 79 70 65 2c 74 2e 64 6f 63 75 6d 65 6e 74 42 6f 6f 74 49 6e 66 6f 2e 75 69 43 75 6c 74 75 72 65 2c 74 2e 64 6f 63 75 6d 65 6e 74 42 6f Data Ascii: ith("/test").toString()),(0,s.Pq)()?H.addQosPillar("Interruptions"):H.addQosPillar("Open"),H;v?.ULS.sendTraceTag(507340064,o.n.Ro,i.k.Warning,"Failed to initialize health logger.")}(a,n,t.documentBootInfo.fileType,t.documentBootInfo.uiCulture,t.documentBo

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:58:00 UTC	621	OUT	GET /wise/owl/onenote-boot.35885234f8e241512812.js HTTP/1.1 Host: wise.gcc.cdn.office.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://baycitymi-my.sharepoint.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://baycitymi-my.sharepoint.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 18:58:01 UTC	1107	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:58:01 GMT Content-Type: application/javascript Content-Length: 143258 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=31536000 Last-Modified: Tue, 20 Aug 2024 00:47:13 GMT x-ms-request-id: 1afe10de-901e-009c-1fb3-f8dd87000000 x-azure-ref: 20240827T185800Z-16b9bbc45892n8q5e3rpfxkw7w00000005qg000000000fyk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Strict-Transport-Security: max-age=31536000; includeSubDomains Timing-Allow-Origin: * X-CDN-Provider: Azure X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Expose-Headers: date,X-Cdn-Provider,X-Ms-Request-Id Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET,HEAD,OPTIONS NEL: {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Report-To: {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AzureCDNGCC"}],"include_subdomains":true} Accept-Ranges: bytes
2024-08-27 18:58:01 UTC	15277	IN	Data Raw: 76 61 72 20 4d 69 63 72 6f 73 6f 66 74 3d 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 4d 69 63 72 6f 73 6f 66 74 3f 4d 69 63 72 6f 73 6f 66 74 3a 7b 7d 3b 4d 69 63 72 6f 73 6f 66 74 2e 4f 66 66 69 63 65 3d 4d 69 63 72 6f 73 6f 66 74 2e 4f 66 66 69 63 65 7c 7c 7b 7d 2c 4d 69 63 72 6f 73 6f 66 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 69 28 73 29 7b 69 66 28 65 5b 73 5d 29 72 65 74 75 72 6e 20 65 5b 73 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6f 3d 65 5b 73 5d 3d 7b 69 3a 73 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 74 5b 73 5d 2e 63 61 6c 6c 28 6f 2e 65 78 70 6f 72 74 73 2c 6f 2c 6f 2e 65 78 70 6f 72 74 73 2c 69 29 2c Data Ascii: var Microsoft="object"==typeof Microsoft?Microsoft:{};Microsoft.Office=Microsoft.Office\|\|{},Microsoft.Office.OneNote=function(t){var e={};function i(s){if(e[s])return e[s].exports;var o=e[s]={i:s,l:!1,exports:{}};return t[s].call(o.exports,o,o.exports,i),
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 42 2c 54 2e 45 72 72 6f 72 2c 60 46 65 74 63 68 20 73 65 74 74 69 6e 67 73 20 65 72 72 6f 72 2e 20 53 74 61 74 75 73 3a 20 24 7b 74 2e 73 74 61 74 75 73 7d 2c 20 63 75 72 45 72 72 6f 72 73 3a 20 24 7b 74 68 69 73 2e 72 69 7d 60 29 2c 74 68 69 73 2e 72 69 2b 3d 31 29 2c 74 68 69 73 2e 72 69 3e 37 29 72 65 74 75 72 6e 3b 6c 65 74 20 65 3d 74 68 69 73 2e 67 65 74 56 61 6c 75 65 28 6b 2e 6c 65 2c 33 65 35 29 3b 74 68 69 73 2e 72 69 3e 33 26 26 28 65 2b 3d 28 74 68 69 73 2e 72 69 2d 33 2b 31 29 2a 28 65 2f 32 29 29 2c 74 68 69 73 2e 65 69 3d 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 74 68 69 73 2e 69 69 2c 65 29 7d 7d 2c 74 68 69 73 2e 64 69 3d 74 3d 3e 7b 22 72 65 71 75 65 73 74 49 64 6c 65 43 61 6c 6c 62 61 63 6b 22 69 6e 20 77 69 6e 64 6f 77 3f Data Ascii: B,T.Error,`Fetch settings error. Status: ${t.status}, curErrors: ${this.ri}`),this.ri+=1),this.ri>7)return;let e=this.getValue(k.le,3e5);this.ri>3&&(e+=(this.ri-3+1)*(e/2)),this.ei=window.setTimeout(this.ii,e)}},this.di=t=>{"requestIdleCallback"in window?
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 57 41 52 44 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 35 35 3a 65 3d 22 52 45 53 45 52 56 45 44 22 7d 74 2e 68 6f 73 74 50 61 67 65 4e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 3d 65 7d 7d 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 5b 74 2e 55 6e 6b 6e 6f 77 6e 3d 30 5d 3d 22 55 6e 6b 6e 6f 77 6e 22 2c 74 5b 74 2e 4e 6f 72 6d 61 6c 3d 31 5d 3d 22 4e 6f 72 6d 61 6c 22 2c 74 5b 74 2e 4d 69 6e 6f 72 3d 32 5d 3d 22 4d 69 6e 6f 72 22 2c 74 5b 74 2e 4d 65 64 69 75 6d 3d 33 5d 3d 22 4d 65 64 69 75 6d 22 2c 74 5b 74 2e 4d 61 6a 6f 72 3d 34 5d 3d 22 4d 61 6a 6f 72 22 2c 74 5b 74 2e 43 72 69 74 69 63 61 6c 3d 35 5d 3d 22 43 72 69 74 69 63 61 6c 22 7d 28 64 74 7c 7c 28 64 74 3d 7b 7d 29 29 3b 63 6c 61 73 73 20 75 74 7b 64 69 73 70 6f 73 65 28 29 7b 77 69 6e 64 6f 77 2e Data Ascii: WARD";break;case 255:e="RESERVED"}t.hostPageNavigationType=e}}!function(t){t[t.Unknown=0]="Unknown",t[t.Normal=1]="Normal",t[t.Minor=2]="Minor",t[t.Medium=3]="Medium",t[t.Major=4]="Major",t[t.Critical=5]="Critical"}(dt\|\|(dt={}));class ut{dispose(){window.
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 73 65 6e 67 65 72 3a 69 2c 69 6e 6e 65 72 41 70 70 6c 69 63 61 74 69 6f 6e 46 72 61 6d 65 3a 73 2c 6f 6e 44 69 73 70 6f 73 65 64 3a 6f 2c 6f 6e 46 72 61 6d 65 52 65 6d 6f 76 65 64 3a 6e 2c 75 6e 6c 6f 61 64 54 69 6d 65 6f 75 74 49 6e 4d 73 3a 72 7c 7c 31 65 33 2c 66 6f 72 63 65 41 70 70 55 6e 6c 6f 61 64 3a 21 31 2c 64 69 73 70 6f 73 65 53 74 61 72 74 54 69 6d 65 3a 4f 28 29 2c 61 70 70 55 6e 6c 6f 61 64 54 69 6d 65 64 4f 75 74 3a 21 31 7d 3b 69 66 28 74 26 26 73 29 72 65 74 75 72 6e 20 52 74 3d 21 30 2c 61 2e 66 6f 72 63 65 41 70 70 55 6e 6c 6f 61 64 3d 21 30 2c 28 63 3d 61 29 2e 66 6f 72 63 65 41 70 70 55 6e 6c 6f 61 64 53 74 61 72 74 54 69 6d 65 3d 4f 28 29 2c 63 2e 6c 6f 67 67 65 72 2e 55 4c 53 2e 65 65 28 35 39 35 38 35 35 34 39 30 2c 5f 2e 42 2c 54 Data Ascii: senger:i,innerApplicationFrame:s,onDisposed:o,onFrameRemoved:n,unloadTimeoutInMs:r\|\|1e3,forceAppUnload:!1,disposeStartTime:O(),appUnloadTimedOut:!1};if(t&&s)return Rt=!0,a.forceAppUnload=!0,(c=a).forceAppUnloadStartTime=O(),c.logger.ULS.ee(595855490,_.B,T
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 4c 53 2e 65 65 28 35 39 35 37 32 34 31 37 38 2c 5f 2e 42 2c 54 2e 49 6e 66 6f 2c 22 42 6f 6f 74 5f 48 65 61 72 74 42 65 61 74 22 29 2c 52 28 29 3e 74 68 69 73 2e 65 61 26 26 28 74 68 69 73 2e 73 74 6f 70 28 29 2c 58 74 28 74 68 69 73 2e 63 69 29 2c 74 68 69 73 2e 6f 61 26 26 74 68 69 73 2e 6f 61 28 29 29 7d 2c 74 68 69 73 2e 74 61 2e 67 65 74 56 61 6c 75 65 28 6b 2e 70 65 2c 65 29 29 2c 74 68 69 73 2e 6e 61 2e 70 75 73 68 28 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 58 74 2c 74 68 69 73 2e 74 61 2e 67 65 74 56 61 6c 75 65 28 6b 2e 68 65 2c 36 65 34 29 2c 74 68 69 73 2e 63 69 2c 31 29 29 2c 74 68 69 73 2e 6e 61 2e 70 75 73 68 28 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 58 74 2c 74 68 69 73 2e 74 61 2e 67 65 74 56 61 6c 75 65 28 6b Data Ascii: LS.ee(595724178,_.B,T.Info,"Boot_HeartBeat"),R()>this.ea&&(this.stop(),Xt(this.ci),this.oa&&this.oa())},this.ta.getValue(k.pe,e)),this.na.push(window.setTimeout(Xt,this.ta.getValue(k.he,6e4),this.ci,1)),this.na.push(window.setTimeout(Xt,this.ta.getValue(k
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 74 68 69 73 2e 6a 72 3d 74 2e 42 6f 6f 74 28 29 2c 74 68 69 73 2e 75 63 28 74 68 69 73 2e 6a 72 29 7d 2c 74 68 69 73 2e 51 61 3d 74 3d 3e 7b 74 68 69 73 2e 58 61 3f 28 74 68 69 73 2e 63 69 2e 55 4c 53 2e 65 65 28 35 39 35 39 36 38 34 38 31 2c 5f 2e 42 2c 54 2e 57 61 72 6e 69 6e 67 2c 22 46 61 69 6c 20 63 61 6c 6c 65 64 20 61 6e 64 20 77 61 63 66 72 61 6d 65 20 69 73 20 61 62 6c 65 20 74 6f 20 61 63 63 65 70 74 20 70 6f 73 74 6d 65 73 73 61 67 65 73 22 29 2c 74 68 69 73 2e 6d 63 28 74 29 29 3a 28 74 68 69 73 2e 63 69 2e 55 4c 53 2e 65 65 28 35 39 35 39 36 38 34 38 32 2c 5f 2e 42 2c 54 2e 57 61 72 6e 69 6e 67 2c 22 46 61 69 6c 20 77 61 73 20 63 61 6c 6c 65 64 20 6f 6e 20 74 68 65 20 73 65 73 73 69 6f 6e 20 70 72 69 6f 72 20 74 6f 20 57 61 63 52 65 61 64 79 Data Ascii: this.jr=t.Boot(),this.uc(this.jr)},this.Qa=t=>{this.Xa?(this.ci.ULS.ee(595968481,_.B,T.Warning,"Fail called and wacframe is able to accept postmessages"),this.mc(t)):(this.ci.ULS.ee(595968482,_.B,T.Warning,"Fail was called on the session prior to WacReady
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 63 6f 6e 73 74 20 73 3d 28 29 3d 3e 7b 69 2b 3d 31 2c 69 3d 3d 3d 74 2e 6c 65 6e 67 74 68 26 26 65 28 29 7d 3b 66 6f 72 28 63 6f 6e 73 74 20 65 20 6f 66 20 74 29 46 65 28 65 2c 73 29 7d 28 65 2c 74 29 7d 28 28 29 3d 3e 7b 72 65 2e 61 64 64 44 75 72 61 74 69 6f 6e 4d 65 74 72 69 63 28 72 65 2e 70 61 2c 72 65 2e 66 61 2c 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 29 2c 61 26 26 61 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 28 63 2e 69 6e 6e 65 72 48 54 4d 4c 3d 72 2c 63 2e 63 68 69 6c 64 72 65 6e 26 26 63 2e 63 68 69 6c 64 72 65 6e 2e 6c 65 6e 67 74 68 3e 30 26 26 22 44 49 56 22 3d 3d 3d 63 2e 63 68 69 6c 64 72 65 6e 5b 30 5d 2e 74 61 67 4e 61 6d 65 26 26 63 2e 63 68 69 6c 64 72 65 6e 5b 30 5d 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 Data Ascii: const s=()=>{i+=1,i===t.length&&e()};for(const e of t)Fe(e,s)}(e,t)}(()=>{re.addDurationMetric(re.pa,re.fa,(new Date).getTime()),a&&a.parentNode&&(c.innerHTML=r,c.children&&c.children.length>0&&"DIV"===c.children[0].tagName&&c.children[0].classList.contai
2024-08-27 18:58:01 UTC	16384	IN	Data Raw: 49 6e 66 6f 2e 64 69 73 61 62 6c 65 43 68 61 74 2c 43 6f 6f 6b 69 65 43 6f 6d 70 6c 69 61 6e 74 3a 74 2e 73 65 73 73 69 6f 6e 49 6e 66 6f 2e 63 6f 6f 6b 69 65 43 6f 6d 70 6c 69 61 6e 74 2c 53 65 73 73 69 6f 6e 43 6f 6e 74 65 78 74 3a 74 2e 73 65 73 73 69 6f 6e 49 6e 66 6f 2e 73 65 73 73 69 6f 6e 43 6f 6e 74 65 78 74 2c 57 64 50 61 72 61 6d 73 3a 74 2e 73 65 73 73 69 6f 6e 49 6e 66 6f 2e 57 64 50 61 72 61 6d 73 2c 48 69 67 68 43 6f 6e 74 72 61 73 74 4d 6f 64 65 3a 74 2e 73 65 73 73 69 6f 6e 49 6e 66 6f 2e 68 69 67 68 43 6f 6e 74 72 61 73 74 4d 6f 64 65 2c 53 75 70 70 6f 72 74 73 44 6f 63 52 65 62 6f 6f 74 3a 74 2e 73 65 73 73 69 6f 6e 49 6e 66 6f 2e 73 75 70 70 6f 72 74 73 44 6f 63 52 65 62 6f 6f 74 2c 53 75 70 70 6f 72 74 73 41 63 63 65 73 73 69 62 69 6c Data Ascii: Info.disableChat,CookieCompliant:t.sessionInfo.cookieCompliant,SessionContext:t.sessionInfo.sessionContext,WdParams:t.sessionInfo.WdParams,HighContrastMode:t.sessionInfo.highContrastMode,SupportsDocReboot:t.sessionInfo.supportsDocReboot,SupportsAccessibil
2024-08-27 18:58:01 UTC	13293	IN	Data Raw: 3b 69 66 28 69 73 4e 61 4e 28 6f 29 7c 7c 69 73 4e 61 4e 28 6e 29 7c 7c 28 65 2e 61 70 70 55 6e 6c 6f 61 64 4c 61 74 65 6e 63 79 3d 6e 2d 6f 29 2c 69 2e 73 65 72 76 65 72 54 69 6d 69 6e 67 73 29 7b 63 6f 6e 73 74 20 74 3d 69 2e 73 65 72 76 65 72 54 69 6d 69 6e 67 73 3b 66 6f 72 28 63 6f 6e 73 74 20 69 20 69 6e 20 74 29 65 5b 22 73 74 2d 22 2b 69 2e 74 6f 53 74 72 69 6e 67 28 29 5d 3d 74 5b 69 5d 7d 7d 74 2e 6c 6f 67 67 65 72 2e 55 4c 53 2e 65 65 28 35 39 32 35 32 34 38 32 32 2c 5f 2e 42 2c 54 2e 49 6e 66 6f 2c 22 41 70 70 20 64 69 73 70 6f 73 65 64 3a 20 22 2b 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 29 29 2c 74 2e 6c 6f 67 67 65 72 2e 55 4c 53 2e 66 6c 75 73 68 4f 6e 43 6c 6f 73 65 28 29 7d 28 69 2c 72 2c 74 29 2c 69 2e 63 6f 6e 74 61 69 6e 65 72 Data Ascii: ;if(isNaN(o)\|\|isNaN(n)\|\|(e.appUnloadLatency=n-o),i.serverTimings){const t=i.serverTimings;for(const i in t)e["st-"+i.toString()]=t[i]}}t.logger.ULS.ee(592524822,_.B,T.Info,"App disposed: "+JSON.stringify(e)),t.logger.ULS.flushOnClose()}(i,r,t),i.container

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:58:05 UTC	650	OUT	GET /files/odsp-web-prod_2024-08-09.009/wacowlhostwebpack/wacowlhostwebpack.js HTTP/1.1 Host: res-1-gcc.cdn.office.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://baycitymi-my.sharepoint.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://baycitymi-my.sharepoint.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 18:58:06 UTC	1226	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:58:06 GMT Content-Type: application/javascript Content-Length: 140003 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 14 Aug 2024 06:35:31 GMT x-ms-request-id: f895801d-a01e-009f-25b3-f8de80000000 x-ms-meta-Sourcebuild: odsp-web-prod_2024-08-09.009 x-ms-meta-Sourceid: 21F74D6C1FCBAE36D35F0F0E2CF1A5409FF0B1978FA3596FDE16DCECA9C6E62700 x-azure-ref: 20240827T185806Z-16b9bbc4589vqdgx1c05ge980g00000007ng0000000013kr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Strict-Transport-Security: max-age=31536000; includeSubDomains Timing-Allow-Origin: * X-CDN-Provider: Azure X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Expose-Headers: date,X-Cdn-Provider,X-Ms-Request-Id Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET,HEAD,OPTIONS NEL: {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Report-To: {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AzureCDNGCC"}],"include_subdomains":true} Accept-Ranges: bytes
2024-08-27 18:58:06 UTC	15158	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd fb 77 db 36 b6 30 fa fb f7 57 48 3c 73 75 88 1a 92 25 e7 4d 05 d1 49 ec 64 9a 6f da 26 a7 ce b4 f7 5e 59 a3 05 93 90 8c 29 05 6a 48 c8 8e 2b e9 7f bf 6b e3 41 02 24 25 bb 9d ce 7c 67 ad db 35 13 8b 78 3f 36 36 36 f6 f3 f4 9b 6e e7 43 96 77 52 1e 33 51 b0 0e 17 8b 2c 5f 51 c9 33 d1 59 a7 8c 16 ac 53 30 d6 b9 a3 71 76 97 de 64 85 bc 63 d7 6b 1a ff 32 f8 7b 31 f8 ee e3 f9 fb 1f 2e df 0f e4 57 d9 f9 e6 f4 7f 85 21 22 6f b6 b7 34 ef 30 92 64 f1 66 c5 84 1c c4 9b 3c 67 42 5e c6 39 5f cb 71 c2 16 5c b0 30 c8 92 62 dd 17 ec ab 3c cd b3 4c 16 a7 3f d3 f8 d3 5d fa 6d 56 c8 00 4f 55 ee 20 67 34 96 83 94 5f 07 33 5c 36 2c c7 39 93 9b 5c e8 ae 82 0d 8c 4e e6 3c 96 c1 18 b2 05 99 86 0c 4b 2c 20 57 0c f2 50 22 2c 06 49 28 f1 76 3e a7 Data Ascii: w60WH<su%MIdo&^Y)jH+kA$%\|g5x?666nCwR3Q,_Q3YS0qvdck2{1.W!"o40df<gB^9_q\0b<L?]mVOU g4_3\6,9\N<K, WP",I(v>
2024-08-27 18:58:06 UTC	16384	IN	Data Raw: 83 6d f5 48 48 70 b0 af be 54 b4 33 9f 1a 0d f6 ca 73 f6 58 b8 ce 89 37 8a c3 e6 7b c6 0e e1 14 67 b8 70 b9 90 ef ff 18 a0 fc 64 fc 1b 98 b3 6a 5c fd f8 e1 e6 19 d0 57 2a 4c 79 89 bf c2 bb 10 c2 02 16 6b 16 f3 05 07 0e c5 f7 9b 54 72 88 78 9e 23 4c 9d 85 8a 82 e0 88 a4 92 3b 92 8c 57 cf e1 78 1c 12 7e 19 8b 2c 15 3d 0a 24 50 8e b7 60 50 03 b9 28 33 3e 26 d6 bf 30 2f 74 2a 30 a6 47 95 f0 cc 71 96 24 25 8d 0f 99 ef 02 13 b0 dc d9 93 93 f6 ae 60 c4 36 76 0e 73 3d bc 5b e3 37 6f c8 53 31 db 23 df 49 b0 9f 4b 38 e6 0f 86 cb aa cd cd ba 1c 71 67 eb e8 11 58 cb 54 a7 23 2c 09 b0 38 6b 01 e0 65 a5 6f 27 2b ad 69 01 6c 24 e0 b2 f1 d9 38 57 f6 14 14 c4 70 10 59 23 b7 83 0b 11 36 d3 85 62 fb 56 35 2b 88 f4 84 cd d6 2f 99 54 a2 a2 ef 59 51 d0 a5 d6 ad ba c6 95 18 41 Data Ascii: mHHpT3sX7{gpdj\WLykTrx#L;Wx~,=$P`P(3>&0/t0Gq$%`6vs=[7oS1#IK8qgXT#,8keo'+il$8WpY#6bV5+/TYQA
2024-08-27 18:58:06 UTC	16384	IN	Data Raw: 7b 63 fb ce e8 83 ff 41 9d 17 be d3 4e d1 1b 38 6e 95 7d e5 fa fa dc 19 55 af 62 b6 15 cc 32 f0 34 0a e0 07 44 9f a1 4b a2 91 ef a0 04 e3 f0 2c f6 8b 02 27 60 4d e9 b8 a6 8c a6 19 fe 56 9f 4b b5 36 95 5c 51 25 8e e7 a3 88 78 7b 2a 7d 7f c7 7b a1 2a c6 55 33 11 91 41 b9 70 f6 fe 82 28 9d bd a8 a2 05 55 2e 72 f0 9a f2 1a 57 f6 65 a1 7f 26 a5 c4 e9 c3 3b 1f d4 15 64 51 1c e1 71 4a 4e 0e 1b 68 31 19 10 73 c5 b3 99 3d 57 54 67 cd 1e d7 9d b5 6d bf 5d 2d 98 f0 68 b9 19 32 a8 e0 aa 33 d7 52 d1 43 1f c7 a4 26 4b f6 10 97 7b df c0 6b 75 a5 4f 8f df 5d 79 00 9c cb 51 e5 fb d9 8c 10 b3 cd e2 a2 dc d9 b9 a3 e2 ca 30 b2 e4 f1 69 e9 f9 c0 9a 58 b9 4f 4b cc 1b 17 8d 8d 28 37 72 c0 80 4b b1 eb eb f3 c6 44 e2 46 89 bf b1 58 20 eb 14 04 dd ff d9 db ba 61 57 21 5e 8b ca 5b Data Ascii: {cAN8n}Ub24DK,'`MVK6\Q%x{}{U3Ap(U.rWe&;dQqJNh1s=WTgm]-h23RC&K{kuO]yQ0iXOK(7rKDFX aW!^[
2024-08-27 18:58:06 UTC	16384	IN	Data Raw: 33 dd 35 36 0b f3 0f ae aa 5a 77 cd 57 6b 40 31 9e de dc f4 f7 0b 50 5f 60 b6 43 2b 08 50 7c a7 a3 94 5d 77 72 63 75 67 68 83 4e 39 45 2d 00 fa 6a ad 6c b0 27 0a 12 c7 75 f0 41 0e 97 99 a7 0a 9a 2a cc d6 59 3f b8 b9 39 6b 03 42 05 be 2f db d3 9a 1c 89 f3 07 3f 74 60 0d b1 d3 e5 fb ba 28 32 da 58 11 1e 2e d0 d6 29 e5 be 01 5f 9f 52 b6 86 38 ac 31 f5 8d f3 84 6e f8 92 5b c6 ec 3b d6 92 12 c5 7c 35 09 b6 d7 80 e3 7b d6 80 df 76 96 77 4c be e0 e1 93 2f 80 d1 3f e9 54 c0 66 e4 3c 39 25 55 5e f4 7a 07 00 ee 6c 7e 0f f2 ec 49 92 31 03 2a d9 be b6 a7 d7 eb 4f 46 1d ef 6b a5 8f 82 0e 4a de 6c af 46 67 e8 35 88 5a 8f 47 ea 61 dc eb c5 6d 8a df 6a 00 7b cc ab 51 cc 6d 36 bf 1e c5 83 0d e4 13 3d 1e 61 4d 41 07 93 9b 9b 57 07 a3 d1 69 af 07 7f ce 6e 6e fa af 46 e7 7c Data Ascii: 356ZwWk@1P_`C+P\|]wrcughN9E-jl'uAY?9kB/?t`(2X.)_R81n[;\|5{vwL/?Tf<9%U^zl~I1OFkJlFg5ZGamj{Qm6=aMAWinnF\|
2024-08-27 18:58:06 UTC	16384	IN	Data Raw: 6e 91 d9 a6 2b 8f f6 de f4 2b 65 28 3f e3 9e 53 ff 9c 15 07 2f eb 5b e3 a3 35 55 2a 70 38 b0 86 c3 dc 1d 62 f9 ee 1c be 66 c6 a4 b9 b0 03 60 9d 29 29 3e 48 80 6e 94 11 fb 32 a5 65 58 24 4b 6e 61 1f 02 44 10 60 b1 09 f0 a2 48 16 e0 9e 42 fe 4c 77 3d 0f 88 44 ec 35 53 7d d0 c2 4f ab a1 fc 99 ea e9 21 70 b6 db 5f e0 b5 69 b8 70 56 d9 bc 86 97 aa 19 ba 75 d8 57 b4 a8 12 9e 3a 28 0c a7 a6 78 bf f1 8a c1 3f 44 f5 07 28 3e cf d3 20 44 8d 8d d6 6b 96 25 90 c2 e2 b8 f5 76 28 7f 66 87 81 1b db e0 d1 85 79 dc d8 2a b9 ae 6a b1 46 77 bf c1 07 4b 37 e1 38 d7 fe 00 af 3d dd d5 9d e6 f5 37 2b 52 d1 22 23 c5 95 28 94 6e 30 46 fd de 67 f8 16 18 c4 f0 9a 6f 75 d5 79 44 d3 35 6d 00 f0 ed 7c 1c ca 9f 39 9e e3 00 71 67 d7 5f 08 8f e7 39 9e ed 19 fb 5f 87 f2 67 44 f3 62 b0 51 Data Ascii: n++e(?S/[5Up8bf`))>Hn2eX$KnaD`HBLw=D5S}O!p_ipVuW:(x?D(> Dk%v(fyjFwK78=7+R"#(n0FgouyD5m\|9qg_9_gDbQ
2024-08-27 18:58:06 UTC	16384	IN	Data Raw: 98 3b b8 7a 0d 93 e3 83 b7 74 14 3e 4f 86 9a bf a1 26 e3 ea 75 2d 18 51 22 c8 ab 2a 3c 58 78 cd 13 51 b8 7a 27 0c 61 c5 dc da 61 cd dd d0 5f 7e 08 e2 39 f0 45 cf b5 00 20 81 01 ae be 10 1c 71 73 5b 93 c8 14 95 31 82 6b a7 81 35 f5 d1 53 f8 1a b0 1c dc 44 f5 d9 35 b0 09 b8 94 80 0a 25 a4 6b 4f 14 c6 a7 f2 53 75 91 35 95 9f 89 bb a3 30 b6 bc 7b 62 27 24 98 a2 9a e7 d1 9a bf 39 15 82 bf 50 5e 75 e0 d0 2c 67 e0 da 27 ba fe ca ad 02 af 57 85 85 a9 8a cf 94 7b 30 0a fc 52 1d 30 26 6b e6 0f d3 0d bf 43 4e 3f d2 80 f9 d3 32 54 80 9c 5c 3c c1 6e cc 4f 57 c1 25 d3 31 7f 46 56 80 b3 77 57 8e 3c 81 e6 67 74 68 37 27 16 63 fe 2c fa f3 73 5f 38 dc c0 39 99 3f 27 61 d0 12 00 e7 75 80 76 f8 e7 2f c8 0a 91 2d 34 98 bf a8 0e b9 d8 7a 00 9c 45 66 dc 23 c7 15 df 75 4a e2 f4 Data Ascii: ;zt>O&u-Q"*<XxQz'aa_~9E qs[1k5SD5%kOSu50{b'$9P^u,g'W{0R0&kCN?2T\<nOW%1FVwW<gth7'c,s_89?'auv/-4zEf#uJ
2024-08-27 18:58:06 UTC	16384	IN	Data Raw: 71 cc 53 ca 13 a3 66 f3 b7 4b f3 23 28 9f 4d 2e 5e 2f cf 92 9a cf df af 4d 16 2f 53 4d 9f 1d 48 77 2c 00 f3 b8 c9 b9 69 30 c2 fc c3 f6 b0 bb 06 79 40 8a 6a 68 90 4b 4c b1 6c c5 b8 f7 34 6f b4 e0 84 4d fa 00 1b 8a db 28 01 52 25 ee af dc 28 0c 54 0f 49 95 e6 be 0f ee 2f 78 5a 4a a0 29 b0 5e 90 c9 b3 4f 79 c7 bb 2a 25 09 8b 36 b2 88 92 4d 80 ef 82 90 9e ff 26 67 f1 a7 30 4d 62 e0 e9 40 b2 5f 3c 91 73 2f bd c7 10 dd 0e ed ac c4 6f 4c c5 ad ce 12 d1 8a fb 65 a6 6a d8 02 47 7e 33 d8 b8 96 b2 c4 a1 55 cf b0 1d 8b bc cc 7e dd f8 11 dd 64 e5 1a 78 a2 fa ae 48 82 b7 5e 7b e9 47 0a 9d bf c7 1f e4 b5 17 87 2b 50 ad 40 0a fb 49 2e b8 af 09 73 de 7d c9 cc 94 ca 49 44 b8 fd c0 cd c1 7c 23 c1 63 ea 72 b3 94 98 3b f8 5e 56 4b 24 e0 34 84 79 1b fc 41 b8 fc d5 a1 9d 4f ec Data Ascii: qSfK#(M.^/M/SMHw,i0y@jhKLl4oM(R%(TI/xZJ)^Oy*%6M&g0Mb@_<s/oLejG~3U~dxH^{G+P@I.s}ID\|#cr;^VK$4yAO
2024-08-27 18:58:06 UTC	16384	IN	Data Raw: 4e e5 23 d7 4d 3b 6c 27 ed 76 30 74 98 20 77 d4 6e 07 66 1e 98 26 36 d4 6e a7 2d 93 24 a2 9e 62 d7 e5 b5 db 1e 16 e2 5b cd 10 e6 ab a2 6e f5 d2 44 43 b1 a2 89 6b e2 03 a5 51 ec 1d 76 99 fa ed b6 8e 37 a2 34 91 8b 67 7a c6 b6 92 69 12 1f cf 13 9f ea be 3c 74 52 83 d8 80 24 2f 0a c9 57 09 53 a4 b6 ca cd 16 0d 42 c0 63 7c 65 b7 6b 2c 69 90 b4 ba 40 c1 90 5d 7c 1a 77 55 29 2d d5 c7 32 75 a5 ee 7a cd a4 18 44 47 d6 02 a8 9b 72 75 37 a5 b2 45 fe 68 c5 d2 a7 b6 b4 60 f8 28 86 a6 49 ec 5a e8 98 06 42 d1 53 4c fc 31 5b 2f 1d cb ac 48 e5 e6 63 b7 fe 21 2f 36 fe 6a 8d 3c 78 3c 17 2d ce d0 78 ad 22 4f a6 46 7e 45 af 21 de 9b a4 e2 18 0d 02 82 34 5a b6 76 04 11 da b5 20 10 04 39 ed 5a 28 bc 28 91 ed 92 08 f7 18 55 83 f6 7a bb dd 91 d4 77 52 c0 52 90 d2 e5 18 2e 5a 6a Data Ascii: N#M;l'v0t wnf&6n-$b[nDCkQv74gzi<tR$/WSBc\|ek,i@]\|wU)-2uzDGru7Eh`(IZBSL1[/Hc!/6j<x<-x"OF~E!4Zv 9Z((UzwRR.Zj
2024-08-27 18:58:06 UTC	10157	IN	Data Raw: cc 1f cd 6e fb 77 a2 1f 3a 4e d6 11 c4 3c 42 12 32 07 97 4e 01 d2 8f 39 ac ca 4b 33 0d e7 a1 35 45 0f 88 e2 ca e5 b4 4f 42 fa 5a f6 c3 fc 87 50 31 ed 72 85 b2 1d d1 f0 36 bf 3b ac b5 4b f8 81 8a b0 40 ad 04 96 ae 49 cb 32 35 0f cb 12 57 fc f6 0e 3c 68 90 94 b2 c3 e4 87 d4 f4 a2 21 bd 5a a6 b7 c9 dd 61 21 ea c9 dd 2c 78 bc 46 3e 98 c0 67 12 80 de cf 62 a2 ae 91 e0 bb 04 4e bc 5f 77 7e e5 08 92 1c bc 27 fa 81 f8 7d b3 c4 b6 f9 9c 00 1b 48 53 6a b9 ff 5c 92 21 d9 8b 07 f8 4b a9 6e ba 28 2e 13 60 bb fc 02 fc 97 cb 44 1f 35 dd ee d6 1f 61 f1 be f4 71 2b cf a6 db dd 2a d8 51 e8 56 9b 0b 79 e9 b7 17 e6 bf fe 09 78 d7 fc be ca 1c 87 d4 26 20 74 d6 75 b3 f9 19 0b bf 94 c7 41 5e b3 d1 37 cd 8a bf ef 34 2d 36 9c a6 85 79 9a 9e d6 5a f1 3d 87 69 f2 66 b2 a3 70 a3 a3 Data Ascii: nw:N<B2N9K35EOBZP1r6;K@I25W<h!Za!,xF>gbN_w~'}HSj\!Kn(.`D5aq+*QVyx& tuA^74-6yZ=ifp

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:58:09 UTC	421	OUT	GET /files/odsp-web-prod_2024-08-09.009/wacowlhostwebpack/wacowlhostwebpack.js HTTP/1.1 Host: res-1-gcc.cdn.office.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 18:58:09 UTC	1246	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:58:09 GMT Content-Type: application/javascript Content-Length: 140003 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 14 Aug 2024 06:35:31 GMT x-ms-request-id: f895801d-a01e-009f-25b3-f8de80000000 x-ms-meta-Sourcebuild: odsp-web-prod_2024-08-09.009 x-ms-meta-Sourceid: 21F74D6C1FCBAE36D35F0F0E2CF1A5409FF0B1978FA3596FDE16DCECA9C6E62700 x-azure-ref: 20240827T185809Z-16b9bbc45892n8q5e3rpfxkw7w00000005fg00000000544n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Strict-Transport-Security: max-age=31536000; includeSubDomains Timing-Allow-Origin: * X-CDN-Provider: Azure X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Expose-Headers: date,X-Cdn-Provider,X-Ms-Request-Id Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET,HEAD,OPTIONS NEL: {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Report-To: {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AzureCDNGCC"}],"include_subdomains":true} Accept-Ranges: bytes
2024-08-27 18:58:09 UTC	15138	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd fb 77 db 36 b6 30 fa fb f7 57 48 3c 73 75 88 1a 92 25 e7 4d 05 d1 49 ec 64 9a 6f da 26 a7 ce b4 f7 5e 59 a3 05 93 90 8c 29 05 6a 48 c8 8e 2b e9 7f bf 6b e3 41 02 24 25 bb 9d ce 7c 67 ad db 35 13 8b 78 3f 36 36 36 f6 f3 f4 9b 6e e7 43 96 77 52 1e 33 51 b0 0e 17 8b 2c 5f 51 c9 33 d1 59 a7 8c 16 ac 53 30 d6 b9 a3 71 76 97 de 64 85 bc 63 d7 6b 1a ff 32 f8 7b 31 f8 ee e3 f9 fb 1f 2e df 0f e4 57 d9 f9 e6 f4 7f 85 21 22 6f b6 b7 34 ef 30 92 64 f1 66 c5 84 1c c4 9b 3c 67 42 5e c6 39 5f cb 71 c2 16 5c b0 30 c8 92 62 dd 17 ec ab 3c cd b3 4c 16 a7 3f d3 f8 d3 5d fa 6d 56 c8 00 4f 55 ee 20 67 34 96 83 94 5f 07 33 5c 36 2c c7 39 93 9b 5c e8 ae 82 0d 8c 4e e6 3c 96 c1 18 b2 05 99 86 0c 4b 2c 20 57 0c f2 50 22 2c 06 49 28 f1 76 3e a7 Data Ascii: w60WH<su%MIdo&^Y)jH+kA$%\|g5x?666nCwR3Q,_Q3YS0qvdck2{1.W!"o40df<gB^9_q\0b<L?]mVOU g4_3\6,9\N<K, WP",I(v>
2024-08-27 18:58:09 UTC	16384	IN	Data Raw: 5e ef 74 89 bf 86 c1 c0 a1 a5 aa f5 2d fd 8c 6d 9c 37 70 8a 83 6d f5 48 48 70 b0 af be 54 b4 33 9f 1a 0d f6 ca 73 f6 58 b8 ce 89 37 8a c3 e6 7b c6 0e e1 14 67 b8 70 b9 90 ef ff 18 a0 fc 64 fc 1b 98 b3 6a 5c fd f8 e1 e6 19 d0 57 2a 4c 79 89 bf c2 bb 10 c2 02 16 6b 16 f3 05 07 0e c5 f7 9b 54 72 88 78 9e 23 4c 9d 85 8a 82 e0 88 a4 92 3b 92 8c 57 cf e1 78 1c 12 7e 19 8b 2c 15 3d 0a 24 50 8e b7 60 50 03 b9 28 33 3e 26 d6 bf 30 2f 74 2a 30 a6 47 95 f0 cc 71 96 24 25 8d 0f 99 ef 02 13 b0 dc d9 93 93 f6 ae 60 c4 36 76 0e 73 3d bc 5b e3 37 6f c8 53 31 db 23 df 49 b0 9f 4b 38 e6 0f 86 cb aa cd cd ba 1c 71 67 eb e8 11 58 cb 54 a7 23 2c 09 b0 38 6b 01 e0 65 a5 6f 27 2b ad 69 01 6c 24 e0 b2 f1 d9 38 57 f6 14 14 c4 70 10 59 23 b7 83 0b 11 36 d3 85 62 fb 56 35 2b 88 f4 Data Ascii: ^t-m7pmHHpT3sX7{gpdj\WLykTrx#L;Wx~,=$P`P(3>&0/t0Gq$%`6vs=[7oS1#IK8qgXT#,8keo'+il$8WpY#6bV5+
2024-08-27 18:58:09 UTC	16384	IN	Data Raw: bd a4 53 14 11 90 65 76 e2 34 79 b8 f6 f3 af 39 ec 1f 43 df 7b 63 fb ce e8 83 ff 41 9d 17 be d3 4e d1 1b 38 6e 95 7d e5 fa fa dc 19 55 af 62 b6 15 cc 32 f0 34 0a e0 07 44 9f a1 4b a2 91 ef a0 04 e3 f0 2c f6 8b 02 27 60 4d e9 b8 a6 8c a6 19 fe 56 9f 4b b5 36 95 5c 51 25 8e e7 a3 88 78 7b 2a 7d 7f c7 7b a1 2a c6 55 33 11 91 41 b9 70 f6 fe 82 28 9d bd a8 a2 05 55 2e 72 f0 9a f2 1a 57 f6 65 a1 7f 26 a5 c4 e9 c3 3b 1f d4 15 64 51 1c e1 71 4a 4e 0e 1b 68 31 19 10 73 c5 b3 99 3d 57 54 67 cd 1e d7 9d b5 6d bf 5d 2d 98 f0 68 b9 19 32 a8 e0 aa 33 d7 52 d1 43 1f c7 a4 26 4b f6 10 97 7b df c0 6b 75 a5 4f 8f df 5d 79 00 9c cb 51 e5 fb d9 8c 10 b3 cd e2 a2 dc d9 b9 a3 e2 ca 30 b2 e4 f1 69 e9 f9 c0 9a 58 b9 4f 4b cc 1b 17 8d 8d 28 37 72 c0 80 4b b1 eb eb f3 c6 44 e2 46 Data Ascii: Sev4y9C{cAN8n}Ub24DK,'`MVK6\Q%x{}{U3Ap(U.rWe&;dQqJNh1s=WTgm]-h23RC&K{kuO]yQ0iXOK(7rKDF
2024-08-27 18:58:09 UTC	16384	IN	Data Raw: df 1f ca c7 5c a7 08 cd 24 0b 65 7e 5f 45 21 1d 50 a5 bf 97 33 dd 35 36 0b f3 0f ae aa 5a 77 cd 57 6b 40 31 9e de dc f4 f7 0b 50 5f 60 b6 43 2b 08 50 7c a7 a3 94 5d 77 72 63 75 67 68 83 4e 39 45 2d 00 fa 6a ad 6c b0 27 0a 12 c7 75 f0 41 0e 97 99 a7 0a 9a 2a cc d6 59 3f b8 b9 39 6b 03 42 05 be 2f db d3 9a 1c 89 f3 07 3f 74 60 0d b1 d3 e5 fb ba 28 32 da 58 11 1e 2e d0 d6 29 e5 be 01 5f 9f 52 b6 86 38 ac 31 f5 8d f3 84 6e f8 92 5b c6 ec 3b d6 92 12 c5 7c 35 09 b6 d7 80 e3 7b d6 80 df 76 96 77 4c be e0 e1 93 2f 80 d1 3f e9 54 c0 66 e4 3c 39 25 55 5e f4 7a 07 00 ee 6c 7e 0f f2 ec 49 92 31 03 2a d9 be b6 a7 d7 eb 4f 46 1d ef 6b a5 8f 82 0e 4a de 6c af 46 67 e8 35 88 5a 8f 47 ea 61 dc eb c5 6d 8a df 6a 00 7b cc ab 51 cc 6d 36 bf 1e c5 83 0d e4 13 3d 1e 61 4d 41 Data Ascii: \$e~_E!P356ZwWk@1P_`C+P\|]wrcughN9E-jl'uAY?9kB/?t`(2X.)_R81n[;\|5{vwL/?Tf<9%U^zl~I1OFkJlFg5ZGamj{Qm6=aMA
2024-08-27 18:58:09 UTC	16384	IN	Data Raw: 7f e0 b7 85 82 6f 9f de c6 ad 64 ee 6d e3 e1 3f 54 2d 98 6f 6e 91 d9 a6 2b 8f f6 de f4 2b 65 28 3f e3 9e 53 ff 9c 15 07 2f eb 5b e3 a3 35 55 2a 70 38 b0 86 c3 dc 1d 62 f9 ee 1c be 66 c6 a4 b9 b0 03 60 9d 29 29 3e 48 80 6e 94 11 fb 32 a5 65 58 24 4b 6e 61 1f 02 44 10 60 b1 09 f0 a2 48 16 e0 9e 42 fe 4c 77 3d 0f 88 44 ec 35 53 7d d0 c2 4f ab a1 fc 99 ea e9 21 70 b6 db 5f e0 b5 69 b8 70 56 d9 bc 86 97 aa 19 ba 75 d8 57 b4 a8 12 9e 3a 28 0c a7 a6 78 bf f1 8a c1 3f 44 f5 07 28 3e cf d3 20 44 8d 8d d6 6b 96 25 90 c2 e2 b8 f5 76 28 7f 66 87 81 1b db e0 d1 85 79 dc d8 2a b9 ae 6a b1 46 77 bf c1 07 4b 37 e1 38 d7 fe 00 af 3d dd d5 9d e6 f5 37 2b 52 d1 22 23 c5 95 28 94 6e 30 46 fd de 67 f8 16 18 c4 f0 9a 6f 75 d5 79 44 d3 35 6d 00 f0 ed 7c 1c ca 9f 39 9e e3 00 71 Data Ascii: odm?T-on++e(?S/[5Up8bf`))>Hn2eX$KnaD`HBLw=D5S}O!p_ipVuW:(x?D(> Dk%v(fyjFwK78=7+R"#(n0FgouyD5m\|9q
2024-08-27 18:58:09 UTC	16384	IN	Data Raw: 44 b8 9f 5c bd a2 92 70 e3 55 c8 c1 d5 ab 3a 80 12 73 7b 98 98 3b b8 7a 0d 93 e3 83 b7 74 14 3e 4f 86 9a bf a1 26 e3 ea 75 2d 18 51 22 c8 ab 2a 3c 58 78 cd 13 51 b8 7a 27 0c 61 c5 dc da 61 cd dd d0 5f 7e 08 e2 39 f0 45 cf b5 00 20 81 01 ae be 10 1c 71 73 5b 93 c8 14 95 31 82 6b a7 81 35 f5 d1 53 f8 1a b0 1c dc 44 f5 d9 35 b0 09 b8 94 80 0a 25 a4 6b 4f 14 c6 a7 f2 53 75 91 35 95 9f 89 bb a3 30 b6 bc 7b 62 27 24 98 a2 9a e7 d1 9a bf 39 15 82 bf 50 5e 75 e0 d0 2c 67 e0 da 27 ba fe ca ad 02 af 57 85 85 a9 8a cf 94 7b 30 0a fc 52 1d 30 26 6b e6 0f d3 0d bf 43 4e 3f d2 80 f9 d3 32 54 80 9c 5c 3c c1 6e cc 4f 57 c1 25 d3 31 7f 46 56 80 b3 77 57 8e 3c 81 e6 67 74 68 37 27 16 63 fe 2c fa f3 73 5f 38 dc c0 39 99 3f 27 61 d0 12 00 e7 75 80 76 f8 e7 2f c8 0a 91 2d 34 Data Ascii: D\pU:s{;zt>O&u-Q"*<XxQz'aa_~9E qs[1k5SD5%kOSu50{b'$9P^u,g'W{0R0&kCN?2T\<nOW%1FVwW<gth7'c,s_89?'auv/-4
2024-08-27 18:58:09 UTC	16384	IN	Data Raw: 80 43 c9 72 9a c7 bd a1 38 66 1c 98 84 c3 b5 ab 53 c2 4b 85 71 cc 53 ca 13 a3 66 f3 b7 4b f3 23 28 9f 4d 2e 5e 2f cf 92 9a cf df af 4d 16 2f 53 4d 9f 1d 48 77 2c 00 f3 b8 c9 b9 69 30 c2 fc c3 f6 b0 bb 06 79 40 8a 6a 68 90 4b 4c b1 6c c5 b8 f7 34 6f b4 e0 84 4d fa 00 1b 8a db 28 01 52 25 ee af dc 28 0c 54 0f 49 95 e6 be 0f ee 2f 78 5a 4a a0 29 b0 5e 90 c9 b3 4f 79 c7 bb 2a 25 09 8b 36 b2 88 92 4d 80 ef 82 90 9e ff 26 67 f1 a7 30 4d 62 e0 e9 40 b2 5f 3c 91 73 2f bd c7 10 dd 0e ed ac c4 6f 4c c5 ad ce 12 d1 8a fb 65 a6 6a d8 02 47 7e 33 d8 b8 96 b2 c4 a1 55 cf b0 1d 8b bc cc 7e dd f8 11 dd 64 e5 1a 78 a2 fa ae 48 82 b7 5e 7b e9 47 0a 9d bf c7 1f e4 b5 17 87 2b 50 ad 40 0a fb 49 2e b8 af 09 73 de 7d c9 cc 94 ca 49 44 b8 fd c0 cd c1 7c 23 c1 63 ea 72 b3 94 98 Data Ascii: Cr8fSKqSfK#(M.^/M/SMHw,i0y@jhKLl4oM(R%(TI/xZJ)^Oy*%6M&g0Mb@_<s/oLejG~3U~dxH^{G+P@I.s}ID\|#cr
2024-08-27 18:58:09 UTC	16384	IN	Data Raw: 35 0d 7f 68 a8 8c f7 31 14 17 07 07 ca 2a 15 ba 0a b9 e6 03 4e e5 23 d7 4d 3b 6c 27 ed 76 30 74 98 20 77 d4 6e 07 66 1e 98 26 36 d4 6e a7 2d 93 24 a2 9e 62 d7 e5 b5 db 1e 16 e2 5b cd 10 e6 ab a2 6e f5 d2 44 43 b1 a2 89 6b e2 03 a5 51 ec 1d 76 99 fa ed b6 8e 37 a2 34 91 8b 67 7a c6 b6 92 69 12 1f cf 13 9f ea be 3c 74 52 83 d8 80 24 2f 0a c9 57 09 53 a4 b6 ca cd 16 0d 42 c0 63 7c 65 b7 6b 2c 69 90 b4 ba 40 c1 90 5d 7c 1a 77 55 29 2d d5 c7 32 75 a5 ee 7a cd a4 18 44 47 d6 02 a8 9b 72 75 37 a5 b2 45 fe 68 c5 d2 a7 b6 b4 60 f8 28 86 a6 49 ec 5a e8 98 06 42 d1 53 4c fc 31 5b 2f 1d cb ac 48 e5 e6 63 b7 fe 21 2f 36 fe 6a 8d 3c 78 3c 17 2d ce d0 78 ad 22 4f a6 46 7e 45 af 21 de 9b a4 e2 18 0d 02 82 34 5a b6 76 04 11 da b5 20 10 04 39 ed 5a 28 bc 28 91 ed 92 08 f7 Data Ascii: 5h1*N#M;l'v0t wnf&6n-$b[nDCkQv74gzi<tR$/WSBc\|ek,i@]\|wU)-2uzDGru7Eh`(IZBSL1[/Hc!/6j<x<-x"OF~E!4Zv 9Z((
2024-08-27 18:58:09 UTC	10177	IN	Data Raw: a3 76 21 45 43 58 1e 91 4c 32 67 7e ec 03 04 aa f8 1a 77 13 cc 1f cd 6e fb 77 a2 1f 3a 4e d6 11 c4 3c 42 12 32 07 97 4e 01 d2 8f 39 ac ca 4b 33 0d e7 a1 35 45 0f 88 e2 ca e5 b4 4f 42 fa 5a f6 c3 fc 87 50 31 ed 72 85 b2 1d d1 f0 36 bf 3b ac b5 4b f8 81 8a b0 40 ad 04 96 ae 49 cb 32 35 0f cb 12 57 fc f6 0e 3c 68 90 94 b2 c3 e4 87 d4 f4 a2 21 bd 5a a6 b7 c9 dd 61 21 ea c9 dd 2c 78 bc 46 3e 98 c0 67 12 80 de cf 62 a2 ae 91 e0 bb 04 4e bc 5f 77 7e e5 08 92 1c bc 27 fa 81 f8 7d b3 c4 b6 f9 9c 00 1b 48 53 6a b9 ff 5c 92 21 d9 8b 07 f8 4b a9 6e ba 28 2e 13 60 bb fc 02 fc 97 cb 44 1f 35 dd ee d6 1f 61 f1 be f4 71 2b cf a6 db dd 2a d8 51 e8 56 9b 0b 79 e9 b7 17 e6 bf fe 09 78 d7 fc be ca 1c 87 d4 26 20 74 d6 75 b3 f9 19 0b bf 94 c7 41 5e b3 d1 37 cd 8a bf ef 34 2d Data Ascii: v!ECXL2g~wnw:N<B2N9K35EOBZP1r6;K@I25W<h!Za!,xF>gbN_w~'}HSj\!Kn(.`D5aq+*QVyx& tuA^74-

Timestamp	Bytes transferred	Direction	Data
2024-08-27 18:58:21 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=8dzolmfARCn+Aww&MD=6lVLXk7B HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-27 18:58:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: cc4d86e4-e97d-478e-b9ef-d151fdd3365d MS-RequestId: b2dd58cc-ad4c-4547-97b0-b3b253170648 MS-CV: Zn2MNoN9EkeYJU69.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 27 Aug 2024 18:58:21 GMT Connection: close Content-Length: 30005
2024-08-27 18:58:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-27 18:58:21 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Timestamp	Bytes transferred	Direction	Data
2024-08-27 19:00:33 UTC	635	OUT	GET /files/odsp-web-prod_2024-08-09.009/wacowlhostwebpack/13.js HTTP/1.1 Host: res-1-gcc.cdn.office.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://baycitymi-my.sharepoint.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://baycitymi-my.sharepoint.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 19:00:34 UTC	1225	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 19:00:34 GMT Content-Type: application/javascript Content-Length: 75709 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 14 Aug 2024 06:35:28 GMT x-ms-request-id: 1d686a6c-001e-0033-7ab3-f8ff17000000 x-ms-meta-Sourcebuild: odsp-web-prod_2024-08-09.009 x-ms-meta-Sourceid: 8263F10C15BB3BA1B78E7D4A5DD43B52160A28A279DD4A9F4CD4E1DB815C498900 x-azure-ref: 20240827T190034Z-164758fc766ltt9ldnr9bn1e9c00000009h0000000001dfy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Strict-Transport-Security: max-age=31536000; includeSubDomains Timing-Allow-Origin: * X-CDN-Provider: Azure X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Expose-Headers: date,X-Cdn-Provider,X-Ms-Request-Id Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET,HEAD,OPTIONS NEL: {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Report-To: {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AzureCDNGCC"}],"include_subdomains":true} Accept-Ranges: bytes
2024-08-27 19:00:34 UTC	15159	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cc bd 6b 73 db b6 d6 30 fa fd f9 15 12 4f 0f 37 b1 05 2b 92 6f 89 a9 20 9a c4 ce c5 69 12 a7 b6 d3 b4 55 b5 3d b0 08 49 68 68 50 21 21 5f 6a e9 bf 9f 59 0b 00 09 4a 72 92 be cf 9e 77 4e 26 63 91 00 08 82 c0 c2 c2 ba af 47 ff 6e 36 5e 65 79 23 95 23 a1 0a d1 90 6a 9c e5 57 5c cb 4c 35 66 a9 e0 85 68 14 42 34 ba 3b ed bf 8a f6 bb e3 c3 97 1f ce 5e b6 f5 ad 6e fc fb d1 ff 44 85 48 c7 ed 2c 29 66 1f c4 ad fe 2c 2e 67 7c f4 e5 6d 91 a9 19 7b b0 66 b1 18 0c 49 7b 36 2f a6 d1 60 d0 dd 19 d2 fb c7 dd 6e 1c 09 aa a9 22 ec d9 7d 30 87 37 ea 5c 8e 74 d0 bb e6 79 83 f7 54 3b 89 34 bd e7 71 44 d8 33 4e 2f f1 57 2e 09 1d cf d5 08 06 1a 09 72 2f 06 a2 7d 78 7a 7c 7e 7c f8 fc 1d eb 0e 59 e0 6e 02 0a 55 9f 9f 9f 7e 38 fe f0 9a 6d 0f 59 60 af Data Ascii: ks0O7+o iU=IhhP!!_jYJrwN&cGn6^ey##jW\L5fhB4;^nDH,)f,.g\|m{fI{6/`n"}07\tyT;4qD3N/W.r/}xz\|~\|YnU~8mY`
2024-08-27 19:00:34 UTC	16384	IN	Data Raw: 9f e6 bd 56 2b ab d4 a0 19 9a 73 15 c4 05 f9 c4 3c 77 ed b1 b2 e1 e1 70 9f 63 f2 cb 7b cc af 67 82 5c af c8 6e 7d a2 6e 7f 97 06 27 4a 40 d8 e3 d2 ea a8 51 a1 fb bc b0 34 1e f5 ab b5 b8 6a dc c8 34 45 bb 83 4b d1 28 ac 1d 18 e6 3f 5d 71 87 06 2b 1e a0 f5 97 d2 c6 a7 2f 81 d7 a9 2d 3d a4 5b db 54 91 11 88 95 04 1f 47 d7 34 aa 3d 20 d5 cb e8 88 13 7a cb 99 a5 4c 8b c6 d5 bc d0 10 d1 ec 5a 26 c2 fb 90 c6 95 d0 d3 0c 92 2c 72 16 9c 1d fd 0c 56 13 85 86 6f 30 44 0b 84 65 6c b7 03 7a c2 d9 fd 86 b0 56 71 d7 63 0e 6e 78 dd 12 45 dc 34 32 5e 8b 35 f3 92 6f f6 c8 af 89 dc 0d 6b ad bd 58 d6 98 23 07 01 c7 66 78 7a fe c3 84 12 2d e8 08 f0 30 c5 63 8b 5e d1 0b 3a a5 97 f4 9a 9e d1 23 7a cc 3a f4 16 86 f1 9d 20 6a 87 91 0d a1 76 1c 86 cd 5b 13 ad 5e 58 19 3a 4a 5d f0 Data Ascii: V+s<wpc{g\n}n'J@Q4j4EK(?]q+/-=[TG4= zLZ&,rVo0DelzVqcnxE42^5okX#fxz-0c^:#z: jv[^X:J]
2024-08-27 19:00:34 UTC	16384	IN	Data Raw: a7 f5 45 b7 a7 22 cd 0f 63 d3 48 6e 27 d4 d6 2d 87 74 0f b1 dc 50 19 2b 89 41 25 dd 03 c2 91 2b 71 9b b3 0f ac eb 39 4a a9 40 e1 2b 7f a0 6b 53 79 a1 83 07 ea 15 d9 87 3a e6 19 97 7d 72 3e 49 92 71 e8 c8 07 5c de 2a 42 58 68 82 85 41 3a 04 09 c3 f0 81 8e 7a 82 d4 a3 34 19 cf 47 54 b7 79 76 96 ee d5 62 e1 5e 99 45 0e c0 8d 77 4f 9d f5 d4 cd 01 cc 75 2a 78 26 1c e6 6c cf c7 91 88 47 42 93 5c 6e 27 30 bf a6 d3 d7 32 ea 5d 04 50 3f a1 b3 93 cc a2 69 92 3b 7d 17 84 18 ef 04 cf e7 a9 20 12 07 cc 04 aa 67 2a a9 d8 f8 ce be 56 b8 39 fb 46 7f 91 75 60 ea 44 1c 3a f4 97 52 4e d2 88 ca e1 03 a5 7d 10 b3 1c 92 e0 2f a5 7c 16 df 91 0d 81 54 f5 ec 30 17 4c 4b 76 f8 8c 9f 45 d3 28 27 74 2c f3 93 da 22 19 e6 5f 48 96 8a 63 2e 93 1a 26 0d 80 69 25 f1 05 c8 3d c7 3c 43 ce Data Ascii: E"cHn'-tP+A%+q9J@+kSy:}r>Iq\BXhA:z4GTyvb^EwOux&lGB\n'02]P?i;} g*V9Fu`D:RN}/\|T0LKvE('t,"_Hc.&i%=<C
2024-08-27 19:00:34 UTC	16384	IN	Data Raw: cb 5d 04 04 cd ab 84 a7 ed 74 67 c7 00 3b 12 bd 36 43 80 8b a2 a6 8a 15 04 ff c8 7c c0 48 74 a6 51 59 2b 20 24 75 3f f4 24 d2 a1 a4 e1 bb 6e 2e 42 6b b2 0e 72 a3 8e d8 5c 6e 87 ad 5f dd 58 db ed 5a ed 53 5e 0a 3f 1f 86 3b b5 7e af df 67 46 06 0c 57 b0 d7 dd ef 1e 40 8e 4b 10 e7 31 89 f5 eb 08 01 32 20 bb 85 e4 d7 cb a2 a0 59 35 bb 79 0b 53 92 66 93 0f f9 35 ff 88 93 f4 6f 32 a6 46 f7 12 9e 33 80 94 3f 4e 12 59 83 26 0a 46 69 ca 92 9e 81 b6 bf 67 fc 64 61 13 fa f4 00 4b 14 39 e8 d5 4b 66 15 70 19 b3 0e 7c 62 a9 e1 27 48 13 9a 30 7c a4 a9 3c 9c 59 90 fe e4 59 c6 42 fb 8d 5d 7e cd bd da 84 bb 6a 18 1f 97 d5 28 5f f2 eb 8f 0f 27 77 a4 a5 99 4a 12 3d 34 d2 ce c1 a4 e9 17 1a cd 80 05 ba 70 95 c2 1c af f3 b2 3a a1 63 5a 14 34 69 ce c5 4c a3 d4 77 01 96 e0 93 51 Data Ascii: ]tg;6C\|HtQY+ $u?$n.Bkr\n_XZS^?;~gFW@K12 Y5ySf5o2F3?NY&FigdaK9Kfp\|b'H0\|<YYB]~j(_'wJ=4p:cZ4iLwQ
2024-08-27 19:00:34 UTC	11398	IN	Data Raw: 3b 01 dd 51 df ce ab 0b f1 99 b5 c6 5c f4 53 90 1a f4 50 ee 56 85 3d 59 52 34 52 18 15 90 3c ec 91 32 2c 44 45 f9 ab 72 98 ef ec 90 74 67 27 88 ce d3 8b b0 38 cf 2f 04 4f 17 ad 1e 08 f7 97 8b a7 cb 38 0c 9f 80 18 e8 26 e7 ae 00 51 6c 7c 70 f0 9c 01 78 f7 f7 0f 2c 7f 6f fb fb cf 78 0c e0 c3 46 00 af 7c 51 57 b8 3c d2 e7 ff 96 0f 72 fd 96 43 0a 8e 95 b6 7a 24 0a b6 b7 63 66 c1 26 76 9c f4 06 c9 ef 13 2e 1b 6e f6 fe 1d 90 7e 30 90 2d 18 1a 82 37 66 cc 99 ad fe ba 0c 96 0b 21 77 ac 45 20 9d 76 e7 19 75 81 fc 9d 19 2b e0 70 ee 80 5d d5 43 f5 72 a9 91 98 b3 4c 9b a9 ef 1b 87 cb c9 48 5d b0 bb 74 05 97 33 0d 0a c9 b2 26 ed 71 65 d3 c3 cd 51 1e 6d ae 82 6b 5b 6d 4a 4f 7c 58 00 55 c1 c2 6d 53 45 ac c2 b1 66 2b 23 ec 6b 08 47 85 bf cb 27 9f 73 5e a7 47 3c 8f f4 70 Data Ascii: ;Q\SPV=YR4R<2,DErtg'8/O8&Ql\|px,oxF\|QW<rCz$cf&v.n~0-7f!wE vu+p]CrLH]t3&qeQmk[mJO\|XUmSEf+#kG's^G<p

Timestamp	Bytes transferred	Direction	Data
2024-08-27 19:00:37 UTC	406	OUT	GET /files/odsp-web-prod_2024-08-09.009/wacowlhostwebpack/13.js HTTP/1.1 Host: res-1-gcc.cdn.office.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-08-27 19:00:38 UTC	1225	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 19:00:38 GMT Content-Type: application/javascript Content-Length: 75709 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Wed, 14 Aug 2024 06:35:28 GMT x-ms-request-id: 612dc44f-d01e-0013-05b3-f893db000000 x-ms-meta-Sourcebuild: odsp-web-prod_2024-08-09.009 x-ms-meta-Sourceid: 8263F10C15BB3BA1B78E7D4A5DD43B52160A28A279DD4A9F4CD4E1DB815C498900 x-azure-ref: 20240827T190037Z-178f7cc594dwp8xf54dcxcwncg0000000be0000000001ctb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Strict-Transport-Security: max-age=31536000; includeSubDomains Timing-Allow-Origin: * X-CDN-Provider: Azure X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Expose-Headers: date,X-Cdn-Provider,X-Ms-Request-Id Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET,HEAD,OPTIONS NEL: {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} Report-To: {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AzureCDNGCC"}],"include_subdomains":true} Accept-Ranges: bytes
2024-08-27 19:00:38 UTC	15159	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cc bd 6b 73 db b6 d6 30 fa fd f9 15 12 4f 0f 37 b1 05 2b 92 6f 89 a9 20 9a c4 ce c5 69 12 a7 b6 d3 b4 55 b5 3d b0 08 49 68 68 50 21 21 5f 6a e9 bf 9f 59 0b 00 09 4a 72 92 be cf 9e 77 4e 26 63 91 00 08 82 c0 c2 c2 ba af 47 ff 6e 36 5e 65 79 23 95 23 a1 0a d1 90 6a 9c e5 57 5c cb 4c 35 66 a9 e0 85 68 14 42 34 ba 3b ed bf 8a f6 bb e3 c3 97 1f ce 5e b6 f5 ad 6e fc fb d1 ff 44 85 48 c7 ed 2c 29 66 1f c4 ad fe 2c 2e 67 7c f4 e5 6d 91 a9 19 7b b0 66 b1 18 0c 49 7b 36 2f a6 d1 60 d0 dd 19 d2 fb c7 dd 6e 1c 09 aa a9 22 ec d9 7d 30 87 37 ea 5c 8e 74 d0 bb e6 79 83 f7 54 3b 89 34 bd e7 71 44 d8 33 4e 2f f1 57 2e 09 1d cf d5 08 06 1a 09 72 2f 06 a2 7d 78 7a 7c 7e 7c f8 fc 1d eb 0e 59 e0 6e 02 0a 55 9f 9f 9f 7e 38 fe f0 9a 6d 0f 59 60 af Data Ascii: ks0O7+o iU=IhhP!!_jYJrwN&cGn6^ey##jW\L5fhB4;^nDH,)f,.g\|m{fI{6/`n"}07\tyT;4qD3N/W.r/}xz\|~\|YnU~8mY`
2024-08-27 19:00:38 UTC	16384	IN	Data Raw: 9f e6 bd 56 2b ab d4 a0 19 9a 73 15 c4 05 f9 c4 3c 77 ed b1 b2 e1 e1 70 9f 63 f2 cb 7b cc af 67 82 5c af c8 6e 7d a2 6e 7f 97 06 27 4a 40 d8 e3 d2 ea a8 51 a1 fb bc b0 34 1e f5 ab b5 b8 6a dc c8 34 45 bb 83 4b d1 28 ac 1d 18 e6 3f 5d 71 87 06 2b 1e a0 f5 97 d2 c6 a7 2f 81 d7 a9 2d 3d a4 5b db 54 91 11 88 95 04 1f 47 d7 34 aa 3d 20 d5 cb e8 88 13 7a cb 99 a5 4c 8b c6 d5 bc d0 10 d1 ec 5a 26 c2 fb 90 c6 95 d0 d3 0c 92 2c 72 16 9c 1d fd 0c 56 13 85 86 6f 30 44 0b 84 65 6c b7 03 7a c2 d9 fd 86 b0 56 71 d7 63 0e 6e 78 dd 12 45 dc 34 32 5e 8b 35 f3 92 6f f6 c8 af 89 dc 0d 6b ad bd 58 d6 98 23 07 01 c7 66 78 7a fe c3 84 12 2d e8 08 f0 30 c5 63 8b 5e d1 0b 3a a5 97 f4 9a 9e d1 23 7a cc 3a f4 16 86 f1 9d 20 6a 87 91 0d a1 76 1c 86 cd 5b 13 ad 5e 58 19 3a 4a 5d f0 Data Ascii: V+s<wpc{g\n}n'J@Q4j4EK(?]q+/-=[TG4= zLZ&,rVo0DelzVqcnxE42^5okX#fxz-0c^:#z: jv[^X:J]
2024-08-27 19:00:38 UTC	16384	IN	Data Raw: a7 f5 45 b7 a7 22 cd 0f 63 d3 48 6e 27 d4 d6 2d 87 74 0f b1 dc 50 19 2b 89 41 25 dd 03 c2 91 2b 71 9b b3 0f ac eb 39 4a a9 40 e1 2b 7f a0 6b 53 79 a1 83 07 ea 15 d9 87 3a e6 19 97 7d 72 3e 49 92 71 e8 c8 07 5c de 2a 42 58 68 82 85 41 3a 04 09 c3 f0 81 8e 7a 82 d4 a3 34 19 cf 47 54 b7 79 76 96 ee d5 62 e1 5e 99 45 0e c0 8d 77 4f 9d f5 d4 cd 01 cc 75 2a 78 26 1c e6 6c cf c7 91 88 47 42 93 5c 6e 27 30 bf a6 d3 d7 32 ea 5d 04 50 3f a1 b3 93 cc a2 69 92 3b 7d 17 84 18 ef 04 cf e7 a9 20 12 07 cc 04 aa 67 2a a9 d8 f8 ce be 56 b8 39 fb 46 7f 91 75 60 ea 44 1c 3a f4 97 52 4e d2 88 ca e1 03 a5 7d 10 b3 1c 92 e0 2f a5 7c 16 df 91 0d 81 54 f5 ec 30 17 4c 4b 76 f8 8c 9f 45 d3 28 27 74 2c f3 93 da 22 19 e6 5f 48 96 8a 63 2e 93 1a 26 0d 80 69 25 f1 05 c8 3d c7 3c 43 ce Data Ascii: E"cHn'-tP+A%+q9J@+kSy:}r>Iq\BXhA:z4GTyvb^EwOux&lGB\n'02]P?i;} g*V9Fu`D:RN}/\|T0LKvE('t,"_Hc.&i%=<C
2024-08-27 19:00:38 UTC	16384	IN	Data Raw: cb 5d 04 04 cd ab 84 a7 ed 74 67 c7 00 3b 12 bd 36 43 80 8b a2 a6 8a 15 04 ff c8 7c c0 48 74 a6 51 59 2b 20 24 75 3f f4 24 d2 a1 a4 e1 bb 6e 2e 42 6b b2 0e 72 a3 8e d8 5c 6e 87 ad 5f dd 58 db ed 5a ed 53 5e 0a 3f 1f 86 3b b5 7e af df 67 46 06 0c 57 b0 d7 dd ef 1e 40 8e 4b 10 e7 31 89 f5 eb 08 01 32 20 bb 85 e4 d7 cb a2 a0 59 35 bb 79 0b 53 92 66 93 0f f9 35 ff 88 93 f4 6f 32 a6 46 f7 12 9e 33 80 94 3f 4e 12 59 83 26 0a 46 69 ca 92 9e 81 b6 bf 67 fc 64 61 13 fa f4 00 4b 14 39 e8 d5 4b 66 15 70 19 b3 0e 7c 62 a9 e1 27 48 13 9a 30 7c a4 a9 3c 9c 59 90 fe e4 59 c6 42 fb 8d 5d 7e cd bd da 84 bb 6a 18 1f 97 d5 28 5f f2 eb 8f 0f 27 77 a4 a5 99 4a 12 3d 34 d2 ce c1 a4 e9 17 1a cd 80 05 ba 70 95 c2 1c af f3 b2 3a a1 63 5a 14 34 69 ce c5 4c a3 d4 77 01 96 e0 93 51 Data Ascii: ]tg;6C\|HtQY+ $u?$n.Bkr\n_XZS^?;~gFW@K12 Y5ySf5o2F3?NY&FigdaK9Kfp\|b'H0\|<YYB]~j(_'wJ=4p:cZ4iLwQ
2024-08-27 19:00:38 UTC	11398	IN	Data Raw: 3b 01 dd 51 df ce ab 0b f1 99 b5 c6 5c f4 53 90 1a f4 50 ee 56 85 3d 59 52 34 52 18 15 90 3c ec 91 32 2c 44 45 f9 ab 72 98 ef ec 90 74 67 27 88 ce d3 8b b0 38 cf 2f 04 4f 17 ad 1e 08 f7 97 8b a7 cb 38 0c 9f 80 18 e8 26 e7 ae 00 51 6c 7c 70 f0 9c 01 78 f7 f7 0f 2c 7f 6f fb fb cf 78 0c e0 c3 46 00 af 7c 51 57 b8 3c d2 e7 ff 96 0f 72 fd 96 43 0a 8e 95 b6 7a 24 0a b6 b7 63 66 c1 26 76 9c f4 06 c9 ef 13 2e 1b 6e f6 fe 1d 90 7e 30 90 2d 18 1a 82 37 66 cc 99 ad fe ba 0c 96 0b 21 77 ac 45 20 9d 76 e7 19 75 81 fc 9d 19 2b e0 70 ee 80 5d d5 43 f5 72 a9 91 98 b3 4c 9b a9 ef 1b 87 cb c9 48 5d b0 bb 74 05 97 33 0d 0a c9 b2 26 ed 71 65 d3 c3 cd 51 1e 6d ae 82 6b 5b 6d 4a 4f 7c 58 00 55 c1 c2 6d 53 45 ac c2 b1 66 2b 23 ec 6b 08 47 85 bf cb 27 9f 73 5e a7 47 3c 8f f4 70 Data Ascii: ;Q\SPV=YR4R<2,DErtg'8/O8&Ql\|px,oxF\|QW<rCz$cf&v.n~0-7f!wE vu+p]CrLH]t3&qeQmk[mJO\|XUmSEf+#kG's^G<p

Target ID:	0
Start time:	14:57:26
Start date:	27/08/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\San Xavier District of the Tohono O#U2019odham Nation.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report San Xavier District of the Tohono O#U2019odham Nation.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5a8ae50f-6526-45f6-9754-be62b4c7dbe0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240827185731Z-152.bmp

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6644

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Windows Analysis Report
San Xavier District of the Tohono O#U2019odham Nation.pdf

Target ID:	4
Start time:	14:57:27
Start date:	27/08/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1584,i,2345941670000869250,4026492604822404281,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	14:57:51
Start date:	27/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://baycitymi-my.sharepoint.com/:o:/g/personal/avogel_baycitymi_gov/Elmi9pmfBD9FsxTL7-oQ2IoBeHOG7eWvLU9bAnRZwDCz7Q?e=tcLUbt"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	14:57:52
Start date:	27/08/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2008,i,17246115955249219125,14719809775228950345,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre