Edit tour

Windows Analysis Report
https://cityofsolanabeach-my.sharepoint.com/:b:/r/personal/lyim_cosb_org/Documents/Microsoft Teams Chat Files/04212025141353-0001.pdf?csf=1&web=1

Overview

General Information

Sample URL:	https://cityofsolanabeach-my.sharepoint.com/:b:/r/personal/lyim_cosb_org/Documents/Microsoft Teams Chat Files/04212025141353-0001.pdf?csf=1&web=1
Analysis ID:	1672189
Infos:

Detection

Score:	1
Range:	0 - 100
Confidence:	80%

Signatures

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5960 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2156,i,11171481201563504429,16075537620969772834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6736 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cityofsolanabeach-my.sharepoint.com/:b:/r/personal/lyim_cosb_org/Documents/Microsoft%20Teams%20Chat%20Files/04212025141353-0001.pdf?csf=1&web=1" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d&sso_reload=true

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.6:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.6:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.62.129:443 -> 192.168.2.6:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.222.3.228:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.176:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.164:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.7:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.155.3:443 -> 192.168.2.6:49739 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: cityofsolanabeach-my.sharepoint.com to https://login.microsoftonline.com:443/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5fid=00000003%2d0000%2d0ff1%2dce00%2d000000000000&response%5fmode=form%5fpost&response%5ftype=code%20id%5ftoken&resource=00000003%2d0000%2d0ff1%2dce00%2d000000000000&scope=openid&nonce=4d0a58e010049c5cec6e7ae0acefb6a5009b22e318b5c6e6%2dff696de58c6764e2936e0fa2eefada13a0cfc230de9e59fbf12fa3b1cfa8a6ff&redirect%5furi=https%3a%2f%2fcityofsolanabeach%2dmy%2esharepoint%2ecom%2f%5fforms%2fdefault%2easpx&state=od0w&claims=%7b%22id%5ftoken%22%3a%7b%22xms%5fcc%22%3a%7b%22values%22%3a%5b%22cp1%22%5d%7d%7d%7d&wsucxt=1&cobrandid=11bd8083%2d87e0%2d41b5%2dbb78%2d0bc43c8a8e8a&client%2drequest%2did=bc5597a1%2db053%2d8000%2dae3e%2d1a732b3d6f5d

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /:b:/r/personal/lyim_cosb_org/Documents/Microsoft%20Teams%20Chat%20Files/04212025141353-0001.pdf?csf=1&web=1 HTTP/1.1Host: cityofsolanabeach-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/lyim_cosb_org/Documents/Microsoft%20Teams%20Chat%20Files/04212025141353-0001.pdf?csf=1&web=1&CID=905aaab5-842f-4e16-8c21-78919e2e4804 HTTP/1.1Host: cityofsolanabeach-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/lyim_cosb_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Flyim%5Fcosb%5Forg%2FDocuments%2FMicrosoft%20Teams%20Chat%20Files%2F04212025141353%2D0001%2Epdf%3Fcsf%3D1%26web%3D1%26CID%3D905aaab5%2D842f%2D4e16%2D8c21%2D78919e2e4804 HTTP/1.1Host: cityofsolanabeach-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_forms/default.aspx?ReturnUrl=%2fpersonal%2flyim_cosb_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Flyim%255Fcosb%255Forg%252FDocuments%252FMicrosoft%2520Teams%2520Chat%2520Files%252F04212025141353%252D0001%252Epdf%253Fcsf%253D1%2526web%253D1%2526CID%253D905aaab5%252D842f%252D4e16%252D8c21%252D78919e2e4804&Source=cookie HTTP/1.1Host: cityofsolanabeach-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGbHlpbSU1RmNvc2IlNUZvcmclMkZEb2N1bWVudHMlMkZNaWNyb3NvZnQlMjBUZWFtcyUyMENoYXQlMjBGaWxlcyUyRjA0MjEyMDI1MTQxMzUzJTJEMDAwMSUyRXBkZiUzRmNzZiUzRDElMjZ3ZWIlM0QxJTI2Q0lEJTNEOTA1YWFhYjUlMkQ4NDJmJTJENGUxNiUyRDhjMjElMkQ3ODkxOWUyZTQ4MDQ=
Source: global traffic	HTTP traffic detected: GET /83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d HTTP/1.1Host: login.microsoftonline.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d&sso_reload=true HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5dAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-FXV4sYLFtI=AQABCQEAAABVrSpeuWamRam2jAF1XRQExuOyBdSO3BZdUl3-qQBUY0gA84xA_yrP87XH6lgt0aPc0Gv7AwWZ7xCy41cbo3h1pxbU9mQYLrqAyuvkUB0EC0Q4hh64537Fti7zqKEHamb4i_2jRmrkU9kKIy0wfXybJKNJmv4DClugCy7fzSE7uiAA; fpc=AuIFpnMgGx9Nnk-AJEH4ucE; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEAl7MPZaLYFwPz5nRmVLRFyBwOl27ZF39HLqwV-vgLrgLwNnr7CsFuKtya5u8wYx2Yg1UmVJMsgxnJ6rI5eCoX-GkK3qcxP9xxc5xl8zowY-KfTqEh3oFkrYYTySO4PijQ6Bs0Og_U18j02V35uXCv2DX1WpKZAzBYqx9YL9XpYYgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5dAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-FXV4sYLFtI=AQABCQEAAABVrSpeuWamRam2jAF1XRQExuOyBdSO3BZdUl3-qQBUY0gA84xA_yrP87XH6lgt0aPc0Gv7AwWZ7xCy41cbo3h1pxbU9mQYLrqAyuvkUB0EC0Q4hh64537Fti7zqKEHamb4i_2jRmrkU9kKIy0wfXybJKNJmv4DClugCy7fzSE7uiAA; fpc=AuIFpnMgGx9Nnk-AJEH4ucE; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEAl7MPZaLYFwPz5nRmVLRFyBwOl27ZF39HLqwV-vgLrgLwNnr7CsFuKtya5u8wYx2Yg1UmVJMsgxnJ6rI5eCoX-GkK3qcxP9xxc5xl8zowY-KfTqEh3oFkrYYTySO4PijQ6Bs0Og_U18j02V35uXCv2DX1WpKZAzBYqx9YL9XpYYgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-uy07ptllz8mdw7abaacimks8-p9pcmn-qsct0uoe6aw/logintenantbranding/0/favicon?ts=638477616223106700 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-uy07ptllz8mdw7abaacimks8-p9pcmn-qsct0uoe6aw/logintenantbranding/0/favicon?ts=638477616223106700 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-uy07ptllz8mdw7abaacimks8-p9pcmn-qsct0uoe6aw/logintenantbranding/0/illustration?ts=638477616232014667 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-uy07ptllz8mdw7abaacimks8-p9pcmn-qsct0uoe6aw/logintenantbranding/0/bannerlogo?ts=638477648718392351 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /83bece33-c444-450f-bc7d-e2db906db4bb/winauth/ssoprobe?client-request-id=bc5597a1-b053-8000-ae3e-1a732b3d6f5d&_=1745420749193 HTTP/1.1Host: autologon.microsoftazuread-sso.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-uy07ptllz8mdw7abaacimks8-p9pcmn-qsct0uoe6aw/logintenantbranding/0/bannerlogo?ts=638477648718392351 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-uy07ptllz8mdw7abaacimks8-p9pcmn-qsct0uoe6aw/logintenantbranding/0/illustration?ts=638477616232014667 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/instrumentation/dssostatus HTTP/1.1Host: login.microsoftonline.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-FXV4sYLFtI=AQABCQEAAABVrSpeuWamRam2jAF1XRQExuOyBdSO3BZdUl3-qQBUY0gA84xA_yrP87XH6lgt0aPc0Gv7AwWZ7xCy41cbo3h1pxbU9mQYLrqAyuvkUB0EC0Q4hh64537Fti7zqKEHamb4i_2jRmrkU9kKIy0wfXybJKNJmv4DClugCy7fzSE7uiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AUUAM86-g0TED0W8feLbkG20uwMAAAAAAPEPzgAAAAAAAABFAABFAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEvFmW9LkO-CuueIHcx3n9NLH8YK9HczFS2kEKHUeDqi9cwvjJVOxuXTHgooQwEXjYPJuMXalvXd5nYyu3Ln0o_5PbJQVHOIwUjS06M1YsRBogAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEU6xihjuwEEDCEUitnDWQxdK-BQL47zqqe_-Xk0a4miA9mjWb-dlm6JXscc9tQsU1WaSaTncnDLlRutBD1f1hwheix8IDmZHczG3-kN1CgkUXVVfdWpEeTeFuqRe7ioiaQhj1M25GLqUSe2J8BAIW9Fa0-o9nAo8Wkdbi4HizMs4gAA; esctx-pRB8z4dIEDo=AQABCQEAAABVrSpeuWamRam2jAF1XRQEwjBWZW8QVbRoTrWyqUyGVD7exB2b4R_ippuqoD6HO7DiseG0VmsrSL6JO7cEb-hCxLErr1x4u8Jdwn8yRXadLXSHR8Sld1AoZ6_elFdEBLHa3mL0gJgo0lwMBm8qyO7T4gBA38xSP8H5GWyYYj5KsiAA; fpc=AuIFpnMgGx9Nnk-AJEH4ucF79WTGAQAAAMj4mt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=3c31e842-8150-4f63-b3e7-f3790430292d; brcap=0; ai_session=zjBSvXJzJPf6JrK3pmhDlQ\|1745420750769\|1745420750769
Source: global traffic	HTTP traffic detected: GET /common/GetCredentialType?mkt=en-US HTTP/1.1Host: login.microsoftonline.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: esctx-FXV4sYLFtI=AQABCQEAAABVrSpeuWamRam2jAF1XRQExuOyBdSO3BZdUl3-qQBUY0gA84xA_yrP87XH6lgt0aPc0Gv7AwWZ7xCy41cbo3h1pxbU9mQYLrqAyuvkUB0EC0Q4hh64537Fti7zqKEHamb4i_2jRmrkU9kKIy0wfXybJKNJmv4DClugCy7fzSE7uiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AUUAM86-g0TED0W8feLbkG20uwMAAAAAAPEPzgAAAAAAAABFAABFAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEvFmW9LkO-CuueIHcx3n9NLH8YK9HczFS2kEKHUeDqi9cwvjJVOxuXTHgooQwEXjYPJuMXalvXd5nYyu3Ln0o_5PbJQVHOIwUjS06M1YsRBogAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEU6xihjuwEEDCEUitnDWQxdK-BQL47zqqe_-Xk0a4miA9mjWb-dlm6JXscc9tQsU1WaSaTncnDLlRutBD1f1hwheix8IDmZHczG3-kN1CgkUXVVfdWpEeTeFuqRe7ioiaQhj1M25GLqUSe2J8BAIW9Fa0-o9nAo8Wkdbi4HizMs4gAA; esctx-pRB8z4dIEDo=AQABCQEAAABVrSpeuWamRam2jAF1XRQEwjBWZW8QVbRoTrWyqUyGVD7exB2b4R_ippuqoD6HO7DiseG0VmsrSL6JO7cEb-hCxLErr1x4u8Jdwn8yRXadLXSHR8Sld1AoZ6_elFdEBLHa3mL0gJgo0lwMBm8qyO7T4gBA38xSP8H5GWyYYj5KsiAA; fpc=AuIFpnMgGx9Nnk-AJEH4ucF79WTGAQAAAMj4mt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=3c31e842-8150-4f63-b3e7-f3790430292d; brcap=0; ai_session=zjBSvXJzJPf6JrK3pmhDlQ\|1745420750769\|1745420750769; MSFPC=GUID=d9890915ece248369b87dc3e57a3b40f&HASH=d989&LV=202504&V=4&LU=1745420755484

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cityofsolanabeach-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msauthimages.net
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com

Source: unknown

HTTP traffic detected: POST /api/report?catId=GW+estsfd+wst HTTP/1.1Host: identity.nel.measure.office.netConnection: keep-aliveContent-Length: 1134Content-Type: application/reports+jsonOrigin: https://login.microsoftonline.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateSet-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyStrict-Transport-Security: max-age=31536000; includeSubDomainsX-Content-Type-Options: nosniffP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 8df307ee-b62b-4836-bc4e-b1bbdedd7a00x-ms-ests-server: 2.1.20540.5 - WUS3 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.PReferrer-Policy: strict-origin-when-cross-originContent-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-4vGyWf2RRXKIuiLvn77zOw' 'unsafe-inline' 'unsafe-eval' https://*.msauth.net https://*.msftauth.net https://*.msftauthimages.net https://*.msauthimages.net https://*.msidentity.com https://*.microsoftonline-p.com https://*.microsoftazuread-sso.com https://*.azureedge.net https://*.outlook.com https://*.office.com https://*.office365.com https://*.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-AllX-XSS-Protection: 0Date: Wed, 23 Apr 2025 15:05:45 GMTConnection: closeContent-Length: 0

Source: chromecache_76.3.dr, chromecache_88.3.dr

String found in binary or memory: http://ns.attribution.com/ads/1.0/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49680
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.6:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.6:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.62.129:443 -> 192.168.2.6:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.222.3.228:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.176:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.62.226.164:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.151.7:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.155.3:443 -> 192.168.2.6:49739 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@24/37@20/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2156,i,11171481201563504429,16075537620969772834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cityofsolanabeach-my.sharepoint.com/:b:/r/personal/lyim_cosb_org/Documents/Microsoft%20Teams%20Chat%20Files/04212025141353-0001.pdf?csf=1&web=1"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2156,i,11171481201563504429,16075537620969772834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://cityofsolanabeach-my.sharepoint.com/:b:/r/personal/lyim_cosb_org/Documents/Microsoft%20Teams%20Chat%20Files/04212025141353-0001.pdf?csf=1&web=1	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://cityofsolanabeach-my.sharepoint.com/personal/lyim_cosb_org/Documents/Microsoft%20Teams%20Chat%20Files/04212025141353-0001.pdf?csf=1&web=1&CID=905aaab5-842f-4e16-8c21-78919e2e4804	0%	Avira URL Cloud	safe
https://cityofsolanabeach-my.sharepoint.com/personal/lyim_cosb_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Flyim%5Fcosb%5Forg%2FDocuments%2FMicrosoft%20Teams%20Chat%20Files%2F04212025141353%2D0001%2Epdf%3Fcsf%3D1%26web%3D1%26CID%3D905aaab5%2D842f%2D4e16%2D8c21%2D78919e2e4804	0%	Avira URL Cloud	safe
https://cityofsolanabeach-my.sharepoint.com/_forms/default.aspx?ReturnUrl=%2fpersonal%2flyim_cosb_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Flyim%255Fcosb%255Forg%252FDocuments%252FMicrosoft%2520Teams%2520Chat%2520Files%252F04212025141353%252D0001%252Epdf%253Fcsf%253D1%2526web%253D1%2526CID%253D905aaab5%252D842f%252D4e16%252D8c21%252D78919e2e4804&Source=cookie	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	high
e329293.dscd.akamaiedge.net	23.62.226.164	true	false	high
www.google.com	142.250.69.4	true	false	high
s-part-0043.t-0009.t-msedge.net	13.107.246.71	true	false	high
a1894.dscb.akamai.net	23.222.3.228	true	false	high
www.tm.a.prd.aadg.trafficmanager.net	40.126.62.129	true	false	high
autologon.microsoftazuread-sso.com	20.190.151.7	true	false	high
aadcdn.msauthimages.net	unknown	unknown	false	high
cityofsolanabeach-my.sharepoint.com	unknown	unknown	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://aadcdn.msauthimages.net/dbd5a2dd-uy07ptllz8mdw7abaacimks8-p9pcmn-qsct0uoe6aw/logintenantbranding/0/favicon?ts=638477616223106700	false		high
https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US	false		high
https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d&sso_reload=true	false		high
https://aadcdn.msauthimages.net/dbd5a2dd-uy07ptllz8mdw7abaacimks8-p9pcmn-qsct0uoe6aw/logintenantbranding/0/bannerlogo?ts=638477648718392351	false		high
https://cityofsolanabeach-my.sharepoint.com/:b:/r/personal/lyim_cosb_org/Documents/Microsoft%20Teams%20Chat%20Files/04212025141353-0001.pdf?csf=1&web=1	false		unknown
https://cityofsolanabeach-my.sharepoint.com/personal/lyim_cosb_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Flyim%5Fcosb%5Forg%2FDocuments%2FMicrosoft%20Teams%20Chat%20Files%2F04212025141353%2D0001%2Epdf%3Fcsf%3D1%26web%3D1%26CID%3D905aaab5%2D842f%2D4e16%2D8c21%2D78919e2e4804	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/favicon.ico	false		high
https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+est	false		high
https://login.microsoftonline.com/common/instrumentation/dssostatus	false		high
https://cityofsolanabeach-my.sharepoint.com/personal/lyim_cosb_org/Documents/Microsoft%20Teams%20Chat%20Files/04212025141353-0001.pdf?csf=1&web=1&CID=905aaab5-842f-4e16-8c21-78919e2e4804	false	Avira URL Cloud: safe	unknown
https://cityofsolanabeach-my.sharepoint.com/_forms/default.aspx?ReturnUrl=%2fpersonal%2flyim_cosb_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Flyim%255Fcosb%255Forg%252FDocuments%252FMicrosoft%2520Teams%2520Chat%2520Files%252F04212025141353%252D0001%252Epdf%253Fcsf%253D1%2526web%253D1%2526CID%253D905aaab5%252D842f%252D4e16%252D8c21%252D78919e2e4804&Source=cookie	false	Avira URL Cloud: safe	unknown
https://aadcdn.msauthimages.net/dbd5a2dd-uy07ptllz8mdw7abaacimks8-p9pcmn-qsct0uoe6aw/logintenantbranding/0/illustration?ts=638477616232014667	false		high
https://autologon.microsoftazuread-sso.com/83bece33-c444-450f-bc7d-e2db906db4bb/winauth/ssoprobe?client-request-id=bc5597a1-b053-8000-ae3e-1a732b3d6f5d&_=1745420749193	false		high
https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d	false		high
https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ns.attribution.com/ads/1.0/	chromecache_76.3.dr, chromecache_88.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.69.4	www.google.com	United States	15169	GOOGLEUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.62.226.176	unknown	United States	20940	AKAMAI-ASN1EU	false
23.62.226.164	e329293.dscd.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
23.222.3.228	a1894.dscb.akamai.net	United States	8612	TISCALI-IT	false
20.190.151.7	autologon.microsoftazuread-sso.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.190.155.3	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.126.62.129	www.tm.a.prd.aadg.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1672189
Start date and time:	2025-04-23 17:04:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://cityofsolanabeach-my.sharepoint.com/:b:/r/personal/lyim_cosb_org/Documents/Microsoft Teams Chat Files/04212025141353-0001.pdf?csf=1&web=1
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@24/37@20/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 192.178.49.195, 142.250.68.238, 192.178.49.174, 142.250.101.84, 142.250.69.14, 20.190.190.194, 23.220.73.19, 192.178.49.170, 142.250.69.10, 142.250.68.234, 192.178.49.202, 13.89.179.14, 51.105.71.137, 20.190.190.130, 40.126.62.132, 20.190.190.129, 20.190.190.131, 40.126.62.130, 20.190.190.195, 20.190.190.196, 184.29.183.29, 13.107.246.71, 4.245.163.56
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, www.tm.lg.prod.aadmsa.akadns.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, onedscolprduks03.uksouth.cloudapp.azure.com, clients2.google.com, redirector.gvt1.com, login.live.com, update.googleapis.com, c.pki.goog, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, aadcdnoriginwus2.afd.azureedge.net, onedscolprdcus18.centralus.cloudapp.azure.com, clients.l.google.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://cityofsolanabeach-my.sharepoint.com/:b:/r/personal/lyim_cosb_org/Documents/Microsoft%20Teams%20Chat%20Files/04212025141353-0001.pdf?csf=1&web=1

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3141
Entropy (8bit):	7.92865776552074
Encrypted:	false
SSDEEP:	96:2A7BWaJRUzY13FG8bq4maycmjPKFEVw/ajdNv:R7Dwk13FHu4mawjkEVw6d1
MD5:	A463C08EE9D86F624AE18D97C4F88740
SHA1:	C8D9D492218A34018A3D829E7D656CC2E0A2CA8C
SHA-256:	9277F7934C16E90DA006AEC2D3751E16A18CE320AF6A4B8E53997F20CEDC43ED
SHA-512:	565B13D7CE43950608A717A4026AD852FF0186E819B7A1CF1B7BE7CB069D960C11C2D31D72F118802F0799708368DB8B33CFB205EE5329569B7526FCB5A06D15
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauthimages.net/dbd5a2dd-uy07ptllz8mdw7abaacimks8-p9pcmn-qsct0uoe6aw/logintenantbranding/0/favicon?ts=638477616223106700
Preview:	.PNG........IHDR... ... .....szz.....pHYs...#...#.x.?v....IDATX....w\.y..{...}.2...%K.e...ll6c.........BI{BC1.....==m......iB.P...cc0>..ml.eY..k..I..F3.U.;...NH..........~.....#.. .P,B.P$.+P(.H...'.....17..a.k...3.C.s%.BQ.j..K... ....Sv...z....,f...D..V.A....a._%.d..-..E.G.s..}v.\|...e29.........s.e5...9..V.'b)O..}Q.~Q.4.m.s.H)...$.K..C.aT........S.S.9....?28..[.....%..3.....,r....l.A..Y.V....b........Z'I....bQ.".......d..?<..c..\|..cc......`.i..K.j..GS....<.L9.s....s.(..$.......Cs?Y.Z..:............d-.\|....=.X...io............6{.F>.$.N}.f(..l/gt..,.@0.....M2...edQ.>q.w.M.T...@.P.,...$.H........l.5..........RH.-.....H[.[4...e_..<4x...M."........Z...N..1.......A..`8..f..@..6...'.z+..+J..~..../.l.......n.K^ell.....4B.D.P....v..2N..x<Z......+........>.^Ws..cc?,.U.......&...)......,c..-M+8r.$.....k.b2.J3J...'5.......Z... .u5SV.0gz'Y...7o....$R..4.........}...2..@.P..@"...'.=..KK..U.3...f..of<\|?..OB1...X.,.uPT...z.....4.C.....Y.z.L{..U523..f.q:...

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2025 17:05:33.970694065 CEST	53	64377	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:34.025554895 CEST	53	63385	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:35.177546024 CEST	53	50880	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:38.251785040 CEST	52869	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:38.251971960 CEST	54026	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:38.392307997 CEST	53	54026	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:38.392546892 CEST	53	52869	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:38.930099964 CEST	63867	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:38.930316925 CEST	57122	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:39.197592020 CEST	53	57122	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:39.215308905 CEST	53	63867	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:42.084456921 CEST	58588	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:42.084640026 CEST	55283	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:42.225059032 CEST	53	55283	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:42.225078106 CEST	53	58588	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:45.194510937 CEST	52130	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:45.195055008 CEST	49843	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:45.335443974 CEST	53	49843	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:45.336668015 CEST	53	52130	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:45.466144085 CEST	57206	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:45.466574907 CEST	52360	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:45.606674910 CEST	53	52360	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:45.606690884 CEST	53	57206	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:47.822587013 CEST	64701	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:47.823210001 CEST	58689	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:47.963954926 CEST	53	58689	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:47.965260029 CEST	53	64701	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:48.748114109 CEST	57317	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:48.748435020 CEST	65486	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:48.888359070 CEST	53	57317	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:48.899955988 CEST	53	65486	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:50.001142025 CEST	53860	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:50.001441002 CEST	56286	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:50.143068075 CEST	53	53860	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:50.143181086 CEST	53	56286	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:52.139440060 CEST	53	57444	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:52.212532043 CEST	53	54005	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:52.316907883 CEST	52960	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:52.317065954 CEST	64287	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:05:52.458271027 CEST	53	52960	1.1.1.1	192.168.2.6
Apr 23, 2025 17:05:52.458697081 CEST	53	64287	1.1.1.1	192.168.2.6
Apr 23, 2025 17:06:11.231991053 CEST	53	53833	1.1.1.1	192.168.2.6
Apr 23, 2025 17:06:32.705305099 CEST	138	138	192.168.2.6	192.168.2.255
Apr 23, 2025 17:06:33.654983997 CEST	53	52224	1.1.1.1	192.168.2.6
Apr 23, 2025 17:06:34.289028883 CEST	53	60885	1.1.1.1	192.168.2.6
Apr 23, 2025 17:06:36.934031963 CEST	53	52838	1.1.1.1	192.168.2.6
Apr 23, 2025 17:06:45.781249046 CEST	62649	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:06:45.781430960 CEST	55212	53	192.168.2.6	1.1.1.1
Apr 23, 2025 17:06:45.921874046 CEST	53	55212	1.1.1.1	192.168.2.6
Apr 23, 2025 17:06:45.922168016 CEST	53	62649	1.1.1.1	192.168.2.6

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:39 UTC	792	OUT	GET /:b:/r/personal/lyim_cosb_org/Documents/Microsoft%20Teams%20Chat%20Files/04212025141353-0001.pdf?csf=1&web=1 HTTP/1.1 Host: cityofsolanabeach-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:05:40 UTC	1016	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/plain Location: https://cityofsolanabeach-my.sharepoint.com/personal/lyim_cosb_org/Documents/Microsoft%20Teams%20Chat%20Files/04212025141353-0001.pdf?csf=1&web=1&CID=905aaab5-842f-4e16-8c21-78919e2e4804 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,4194720,0,87,1049132,1766319,1766319,18503 SPRequestGuid: bb5597a1-60d5-8000-ae3e-17d443e9b629 request-id: bb5597a1-60d5-8000-ae3e-17d443e9b629 MS-CV: oZdVu9VgAICuPhfUQ+m2KQ.0 Strict-Transport-Security: max-age=31536000 IsOCDI: 0 SPRequestDuration: 6 SPIisLatency: 2 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.26002 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 0396293600804FD5B3E8FCBDDFEB2812 Ref B: PHX31EDGE0511 Ref C: 2025-04-23T15:05:39Z Date: Wed, 23 Apr 2025 15:05:39 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:40 UTC	827	OUT	GET /personal/lyim_cosb_org/Documents/Microsoft%20Teams%20Chat%20Files/04212025141353-0001.pdf?csf=1&web=1&CID=905aaab5-842f-4e16-8c21-78919e2e4804 HTTP/1.1 Host: cityofsolanabeach-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:05:40 UTC	1244	IN	HTTP/1.1 302 Found Content-Length: 402 Content-Type: text/html; charset=utf-8 Location: https://cityofsolanabeach-my.sharepoint.com/personal/lyim_cosb_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Flyim%5Fcosb%5Forg%2FDocuments%2FMicrosoft%20Teams%20Chat%20Files%2F04212025141353%2D0001%2Epdf%3Fcsf%3D1%26web%3D1%26CID%3D905aaab5%2D842f%2D4e16%2D8c21%2D78919e2e4804 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,4194720,17989,224,330466,2064587,2064587,22179 X-SharePointHealthScore: 1 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: bb5597a1-b0e0-8000-ae3e-1559ed679315 request-id: bb5597a1-b0e0-8000-ae3e-1559ed679315 MS-CV: oZdVu+CwAICuPhVZ7WeTFQ.0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.26002 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 11A96ED929C2489D81D2E7DE5FC84A04 Ref B: PHX31EDGE0520 Ref C: 2025-04-23T15:05:40Z Date: Wed, 23 Apr 2025 15:05:40 GMT Connection: close
2025-04-23 15:05:40 UTC	402	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 69 74 79 6f 66 73 6f 6c 61 6e 61 62 65 61 63 68 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 6c 79 69 6d 5f 63 6f 73 62 5f 6f 72 67 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 41 75 74 68 65 6e 74 69 63 61 74 65 2e 61 73 70 78 3f 53 6f 75 72 63 65 3d 25 32 46 70 65 72 73 6f 6e 61 6c 25 32 46 6c 79 69 6d 25 35 46 63 6f 73 62 25 35 46 6f 72 67 25 32 46 44 6f 63 75 6d 65 6e 74 73 25 32 46 4d 69 63 72 6f 73 6f 66 74 25 32 30 54 65 61 6d 73 25 32 30 43 68 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://cityofsolanabeach-my.sharepoint.com/personal/lyim_cosb_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Flyim%5Fcosb%5Forg%2FDocuments%2FMicrosoft%20Teams%20Ch

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:40 UTC	926	OUT	GET /personal/lyim_cosb_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Flyim%5Fcosb%5Forg%2FDocuments%2FMicrosoft%20Teams%20Chat%20Files%2F04212025141353%2D0001%2Epdf%3Fcsf%3D1%26web%3D1%26CID%3D905aaab5%2D842f%2D4e16%2D8c21%2D78919e2e4804 HTTP/1.1 Host: cityofsolanabeach-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:05:41 UTC	1805	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 466 Content-Type: text/html; charset=utf-8 Location: /_forms/default.aspx?ReturnUrl=%2fpersonal%2flyim_cosb_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Flyim%255Fcosb%255Forg%252FDocuments%252FMicrosoft%2520Teams%2520Chat%2520Files%252F04212025141353%252D0001%252Epdf%253Fcsf%253D1%2526web%253D1%2526CID%253D905aaab5%252D842f%252D4e16%252D8c21%252D78919e2e4804&Source=cookie P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGbHlpbSU1RmNvc2IlNUZvcmclMkZEb2N1bWVudHMlMkZNaWNyb3NvZnQlMjBUZWFtcyUyMENoYXQlMjBGaWxlcyUyRjA0MjEyMDI1MTQxMzUzJTJEMDAwMSUyRXBkZiUzRmNzZiUzRDElMjZ3ZWIlM0QxJTI2Q0lEJTNEOTA1YWFhYjUlMkQ4NDJmJTJENGUxNiUyRDhjMjElMkQ3ODkxOWUyZTQ4MDQ=; expires=Wed, 23-Apr-2025 15:15:41 GMT; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,4194720,1200,202,1351161,1051136,1051136,20945 X-SharePointHealthScore: 2 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: bc5597a1-501c-8000-ae3e-1bea34e63820 request-id: bc5597a1-501c-8000-ae3e-1bea34e63820 MS-CV: oZdVvBxQAICuPhvqNOY4IA.0 Strict-Transport-Security: max-age=31536000 SPRequestDuration: 14 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.26002 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: EF384DF258954F748A75FF702BBEBDA8 Ref B: PHX31EDGE0612 Ref C: 2025-04-23T15:05:41Z Date: Wed, 23 Apr 2025 15:05:40 GMT Connection: close
2025-04-23 15:05:41 UTC	466	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 2f 5f 66 6f 72 6d 73 2f 64 65 66 61 75 6c 74 2e 61 73 70 78 3f 52 65 74 75 72 6e 55 72 6c 3d 25 32 66 70 65 72 73 6f 6e 61 6c 25 32 66 6c 79 69 6d 5f 63 6f 73 62 5f 6f 72 67 25 32 66 5f 6c 61 79 6f 75 74 73 25 32 66 31 35 25 32 66 41 75 74 68 65 6e 74 69 63 61 74 65 2e 61 73 70 78 25 33 66 53 6f 75 72 63 65 25 33 64 25 32 35 32 46 70 65 72 73 6f 6e 61 6c 25 32 35 32 46 6c 79 69 6d 25 32 35 35 46 63 6f 73 62 25 32 35 35 46 6f 72 67 25 32 35 32 46 44 6f 63 75 6d 65 6e 74 73 25 32 35 32 46 4d 69 63 72 6f 73 6f 66 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="/_forms/default.aspx?ReturnUrl=%2fpersonal%2flyim_cosb_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Flyim%255Fcosb%255Forg%252FDocuments%252FMicrosof

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:41 UTC	1308	OUT	GET /_forms/default.aspx?ReturnUrl=%2fpersonal%2flyim_cosb_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Flyim%255Fcosb%255Forg%252FDocuments%252FMicrosoft%2520Teams%2520Chat%2520Files%252F04212025141353%252D0001%252Epdf%253Fcsf%253D1%2526web%253D1%2526CID%253D905aaab5%252D842f%252D4e16%252D8c21%252D78919e2e4804&Source=cookie HTTP/1.1 Host: cityofsolanabeach-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGbHlpbSU1RmNvc2IlNUZvcmclMkZEb2N1bWVudHMlMkZNaWNyb3NvZnQlMjBUZWFtcyUyMENoYXQlMjBGaWxlcyUyRjA0MjEyMDI1MTQxMzUzJTJEMDAwMSUyRXBkZiUzRmNzZiUzRDElMjZ3ZWIlM0QxJTI2Q0lEJTNEOTA1YWFhYjUlMkQ4NDJmJTJENGUxNiUyRDhjMjElMkQ3ODkxOWUyZTQ4MDQ=
2025-04-23 15:05:42 UTC	3781	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Length: 893 Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://login.microsoftonline.com:443/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: nSGt-4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6=gYEwODBDMUNGQzNGOUZFMDFERTA2NkRDMUJBQzJGMjIyRjM4Q0ZFMjE0MjNDMzZGNUREMDREMEE1OEUwMTAwNDlDNUNFQzZFN0FFMEFDRUZCNkE1MDA5QjIyRTMxOEI1QzZFNhIxMzM4OTg5NDU4MTk2Mjg3NDQjY2l0eW9mc29sYW5hYmVhY2gtbXkuc2hhcmVwb2ludC5jb22W84Evx1hA1DSt/BgkXtrZYtX7rxPjAyd7RfqBJA47RS+TvV4hORiysUnWzFudiGgJhE7ZierIIw82Oza57z4EioHbsn9FqVTJQ9CZHH0FjvjaOKuZpnCi+uPJKxZD0+uiJwLDXuFMa36nzaBOhwYmSp3uuxT3M5AksxcCAyQKSKCQ2lNo2b8K9TKc5fC5tQImjXyJiXEScwfkL7tp4XM28YTSPbfqlEQTjnUxU+fuP6Cbr7OtQlKcbtu0Y+d9PqJaEdvkDQt8enlPTwIwSBjHisiN9bctIQD0qmyEXyz/G+H44WoICC6nZ6CAmm1iq2dg8eLZBMtvDrDZhf8IhkIimwAAAA==; expires=Wed, 23-Apr-2025 15:09:41 GMT; path=/; SameSite=None; secure; HttpOnly Set-Cookie: nSGt-4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6=; expires=Thu, 01-Jan-1970 08:00:00 GMT; path=/; SameSite=None; Partitioned; secure; HttpOnly Set-Cookie: RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGbHlpbSU1RmNvc2IlNUZvcmclMkZEb2N1bWVudHMlMkZNaWNyb3NvZnQlMjBUZWFtcyUyMENoYXQlMjBGaWxlcyUyRjA0MjEyMDI1MTQxMzUzJTJEMDAwMSUyRXBkZiUzRmNzZiUzRDElMjZ3ZWIlM0QxJTI2Q0lEJTNEOTA1YWFhYjUlMkQ4NDJmJTJENGUxNiUyRDhjMjElMkQ3ODkxOWUyZTQ4MDQmUHJldmlvdXNSZXF1ZXN0Q29ycmVsYXRpb25JZD1iYzU1OTdhMSUyRGIwNTMlMkQ4MDAwJTJEYWUzZSUyRDFhNzMyYjNkNmY1ZCZSZXR1cm5Vcmw9JTJGcGVyc29uYWwlMkZseWltJTVGY29zYiU1Rm9yZyUyRiU1RmxheW91dHMlMkYxNSUyRkF1dGhlbnRpY2F0ZSUyRWFzcHglM0ZTb3VyY2UlM0QlMjUyRnBlcnNvbmFsJTI1MkZseWltJTI1NUZjb3NiJTI1NUZvcmclMjUyRkRvY3VtZW50cyUyNTJGTWljcm9zb2Z0JTI1MjBUZWFtcyUyNTIwQ2hhdCUyNTIwRmlsZXMlMjUyRjA0MjEyMDI1MTQxMzUzJTI1MkQwMDAxJTI1MkVwZGYlMjUzRmNzZiUyNTNEMSUyNTI2d2ViJTI1M0QxJTI1MjZDSUQlMjUzRDkwNWFhYWI1JTI1MkQ4NDJmJTI1MkQ0ZTE2JTI1MkQ4YzIxJTI1MkQ3ODkxOWUyZTQ4MDQ=; expires=Wed, 23-Apr-2025 15:15:41 GMT; path=/; SameSite=None; secure; HttpOnly Set-Cookie: RpsContextCookie=; expires=Thu, 01-Jan-1970 08:00:00 GMT; path=/; SameSite=None; Partitioned; secure; HttpOnly X-NetworkStatistics: 0,4194720,0,20,424349,138606,138606,18233 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: bc5597a1-b053-8000-ae3e-1a732b3d6f5d request-id: bc5597a1-b053-8000-ae3e-1a732b3d6f5d MS-CV: oZdVvFOwAICuPhpzKz1vXQ.0 Strict-Transport-Security: max-age=31536000 SPRequestDuration: 44 SPIisLatency: 0 Include-Referred-Token-Binding-ID: true X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.26002 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 97438F0B3069443E988EC3C7941A2D34 Ref B: PHX31EDGE0608 Ref C: 2025-04-23T15:05:41Z Date: Wed, 23 Apr 2025 15:05:41 GMT Connection: close
2025-04-23 15:05:42 UTC	364	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 3a 34 34 33 2f 38 33 62 65 63 65 33 33 2d 63 34 34 34 2d 34 35 30 66 2d 62 63 37 64 2d 65 32 64 62 39 30 36 64 62 34 62 62 2f 6f 61 75 74 68 32 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 25 35 46 69 64 3d 30 30 30 30 30 30 30 33 25 32 44 30 30 30 30 25 32 44 30 66 66 31 25 32 44 63 65 30 30 25 32 44 30 30 30 30 30 30 30 30 30 30 30 30 26 61 6d 70 3b 72 65 73 70 6f 6e 73 65 25 35 46 6d 6f 64 65 3d 66 6f 72 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://login.microsoftonline.com:443/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=for
2025-04-23 15:05:42 UTC	529	IN	Data Raw: 73 63 6f 70 65 3d 6f 70 65 6e 69 64 26 61 6d 70 3b 6e 6f 6e 63 65 3d 34 44 30 41 35 38 45 30 31 30 30 34 39 43 35 43 45 43 36 45 37 41 45 30 41 43 45 46 42 36 41 35 30 30 39 42 32 32 45 33 31 38 42 35 43 36 45 36 25 32 44 46 46 36 39 36 44 45 35 38 43 36 37 36 34 45 32 39 33 36 45 30 46 41 32 45 45 46 41 44 41 31 33 41 30 43 46 43 32 33 30 44 45 39 45 35 39 46 42 46 31 32 46 41 33 42 31 43 46 41 38 41 36 46 46 26 61 6d 70 3b 72 65 64 69 72 65 63 74 25 35 46 75 72 69 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 63 69 74 79 6f 66 73 6f 6c 61 6e 61 62 65 61 63 68 25 32 44 6d 79 25 32 45 73 68 61 72 65 70 6f 69 6e 74 25 32 45 63 6f 6d 25 32 46 25 35 46 66 6f 72 6d 73 25 32 46 64 65 66 61 75 6c 74 25 32 45 61 73 70 78 26 61 6d 70 3b 73 74 61 74 65 3d 4f 44 30 Data Ascii: scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:42 UTC	1369	OUT	GET /83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:05:43 UTC	2208	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: fb86bcaf-efe7-476d-85c8-b4376b860e00 x-ms-ests-server: 2.1.20540.5 - NCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-JLPvbgI5g8d5cIaLKAhIgg' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: esctx-FXV4sYLFtI=AQABCQEAAABVrSpeuWamRam2jAF1XRQExuOyBdSO3BZdUl3-qQBUY0gA84xA_yrP87XH6lgt0aPc0Gv7AwWZ7xCy41cbo3h1pxbU9mQYLrqAyuvkUB0EC0Q4hh64537Fti7zqKEHamb4i_2jRmrkU9kKIy0wfXybJKNJmv4DClugCy7fzSE7uiAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=AuIFpnMgGx9Nnk-AJEH4ucE; expires=Fri, 23-May-2025 15:05:42 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEAl7MPZaLYFwPz5nRmVLRFyBwOl27ZF39HLqwV-vgLrgLwNnr7CsFuKtya5u8wYx2Yg1UmVJMsgxnJ6rI5eCoX-GkK3qcxP9xxc5xl8zowY-KfTqEh3oFkrYYTySO4PijQ6Bs0Og_U18j02V35uXCv2DX1WpKZAzBYqx9YL9XpYYgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 23 Apr 2025 15:05:42 GMT Connection: close Content-Length: 21184
2025-04-23 15:05:43 UTC	14176	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html><head> <title>Redirecting</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" conten
2025-04-23 15:05:43 UTC	7008	IN	Data Raw: 4c 6f 61 64 28 29 20 66 61 69 6c 65 64 20 64 65 73 70 69 74 65 20 69 6e 69 74 69 61 6c 20 6c 6f 61 64 20 73 75 63 63 65 73 73 2e 20 5b 27 22 2b 6e 2b 22 27 5d 22 7d 73 26 26 28 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 65 72 72 6f 72 2e 61 73 70 78 3f 65 72 72 3d 35 30 34 22 29 7d 29 7d 2c 63 2e 4f 6e 45 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 65 2e 73 72 63 7c 7c 65 2e 68 72 65 66 7c 7c 22 22 2c 6f 3d 69 28 29 2c 73 3d 61 28 29 3b 69 66 28 21 65 29 7b 74 68 72 6f 77 22 54 68 65 20 74 61 72 67 65 74 20 65 6c 65 6d 65 6e 74 20 6d 75 73 74 20 62 65 20 70 72 6f 76 69 64 65 64 20 61 6e 64 20 63 61 6e 6e 6f 74 20 62 65 20 6e 75 6c 6c 2e 22 7d 72 28 22 5b 24 4c 6f 61 64 65 72 5d 3a 20 46 61 69 Data Ascii: Load() failed despite initial load success. ['"+n+"']"}s&&(document.location.href="/error.aspx?err=504")})},c.OnError=function(e,t){var n=e.src\|\|e.href\|\|"",o=i(),s=a();if(!e){throw"The target element must be provided and cannot be null."}r("[$Loader]: Fai

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:44 UTC	2660	OUT	GET /83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d&sso_reload=true HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-FXV4sYLFtI=AQABCQEAAABVrSpeuWamRam2jAF1XRQExuOyBdSO3BZdUl3-qQBUY0gA84xA_yrP87XH6lgt0aPc0Gv7AwWZ7xCy41cbo3h1pxbU9mQYLrqAyuvkUB0EC0Q4hh64537Fti7zqKEHamb4i_2jRmrkU9kKIy0wfXybJKNJmv4DClugCy7fzSE7uiAA; fpc=AuIFpnMgGx9Nnk-AJEH4ucE; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEAl7MPZaLYFwPz5nRmVLRFyBwOl27ZF39HLqwV-vgLrgLwNnr7CsFuKtya5u8wYx2Yg1UmVJMsgxnJ6rI5eCoX-GkK3qcxP9xxc5xl8zowY-KfTqEh3oFkrYYTySO4PijQ6Bs0Og_U18j02V35uXCv2DX1WpKZAzBYqx9YL9XpYYgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-04-23 15:05:45 UTC	2833	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff X-Frame-Options: DENY Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch X-DNS-Prefetch-Control: on P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 4bf5714a-86ea-4910-9e72-a05070ef6e00 x-ms-ests-server: 2.1.20540.5 - NCUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-N5ZkPBSM0oOEnI-Gi5AU7w' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: buid=1.AUUAM86-g0TED0W8feLbkG20uwMAAAAAAPEPzgAAAAAAAABFAABFAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEvFmW9LkO-CuueIHcx3n9NLH8YK9HczFS2kEKHUeDqi9cwvjJVOxuXTHgooQwEXjYPJuMXalvXd5nYyu3Ln0o_5PbJQVHOIwUjS06M1YsRBogAA; expires=Fri, 23-May-2025 15:05:45 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEU6xihjuwEEDCEUitnDWQxdK-BQL47zqqe_-Xk0a4miA9mjWb-dlm6JXscc9tQsU1WaSaTncnDLlRutBD1f1hwheix8IDmZHczG3-kN1CgkUXVVfdWpEeTeFuqRe7ioiaQhj1M25GLqUSe2J8BAIW9Fa0-o9nAo8Wkdbi4HizMs4gAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx-pRB8z4dIEDo=AQABCQEAAABVrSpeuWamRam2jAF1XRQEwjBWZW8QVbRoTrWyqUyGVD7exB2b4R_ippuqoD6HO7DiseG0VmsrSL6JO7cEb-hCxLErr1x4u8Jdwn8yRXadLXSHR8Sld1AoZ6_elFdEBLHa3mL0gJgo0lwMBm8qyO7T4gBA38xSP8H5GWyYYj5KsiAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=AuIFpnMgGx9Nnk-AJEH4ucF79WTGAQAAAMj4mt8OAAAA; expires=Fri, 23-May-2025 15:05:45 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 23 Apr 2025 15:05:44 GMT Connection: close Content-Length: 45744
2025-04-23 15:05:45 UTC	13551	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 69 67 6e 20 69 6e 20 74 6f 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html dir="ltr" class="" lang="en"><head> <title>Sign in to your account</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
2025-04-23 15:05:45 UTC	16384	IN	Data Raw: 78 42 47 71 43 32 75 32 62 36 6f 4e 4f 56 33 59 58 46 2d 38 48 58 64 30 46 31 43 42 77 74 75 37 58 59 43 32 65 33 4d 30 7a 52 37 30 35 7a 5f 77 42 30 5c 75 30 30 32 36 65 73 74 73 66 65 64 3d 31 5c 75 30 30 32 36 75 61 69 64 3d 62 63 35 35 39 37 61 31 62 30 35 33 38 30 30 30 61 65 33 65 31 61 37 33 32 62 33 64 36 66 35 64 5c 75 30 30 32 36 63 6f 62 72 61 6e 64 69 64 3d 31 31 62 64 38 30 38 33 2d 38 37 65 30 2d 34 31 62 35 2d 62 62 37 38 2d 30 62 63 34 33 63 38 61 38 65 38 61 5c 75 30 30 32 36 66 63 69 3d 30 30 30 30 30 30 30 33 2d 30 30 30 30 2d 30 66 66 31 2d 63 65 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 5c 75 30 30 32 36 77 73 75 63 78 74 3d 31 22 2c 22 75 72 6c 44 65 76 69 63 65 46 69 6e 67 65 72 70 72 69 6e 74 69 6e 67 22 3a 22 22 2c 22 75 72 6c Data Ascii: xBGqC2u2b6oNOV3YXF-8HXd0F1CBwtu7XYC2e3M0zR705z_wB0\u0026estsfed=1\u0026uaid=bc5597a1b0538000ae3e1a732b3d6f5d\u0026cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a\u0026fci=00000003-0000-0ff1-ce00-000000000000\u0026wsucxt=1","urlDeviceFingerprinting":"","url
2025-04-23 15:05:45 UTC	15809	IN	Data Raw: 74 72 79 22 3a 7b 22 74 79 70 65 22 3a 22 43 68 72 6f 6d 65 53 73 6f 54 65 6c 65 6d 65 74 72 79 22 2c 22 6e 6f 6e 63 65 22 3a 22 41 77 41 42 44 77 45 41 41 41 41 44 41 4f 7a 5f 42 51 44 30 5f 33 50 32 59 64 36 71 63 62 72 6c 67 63 35 74 32 70 58 6e 4f 53 48 61 31 6e 56 75 2d 4a 6e 56 78 76 31 6d 49 49 4c 73 44 73 75 6b 52 52 55 6e 48 73 4e 73 38 77 42 31 64 79 47 6d 49 77 4b 75 51 65 65 38 59 6b 6d 51 79 6e 31 46 4a 33 59 64 7a 70 74 6a 37 30 39 73 48 66 64 63 46 5f 69 63 41 36 54 78 6c 75 61 64 39 6e 59 68 49 41 41 22 2c 22 72 65 70 6f 72 74 53 74 61 74 65 73 22 3a 5b 5d 7d 2c 22 72 65 64 69 72 65 63 74 45 6e 64 53 74 61 74 65 73 22 3a 5b 22 65 6e 64 22 5d 2c 22 63 6f 6f 6b 69 65 4e 61 6d 65 73 22 3a 7b 22 61 61 64 53 73 6f 22 3a 22 41 41 44 53 53 4f 22 Data Ascii: try":{"type":"ChromeSsoTelemetry","nonce":"AwABDwEAAAADAOz_BQD0_3P2Yd6qcbrlgc5t2pXnOSHa1nVu-JnVxv1mIILsDsukRRUnHsNs8wB1dyGmIwKuQee8YkmQyn1FJ3Ydzptj709sHfdcF_icA6Txluad9nYhIAA","reportStates":[]},"redirectEndStates":["end"],"cookieNames":{"aadSso":"AADSSO"

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:44 UTC	1856	OUT	GET /favicon.ico HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-FXV4sYLFtI=AQABCQEAAABVrSpeuWamRam2jAF1XRQExuOyBdSO3BZdUl3-qQBUY0gA84xA_yrP87XH6lgt0aPc0Gv7AwWZ7xCy41cbo3h1pxbU9mQYLrqAyuvkUB0EC0Q4hh64537Fti7zqKEHamb4i_2jRmrkU9kKIy0wfXybJKNJmv4DClugCy7fzSE7uiAA; fpc=AuIFpnMgGx9Nnk-AJEH4ucE; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEAl7MPZaLYFwPz5nRmVLRFyBwOl27ZF39HLqwV-vgLrgLwNnr7CsFuKtya5u8wYx2Yg1UmVJMsgxnJ6rI5eCoX-GkK3qcxP9xxc5xl8zowY-KfTqEh3oFkrYYTySO4PijQ6Bs0Og_U18j02V35uXCv2DX1WpKZAzBYqx9YL9XpYYgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-04-23 15:05:45 UTC	1336	IN	HTTP/1.1 404 Not Found Cache-Control: private Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 8df307ee-b62b-4836-bc4e-b1bbdedd7a00 x-ms-ests-server: 2.1.20540.5 - WUS3 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-4vGyWf2RRXKIuiLvn77zOw' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Date: Wed, 23 Apr 2025 15:05:45 GMT Connection: close Content-Length: 0

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:45 UTC	441	OUT	OPTIONS /api/report?catId=GW+estsfd+wst HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Origin: https://login.microsoftonline.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:05:45 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Wed, 23 Apr 2025 15:05:45 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-04-23 15:05:45 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:46 UTC	417	OUT	POST /api/report?catId=GW+estsfd+wst HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Content-Length: 1134 Content-Type: application/reports+json Origin: https://login.microsoftonline.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:05:46 UTC	1134	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 37 31 35 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 38 33 62 65 63 65 33 33 2d 63 34 34 34 2d 34 35 30 66 2d 62 63 37 64 2d 65 32 64 62 39 30 36 64 62 34 62 62 2f 6f 61 75 74 68 32 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 25 35 46 69 64 3d 30 30 30 30 30 30 30 33 25 32 44 30 30 30 30 25 32 44 30 66 66 31 25 32 44 63 65 30 30 25 32 44 30 30 30 30 30 30 30 30 30 30 30 30 26 72 65 Data Ascii: [{"age":0,"body":{"elapsed_time":715,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&re
2025-04-23 15:05:46 UTC	399	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 Request-Context: appId=cid-v1:20c536d6-d891-4743-bdc8-f66a2e341114 Date: Wed, 23 Apr 2025 15:05:46 GMT Connection: close Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	downloaded
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 20x20, segment length 16, baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	298891
Entropy (8bit):	7.983655598697523
Encrypted:	false
SSDEEP:	6144:XEME4SvMEfIe5YWUmB1+zWgs7JlG4dLeffm5WrGhJrMNySPl+X:XEM8vMMIe5YRI1+psHashxKyElW
MD5:	740C91DB22D4A15EB5B4D477970E0076
SHA1:	119331584ED0B883404C703DE27FC595CAEDF629
SHA-256:	0E45E278C7EE9794AE0708EAA2A09A0EAB546371E013B1D0BC5C72C3836E0B58
SHA-512:	A0434C6FC71755134C9DCA04DBCA6C3BD0DF480D3B5FB8E58E8E7CCAA3EA14A848D7893A4A365A2103750AC28371BFDF6C3D78F5952DDDF67CCB474AEF3156A8
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauthimages.net/dbd5a2dd-uy07ptllz8mdw7abaacimks8-p9pcmn-qsct0uoe6aw/logintenantbranding/0/illustration?ts=638477616232014667
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C........................................................ "..".......C.......................................................................8...."........................................V........................!.1A.."Qaq.....2B...#R.$3br.....%CSc....45s.&DTd...t....6..................................<.......................!1.A."Q2aq....#3....B.R.4..C$br.S..............?...Q...@W.#.......\Sc`.\zQ..+.........P).Tp...sJ(......X..2v...;....\......1...p.c.K.J@..j 3..\zS.qE...... .!..P1...JP7.....(

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 20x20, segment length 16, baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	298891
Entropy (8bit):	7.983655598697523
Encrypted:	false
SSDEEP:	6144:XEME4SvMEfIe5YWUmB1+zWgs7JlG4dLeffm5WrGhJrMNySPl+X:XEM8vMMIe5YRI1+psHashxKyElW
MD5:	740C91DB22D4A15EB5B4D477970E0076
SHA1:	119331584ED0B883404C703DE27FC595CAEDF629
SHA-256:	0E45E278C7EE9794AE0708EAA2A09A0EAB546371E013B1D0BC5C72C3836E0B58
SHA-512:	A0434C6FC71755134C9DCA04DBCA6C3BD0DF480D3B5FB8E58E8E7CCAA3EA14A848D7893A4A365A2103750AC28371BFDF6C3D78F5952DDDF67CCB474AEF3156A8
Malicious:	false
Reputation:	low
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C........................................................ "..".......C.......................................................................8...."........................................V........................!.1A.."Qaq.....2B...#R.$3br.....%CSc....45s.&DTd...t....6..................................<.......................!1.A."Q2aq....#3....B.R.4..C$br.S..............?...Q...@W.#.......\Sc`.\zQ..+.........P).Tp...sJ(......X..2v...;....\......1...p.c.K.J@..j 3..\zS.qE...... .!..P1...JP7.....(

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:48 UTC	737	OUT	GET /dbd5a2dd-uy07ptllz8mdw7abaacimks8-p9pcmn-qsct0uoe6aw/logintenantbranding/0/favicon?ts=638477616223106700 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:05:48 UTC	710	IN	HTTP/1.1 200 OK Content-Length: 3141 Content-Type: image/* Content-MD5: pGPAjunYb2JK4Y2XxPiHQA== Last-Modified: Wed, 03 Apr 2024 17:20:22 GMT ETag: 0x8DC54025808B83B x-ms-request-id: d4acdbb1-801e-004f-02a1-6732b6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=79946 Date: Wed, 23 Apr 2025 15:05:48 GMT Connection: close X-Content-Type-Options: nosniff Akamai-GRN: 0.846d3e17.1745420748.99b27c8
2025-04-23 15:05:48 UTC	3141	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 0b f7 49 44 41 54 58 85 8d 97 f9 77 5c f5 79 87 9f 7b e7 ce cc 9d 7d d5 32 92 c6 da 25 4b 96 65 1b c9 18 6c 6c 36 63 8c b1 c3 da 04 0a 9c a6 81 42 49 7b 42 43 31 a4 81 04 d2 c4 3d 3d 6d e8 09 f4 d4 1c 0a 69 42 08 50 c0 04 b0 63 63 30 3e b6 91 6d 6c 83 65 59 b6 16 6b 9d 19 49 a3 91 46 33 9a 55 9a 3b db ed 0f 4e 48 81 d0 e6 fd 07 9e e7 fd fc f0 7e bf 1f c1 1f 88 23 8a 00 20 08 50 2c 42 be 50 24 97 2b 50 28 a8 48 92 88 d5 ac 27 96 c8 e0 9b 88 31 37 bf d0 61 d2 6b 96 cf c7 33 8d 43 a3 73 25 b9 42 51 d2 6a 84 d8 ba 4b ab fd aa 20 f4 1b 0d ba 53 76 ab 1c f7 7a ac a4 17 b3 2c 66 f2 e8 b4 1a 44 8d Data Ascii: PNGIHDR szzpHYs.#.#x?vIDATXw\y{}2%Kell6cBI{BC1==miBPcc0>mleYkIF3U;NH~# P,BP$+P(H'17ak3Cs%BQjK Svz,fD

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:49 UTC	491	OUT	GET /dbd5a2dd-uy07ptllz8mdw7abaacimks8-p9pcmn-qsct0uoe6aw/logintenantbranding/0/favicon?ts=638477616223106700 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:05:49 UTC	710	IN	HTTP/1.1 200 OK Content-Length: 3141 Content-Type: image/* Content-MD5: pGPAjunYb2JK4Y2XxPiHQA== Last-Modified: Wed, 03 Apr 2024 17:20:22 GMT ETag: 0x8DC54025808B83B x-ms-request-id: d4acdbb1-801e-004f-02a1-6732b6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=79945 Date: Wed, 23 Apr 2025 15:05:49 GMT Connection: close X-Content-Type-Options: nosniff Akamai-GRN: 0.846d3e17.1745420749.99b45ed
2025-04-23 15:05:49 UTC	3141	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 0b f7 49 44 41 54 58 85 8d 97 f9 77 5c f5 79 87 9f 7b e7 ce cc 9d 7d d5 32 92 c6 da 25 4b 96 65 1b c9 18 6c 6c 36 63 8c b1 c3 da 04 0a 9c a6 81 42 49 7b 42 43 31 a4 81 04 d2 c4 3d 3d 6d e8 09 f4 d4 1c 0a 69 42 08 50 c0 04 b0 63 63 30 3e b6 91 6d 6c 83 65 59 b6 16 6b 9d 19 49 a3 91 46 33 9a 55 9a 3b db ed 0f 4e 48 81 d0 e6 fd 07 9e e7 fd fc f0 7e bf 1f c1 1f 88 23 8a 00 20 08 50 2c 42 be 50 24 97 2b 50 28 a8 48 92 88 d5 ac 27 96 c8 e0 9b 88 31 37 bf d0 61 d2 6b 96 cf c7 33 8d 43 a3 73 25 b9 42 51 d2 6a 84 d8 ba 4b ab fd aa 20 f4 1b 0d ba 53 76 ab 1c f7 7a ac a4 17 b3 2c 66 f2 e8 b4 1a 44 8d Data Ascii: PNGIHDR szzpHYs.#.#x?vIDATXw\y{}2%Kell6cBI{BC1==miBPcc0>mleYkIF3U;NH~# P,BP$+P(H'17ak3Cs%BQjK Svz,fD

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:50 UTC	742	OUT	GET /dbd5a2dd-uy07ptllz8mdw7abaacimks8-p9pcmn-qsct0uoe6aw/logintenantbranding/0/illustration?ts=638477616232014667 HTTP/1.1 Host: aadcdn.msauthimages.net Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:05:50 UTC	713	IN	HTTP/1.1 200 OK Content-Length: 298891 Content-Type: image/* Content-MD5: dAyR2yLUoV61tNR3lw4Adg== Last-Modified: Wed, 03 Apr 2024 17:20:23 GMT ETag: 0x8DC540258B82F6C x-ms-request-id: 94d4a787-e01e-0049-4aa1-670109000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: public, max-age=79979 Date: Wed, 23 Apr 2025 15:05:50 GMT Connection: close X-Content-Type-Options: nosniff Akamai-GRN: 0.906d3e17.1745420750.cafba93c
2025-04-23 15:05:50 UTC	16384	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 14 00 14 00 00 ff e2 01 d8 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 01 c8 00 00 00 00 04 30 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 e0 00 01 00 01 00 00 00 00 00 00 61 63 73 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 f6 d6 00 01 00 00 00 00 d3 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 64 65 73 63 00 00 00 f0 00 00 00 24 72 58 59 5a 00 00 01 14 00 00 00 14 67 58 59 5a 00 00 01 28 00 00 00 14 62 58 59 5a 00 00 01 3c 00 00 00 14 77 74 70 74 00 00 01 50 00 00 00 14 72 54 52 43 00 00 01 64 00 00 00 28 67 54 52 43 00 00 01 64 00 00 00 28 62 Data Ascii: JFIFICC_PROFILE0mntrRGB XYZ acsp-desc$rXYZgXYZ(bXYZ<wtptPrTRCd(gTRCd(b
2025-04-23 15:05:50 UTC	16384	IN	Data Raw: 90 8a a0 a1 a2 29 0a e2 9d c5 76 9a 5b 05 0d 11 49 a6 9d c7 a5 76 9c 52 6c 69 0d 69 a1 d3 4f 62 93 4d 2b 1a 43 25 7a d2 15 a7 88 a1 d3 d6 8b 18 c9 4a 4d 3e 94 f1 5c d0 e2 8b 01 ad 14 38 c7 ad 3c 45 06 28 4f d4 91 ad 3b d2 69 a7 74 d7 15 cd 16 3a 19 c5 21 5a 7b 4d 21 5a 56 3a 1b d2 29 34 e3 a1 a7 31 5c 77 c5 26 c0 68 8a 42 29 c2 29 0a ed 4a c6 35 8a 42 b4 ee 9a 42 28 b0 19 c5 21 5a 7b 14 9a 41 34 ac 74 47 65 a0 22 a4 b2 79 53 45 69 a9 12 d3 43 25 68 0a ed 52 0a d0 b2 e2 8b 0d 24 72 31 40 45 48 2b 4d 95 aa b2 58 c9 18 a1 23 7d e9 d6 5d f6 a1 22 81 0d 91 40 45 3c 57 9d 01 18 a0 63 64 50 15 e9 4e 91 9a 12 b4 03 19 22 84 8a 77 06 93 4d 30 88 d1 4c 50 95 34 f9 1b 50 b0 a5 66 8d 0c 11 48 45 38 41 39 a4 ee e9 36 89 a1 92 28 7d 29 e2 94 05 48 a5 62 69 80 45 01 da Data Ascii: )v[IvRliiObM+C%zJM>\8<E(O;it:!Z{M!ZV:)41\w&hB))J5BB(!Z{A4tGe"ySEiC%hR$r1@EH+MX#}]"@E<WcdPN"wM0LP4PfHE8A96(})HbiE
2025-04-23 15:05:50 UTC	5515	IN	Data Raw: 4a 05 3d 42 04 0a 5c 51 85 a5 c5 2d 40 08 19 a5 c5 10 14 58 a5 60 00 14 40 52 e3 7a 20 28 b1 82 07 2a 50 33 45 8a 50 29 a6 2b 04 2d 16 9a 5c 51 63 6a 35 00 21 69 71 45 8a 5c 6d 4e c4 0e 29 71 45 8a 20 b4 b5 0e 80 d3 4b a6 8f 14 a0 53 b0 07 1b 52 81 45 a6 94 0a 56 00 81 44 05 2e 91 d2 88 2d 1a 80 10 0d 2e 28 82 e6 97 4d 16 00 e2 94 0a 2c 66 94 0a 35 00 98 a5 c5 2e 29 71 4b 50 09 8c 51 0a e0 29 69 6a 03 a9 45 20 14 a0 50 d8 0b 9a 20 d9 a1 a5 14 99 49 87 4b 48 3a 57 1a 45 58 b5 d5 d4 43 1d 69 30 bb 13 14 b4 4a 9a 8e c7 6f 5a e2 b8 3b d1 63 06 97 14 b5 d8 cd 02 47 57 52 e0 8a 4a 45 33 ab a9 71 5d 8a 76 49 c2 96 86 8a 80 3a 96 92 94 50 01 66 ba 92 96 90 ce c5 2e 37 ae a2 1c a9 d8 50 98 ae 02 8c 0a 5c 0a 56 3a 00 0a 5c 51 e2 b8 50 14 08 5a 5c 51 62 94 0a 56 56 Data Ascii: J=B\Q-@X`@Rz (*P3EP)+-\Qcj5!iqE\mN)qE KSREVD.-.(M,f5.)qKPQ)ijE P IKH:WEXCi0JoZ;cGWRJE3q]vI:Pf.7P\V:\QPZ\QbVV
2025-04-23 15:05:50 UTC	16384	IN	Data Raw: ff 00 76 b8 e3 f6 47 55 5b bf dc e9 7f 68 e0 f4 2b 2d e6 27 63 9d ea 7c 7e b4 e2 db a2 72 14 e6 90 06 d5 e9 f4 dd 26 6c 4b cc ce 2c dd 46 29 bf 2a 1a 60 3a 8a 6d 97 06 9f 2a 0d 0b 0c 8a ec 8e ae e7 3b 6b b0 ce 2b 88 a2 23 14 98 ab b1 09 8a 51 b5 77 4a ec d1 62 0b 20 d7 66 86 ba 80 b1 4d 25 71 a4 eb 4e c4 2d 26 69 70 31 48 06 4d 2d 42 a1 33 4b 82 68 c2 e0 6f 5d 51 2c 94 5a 85 88 14 9e b4 12 3a a5 11 34 c4 89 a8 d7 1e 7e a6 69 54 4e 9c 58 23 fe 42 2d c2 31 c6 68 e4 60 06 49 15 14 c1 e2 c8 38 a7 08 18 c3 1c d7 24 7a cc a9 34 ce 89 74 d8 ef 60 5a f2 35 db 15 c6 78 d9 73 9a 8d 32 28 e4 37 a1 28 48 d8 57 37 df f3 26 cd fe e9 89 a4 38 fc 40 44 30 05 44 97 8d 00 3d 69 24 80 b1 a8 52 d9 16 e6 31 5c f3 eb 32 c9 db 66 f0 e9 b1 a5 54 49 5e 39 ab 6e ef df 45 fa e4 1d Data Ascii: vGU[h+-'c\|~r&lK,F)`:m;k+#QwJb fM%qN-&ip1HM-B3Kho]Q,Z:4~iTNX#B-1h`I8$z4t`Z5xs2(7(HW7&8@D0D=i$R1\2fTI^9nE
2025-04-23 15:05:50 UTC	16384	IN	Data Raw: e5 d5 39 24 9c 56 df 5f b9 e9 fc 52 1e cd bc d0 ab dc 89 9d db 0c f6 a4 0c 03 eb ca a6 f1 0e cf 70 58 b8 3c a9 c2 dc 4f 36 c4 b3 1c b0 f3 e9 5e 5f 6f c5 0a c2 ca 8b a5 f9 0f 33 56 9d 9b e3 33 c5 7f 0a ac 8c 19 db 4b 93 f8 86 7e b5 ca fa 29 ed 53 75 1d f9 e4 bf be 41 4b 53 8a 65 3d c4 1a 2e 99 43 1d 60 f2 03 6a 22 08 6e 5a b3 f0 cd 69 7b 43 c3 d1 2e 4c f0 90 dd e7 df c7 35 f2 cf b6 b1 b7 f7 13 29 29 18 55 c1 e8 6b d6 c6 f5 24 ce 1c f0 d1 26 3c e4 b0 01 b6 5c f2 a8 b2 dc 22 ec 9c b9 60 54 4d 12 90 4b 49 93 e6 29 96 ca b1 cb 16 23 95 6a bd c7 3b 92 16 e6 71 8c 00 77 aa f7 19 19 2c 70 4e 69 f6 21 c0 27 95 34 f1 aa e7 0c 4e 7c ea 99 9f 23 0c 11 79 03 9a 1f bc 37 d8 73 a7 b0 79 8a e1 be d8 38 f4 15 20 a2 20 66 07 4e f8 c0 da 9c 11 16 4f 0f 33 e6 29 f8 21 2c a4 Data Ascii: 9$V_RpX<O6^_o3V3K~)SuAKSe=.C`j"nZi{C.L5))Uk$&<\"`TMKI)#j;qw,pNi!'4N\|#y7sy8 fNO3)!,
2025-04-23 15:05:50 UTC	7952	IN	Data Raw: 70 23 31 a3 32 06 3c c1 9b 3b fc 73 4e 5c 59 4e 58 14 78 9f cc 16 70 01 f3 03 04 54 69 b8 4c a1 19 e6 bf 3a 48 fb bd da b7 fd 95 a2 dd ee 44 93 ec 77 77 32 b0 53 3a e9 3d 33 be 3d b9 ae 65 66 6d e6 57 8f 9e 92 c3 73 d3 91 a8 dd db cc 8d 1a 03 a0 72 6e ed f3 ff 00 e6 ff 00 8d 36 9c 3a e1 9d f4 4f 34 48 39 01 03 e4 9f 3c 95 ad 12 33 64 a9 ad 4c a4 46 a2 32 3f 11 76 c5 24 76 b2 34 60 99 54 28 e6 15 81 1f 3a 65 2c ee 08 60 6e ee b0 0e cc ea 47 ff 00 a3 a3 92 19 91 b1 a8 b1 03 62 37 c9 f6 68 aa 10 eb a4 71 02 e6 65 4d b7 60 ca bf 4a 8a f7 90 c4 85 9a f5 64 00 ee 43 06 23 d3 6c ed ee a7 a0 8a e3 1e 26 66 27 70 a0 82 01 fe c5 3e 2c a5 64 c4 92 32 b7 f4 48 db e0 82 92 92 13 4c 81 2f 16 b4 8c 81 25 c9 19 18 2b 86 db d4 8e 9e dc 52 99 d5 80 2b 78 00 27 61 a4 6f 53 Data Ascii: p#12<;sN\YNXxpTiL:HDww2S:=3=efmWsrn6:O4H9<3dLF2?v$v4`T(:e,`nGb7hqeM`JdC#l&f'p>,d2HL/%+R+x'aoS
2025-04-23 15:05:50 UTC	16384	IN	Data Raw: 83 6d 24 e7 eb 81 f3 a6 5a 24 44 57 64 91 58 8c ec ab 26 3e 0c 6a 75 6d b8 f4 24 52 3f 0f bc 24 e3 8f 71 61 91 91 ab 47 cb 27 23 dd 55 f7 3c 12 fe e2 32 3f d2 0e 3b b9 ce 51 86 07 c1 ab 51 24 a8 c0 0f b4 c8 99 e4 0c 04 03 f1 da ab ee a7 11 b0 d5 79 a4 81 b1 31 64 1f 83 0a a8 b7 d9 89 c5 19 c9 38 2c d6 e8 80 76 93 8e 96 53 80 7e d0 c3 1e ec e2 ba 5e cd 3d f4 7b f6 8f 8b 89 01 c9 2f 2e 75 7b 79 d5 e1 9a ea 52 56 26 12 90 35 69 5b 52 0f bf 39 a8 33 b5 d4 4d aa 48 64 46 eb b8 41 ed e9 5a 25 27 dc 86 a3 7c 10 a5 ec 9c 01 15 ae 2f 2e 27 c7 ef 3b 7d 45 2c b6 9c 25 95 23 9e de 49 19 76 5d 72 16 38 f6 b0 06 aa a5 ed a7 ed 9e 08 f8 82 6a 4d c8 d2 bf 9b 0c 9f 65 3c dd b8 8c c6 90 ca 2e 55 9b 60 eb 02 ed ed 25 8d 3f 0e 7d f7 16 bc 63 17 dc 1b 81 dd be 86 e1 53 12 36 Data Ascii: m$Z$DWdX&>jum$R?$qaG'#U<2?;QQ$y1d8,vS~^={/.u{yRV&5i[R93MHdFAZ%'\|/.';}E,%#Iv]r8jMe<.U`%?}cS6
2025-04-23 15:05:50 UTC	2917	IN	Data Raw: a3 5d f1 0b 14 4c a5 c5 ba 93 cc 99 30 a7 dd 9c 55 28 c8 9d df 00 3c dc 49 24 cf d8 65 5c 8c e1 99 06 3d bb 51 99 2f 25 03 52 cd 13 79 a3 21 1f 31 4d 45 c6 62 01 94 5d 40 31 b9 d1 16 40 f8 0a 19 3b 41 6d 03 05 ef 12 47 71 ab 48 07 53 0f 7e 29 f0 25 19 32 56 8b cd 19 13 4e cc bc 89 d1 fc 3f 2a 69 be d8 f1 1f da b6 79 12 a1 73 f4 aa 8e 23 da f5 82 1d 2a 96 f6 e4 9c 29 b9 b8 54 df fa bc eb 2f 77 fa 45 16 92 3c 3f 6f 81 49 3b 95 b7 77 fa 9a d6 18 e5 2e 02 70 71 56 cd bc 69 71 29 d1 24 ce db ec 0c 4a c3 fb d4 fa 70 6d 0a c7 01 b3 fd 75 03 e0 6b cf e1 fd 2b f0 c8 a1 65 96 f4 4b 20 eb dc ba 83 f3 3f 4a cf f1 3f d2 e5 b4 92 a8 82 20 80 8c f7 8b 8f a6 37 f8 d6 91 e9 b2 bd a8 c9 ca 2b 77 23 d6 e4 e1 90 ca 7f 6d 0a e7 97 85 9b 7f 6e 4d 0c 1c 2e ca d1 b3 1d b8 1f d5 Data Ascii: ]L0U(<I$e\=Q/%Ry!1MEb]@1@;AmGqHS~)%2VN?iys#)T/wE<?oI;w.pqViq)$Jpmuk+eK ?J? 7+w#mnM.
2025-04-23 15:05:50 UTC	16384	IN	Data Raw: 96 c4 79 38 e1 8e 55 d7 67 62 8c 0f 56 60 de ef bb 56 f6 fc 6e f4 6a 6b 79 14 21 c6 34 9c 80 31 d7 1f e3 55 92 5b f1 b9 1c bc ae 34 8e 6c 62 0a 31 e8 41 c5 4e 8e fa 5b 45 60 f7 ea e0 0f b9 85 53 f2 39 a1 24 09 92 bf 59 dd dc a8 56 68 f5 a0 ce 9c 36 fe bc aa be 79 6e dd d4 3d 8c 67 c3 b3 02 13 03 cf 2c 33 52 5b 8c cf 2a 88 a2 56 d4 3e e9 11 ab fe 67 e9 4e 43 2f 14 89 bf 69 39 88 67 ee 8d 0b ab e2 a6 87 b1 4b 71 a8 ee ef 38 7c 5a 23 8d e4 c6 e3 bc 97 58 ff 00 a4 54 88 4f 12 e2 03 bc 32 ac 05 77 38 52 b8 f6 16 23 e9 4f df 5d dd 77 49 dd f7 0f 10 e6 a2 52 d9 3e ba 7f 85 56 43 7f 14 f2 30 72 b6 d2 47 8c 01 03 48 ad ec d4 09 a4 a3 b5 83 6a cb 78 6c ae 25 0b df dd 28 2b cf f6 87 27 1c be e9 02 a4 cf 17 74 80 34 89 93 b8 7c 31 cf bc 1d fe 35 4a d7 f6 cf 72 91 8e Data Ascii: y8UgbV`Vnjky!41U[4lb1AN[E`S9$YVh6yn=g,3R[*V>gNC/i9gKq8\|Z#XTO2w8R#O]wIR>VC0rGHjxl%(+'t4\|15Jr
2025-04-23 15:05:50 UTC	16384	IN	Data Raw: f1 2b b1 e5 a7 39 fa d3 32 70 5b 74 c8 4b 6b a4 c9 e6 ba 70 69 51 6d ee 33 37 15 e0 80 00 38 7c 64 f2 c3 10 3e 5b d2 c5 c5 78 52 00 7e c0 8a 01 fc 38 38 f5 dc 53 d1 70 e4 57 ff 00 d2 5c bf 90 79 57 7a 59 b8 75 cb 38 36 f6 27 4f 5e f6 4f e0 d4 a9 22 49 4d c7 ad 42 28 b4 82 1c 7e f3 30 fc 85 33 37 1d 90 67 37 06 31 8c 86 8d 0e de fc 7e 55 22 3e 19 24 8a ba e2 b1 4c 73 e6 c4 7b f1 53 57 87 46 63 c2 c9 0a 37 46 ee 80 fa 8a 5b 22 cc dc 5d a3 9d 2e 44 6b 2d f4 ba b9 e4 7d 39 1a 9b 71 c6 ee a4 c2 98 af d4 1d c6 e0 e7 e2 4d 58 b3 25 98 28 25 86 56 f3 09 a4 0f 78 1b d3 09 73 6a 64 3d fd c0 00 9c e9 6e f4 0c fb a9 fb c2 fb 01 6d 73 7c d8 95 6d 6f b7 d8 b3 1e 7f 4a 93 37 12 e3 2c 31 f6 5d 23 a3 3e 01 3f 1a b2 8a 3b 72 84 a9 8c e7 91 49 1b 3f 36 fa d3 52 4c d6 ad 98 Data Ascii: +92p[tKkpiQm378\|d>[xR~88SpW\yWzYu86'O^O"IMB(~037g71~U">$Ls{SWFc7F["].Dk-}9qMX%(%Vxsjd=nms\|moJ7,1]#>?;rI?6RL

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:50 UTC	768	OUT	GET /83bece33-c444-450f-bc7d-e2db906db4bb/winauth/ssoprobe?client-request-id=bc5597a1-b053-8000-ae3e-1a732b3d6f5d&_=1745420749193 HTTP/1.1 Host: autologon.microsoftazuread-sso.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:05:51 UTC	1733	IN	HTTP/1.1 401 Unauthorized Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: image/png; charset=utf-8 Expires: -1 Vary: Origin X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://login.microsoftonline.com Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, OPTIONS P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: dc497041-2547-4f79-949b-fd1c1b317500 x-ms-ests-server: 2.1.20540.5 - WUS3 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+est"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-a9xqsOw8o-dS2YKYPei4yg' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 WWW-Authenticate: Negotiate Set-Cookie: fpc=AhsOvyJ6qWFDoleX1wU32vQ; expires=Fri, 23-May-2025 15:05:51 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 23 Apr 2025 15:05:50 GMT Connection: close Content-Length: 12
2025-04-23 15:05:51 UTC	12	IN	Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 Data Ascii: Unauthorized

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:51 UTC	2866	OUT	POST /common/instrumentation/dssostatus HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive Content-Length: 67 sec-ch-ua-platform: "Windows" hpgid: 1104 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" hpgact: 1800 canary: PAQABDgEAAABVrSpeuWamRam2jAF1XRQE_ExkzHaU4KRyBuu2iJNCcuQAM5W14NY88SyCJOgJelyJJmJqObFfQgDsVjcVKjo0ocuS64hEiaMBFYWXUJMnR4v5cN2WvgcuBUhA8C5rb0jAelwpAlMeUuZ4crxM4AiIKt_mTwH3kktzGSHZs1rXko15JwZFWY7sNWATii6DjOx9ZROSi18v8XlgC_N41NkokbPLP2MRUQTVI20PltWnoyAA sec-ch-ua-mobile: ?0 client-request-id: bc5597a1-b053-8000-ae3e-1a732b3d6f5d User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json hpgrequestid: 4bf5714a-86ea-4910-9e72-a05070ef6e00 Content-type: application/json; charset=UTF-8 Origin: https://login.microsoftonline.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d&sso_reload=true Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-FXV4sYLFtI=AQABCQEAAABVrSpeuWamRam2jAF1XRQExuOyBdSO3BZdUl3-qQBUY0gA84xA_yrP87XH6lgt0aPc0Gv7AwWZ7xCy41cbo3h1pxbU9mQYLrqAyuvkUB0EC0Q4hh64537Fti7zqKEHamb4i_2jRmrkU9kKIy0wfXybJKNJmv4DClugCy7fzSE7uiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AUUAM86-g0TED0W8feLbkG20uwMAAAAAAPEPzgAAAAAAAABFAABFAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEvFmW9LkO-CuueIHcx3n9NLH8YK9HczFS2kEKHUeDqi9cwvjJVOxuXTHgooQwEXjYPJuMXalvXd5nYyu3Ln0o_5PbJQVHOIwUjS06M1YsRBogAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEU6xihjuwEEDCEUitnDWQxdK-BQL47zqqe_-Xk0a4miA9mjWb-dlm6JXscc9tQsU1WaSaTncnDLlRutBD1f1hwheix8IDmZHczG3-kN1CgkUXVVfdWpEeTeFuqRe7ioiaQhj1M25GLqUSe2J8BAIW9Fa0-o9nAo8Wkdbi4HizMs4gAA; esctx-pRB8z4dIEDo=AQABCQEAAABVrSpeuWamRam2jAF1XRQEwjBWZW8QVbRoTrWyqUyGVD7exB2b4R_ippuqoD6HO7DiseG0VmsrSL6JO7cEb-hCxLErr1x4u8Jdwn8yRXadLXSHR8Sld1AoZ6_elFdEBLHa3mL0gJgo0lwMBm8qyO7T4gBA38xSP8H5GWyYYj5KsiAA; fpc=AuIFpnMgGx9Nnk-AJEH4ucF79WTGAQAAAMj4mt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=3c31e [TRUNCATED]
2025-04-23 15:05:51 UTC	67	OUT	Data Raw: 7b 22 72 65 73 75 6c 74 43 6f 64 65 22 3a 32 2c 22 73 73 6f 44 65 6c 61 79 22 3a 30 2c 22 6c 6f 67 22 3a 22 50 72 6f 62 65 20 69 6d 61 67 65 20 65 72 72 6f 72 20 65 76 65 6e 74 20 66 69 72 65 64 22 7d Data Ascii: {"resultCode":2,"ssoDelay":0,"log":"Probe image error event fired"}
2025-04-23 15:05:52 UTC	1778	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://autologon.microsoftazuread-sso.com/ Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, OPTIONS P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" client-request-id: bc5597a1-b053-8000-ae3e-1a732b3d6f5d x-ms-request-id: 162b6fbc-4240-443f-a2ad-8efea7980f00 x-ms-ests-server: 2.1.20540.5 - WUS3 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-cU9gvvN4UQK2ewKf4e8lIQ' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: fpc=AuIFpnMgGx9Nnk-AJEH4ucF79WTGAQAAAMj4mt8OAAAA; expires=Fri, 23-May-2025 15:05:52 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 23 Apr 2025 15:05:51 GMT Connection: close Content-Length: 265
2025-04-23 15:05:52 UTC	265	IN	Data Raw: 7b 22 61 70 69 43 61 6e 61 72 79 22 3a 22 50 41 51 41 42 44 67 45 41 41 41 42 56 72 53 70 65 75 57 61 6d 52 61 6d 32 6a 41 46 31 58 52 51 45 30 44 5f 46 44 77 67 58 4c 68 74 43 32 32 2d 4c 77 52 57 5a 71 6d 59 76 47 61 47 39 38 6a 63 51 6b 64 52 76 67 52 68 70 35 6d 62 30 72 6e 69 49 6f 77 66 6d 6c 37 72 4d 34 77 62 4f 71 52 42 37 6c 4e 56 7a 55 77 4e 7a 62 55 52 52 6b 6d 6d 48 7a 4c 37 4e 2d 41 46 32 67 68 47 68 51 75 56 72 79 4c 47 76 43 79 69 6d 6d 30 33 58 53 70 44 68 56 79 6b 49 6a 64 6b 34 39 39 57 47 65 76 7a 2d 78 79 4d 4e 5a 74 66 4b 5a 54 47 31 36 51 76 63 61 46 31 6c 38 58 35 53 56 43 37 68 47 4e 5f 41 75 54 63 65 4f 66 51 44 33 56 37 74 6b 64 72 77 54 51 39 59 64 78 67 53 78 64 5f 68 78 56 57 68 6d 52 67 75 33 71 66 4a 52 49 6d 62 47 34 51 58 Data Ascii: {"apiCanary":"PAQABDgEAAABVrSpeuWamRam2jAF1XRQE0D_FDwgXLhtC22-LwRWZqmYvGaG98jcQkdRvgRhp5mb0rniIowfml7rM4wbOqRB7lNVzUwNzbURRkmmHzL7N-AF2ghGhQuVryLGvCyimm03XSpDhVykIjdk499WGevz-xyMNZtfKZTG16QvcaF1l8X5SVC7hGN_AuTceOfQD3V7tkdrwTQ9YdxgSxd_hxVWhmRgu3qfJRImbG4QX

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:05:53 UTC	1551	OUT	GET /common/instrumentation/dssostatus HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-FXV4sYLFtI=AQABCQEAAABVrSpeuWamRam2jAF1XRQExuOyBdSO3BZdUl3-qQBUY0gA84xA_yrP87XH6lgt0aPc0Gv7AwWZ7xCy41cbo3h1pxbU9mQYLrqAyuvkUB0EC0Q4hh64537Fti7zqKEHamb4i_2jRmrkU9kKIy0wfXybJKNJmv4DClugCy7fzSE7uiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AUUAM86-g0TED0W8feLbkG20uwMAAAAAAPEPzgAAAAAAAABFAABFAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEvFmW9LkO-CuueIHcx3n9NLH8YK9HczFS2kEKHUeDqi9cwvjJVOxuXTHgooQwEXjYPJuMXalvXd5nYyu3Ln0o_5PbJQVHOIwUjS06M1YsRBogAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEU6xihjuwEEDCEUitnDWQxdK-BQL47zqqe_-Xk0a4miA9mjWb-dlm6JXscc9tQsU1WaSaTncnDLlRutBD1f1hwheix8IDmZHczG3-kN1CgkUXVVfdWpEeTeFuqRe7ioiaQhj1M25GLqUSe2J8BAIW9Fa0-o9nAo8Wkdbi4HizMs4gAA; esctx-pRB8z4dIEDo=AQABCQEAAABVrSpeuWamRam2jAF1XRQEwjBWZW8QVbRoTrWyqUyGVD7exB2b4R_ippuqoD6HO7DiseG0VmsrSL6JO7cEb-hCxLErr1x4u8Jdwn8yRXadLXSHR8Sld1AoZ6_elFdEBLHa3mL0gJgo0lwMBm8qyO7T4gBA38xSP8H5GWyYYj5KsiAA; fpc=AuIFpnMgGx9Nnk-AJEH4ucF79WTGAQAAAMj4mt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=3c31e [TRUNCATED]
2025-04-23 15:05:53 UTC	1739	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Access-Control-Allow-Origin: https://autologon.microsoftazuread-sso.com/ Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: POST, OPTIONS P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 9ca251ad-3d92-49e3-b0ab-35362a408100 x-ms-ests-server: 2.1.20540.5 - EUS ProdSlices x-ms-httpver: 1.1 report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dms"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-l95cx2536kdqICk9V0mRsA' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: fpc=AuIFpnMgGx9Nnk-AJEH4ucF79WTGAQAAAMj4mt8OAAAA; expires=Fri, 23-May-2025 15:05:53 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 23 Apr 2025 15:05:53 GMT Connection: close Content-Length: 164
2025-04-23 15:05:53 UTC	164	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 36 31 30 30 2c 22 73 74 73 45 72 72 6f 72 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 36 36 31 31 35 65 39 66 2d 31 63 64 66 2d 34 30 62 61 2d 39 35 31 33 2d 37 31 30 64 37 66 64 36 34 65 35 33 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 35 2d 30 34 2d 32 33 20 31 35 3a 30 35 3a 35 33 5a 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 7d 7d Data Ascii: {"error":{"code":6100,"stsError":"AADSTS900561","correlationId":"66115e9f-1cdf-40ba-9513-710d7fd64e53","timestamp":"2025-04-23 15:05:53Z","message":"AADSTS900561"}}

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:06:02 UTC	3018	OUT	POST /common/GetCredentialType?mkt=en-US HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive Content-Length: 1754 sec-ch-ua-platform: "Windows" hpgid: 1104 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" hpgact: 1800 canary: PAQABDgEAAABVrSpeuWamRam2jAF1XRQE_ExkzHaU4KRyBuu2iJNCcuQAM5W14NY88SyCJOgJelyJJmJqObFfQgDsVjcVKjo0ocuS64hEiaMBFYWXUJMnR4v5cN2WvgcuBUhA8C5rb0jAelwpAlMeUuZ4crxM4AiIKt_mTwH3kktzGSHZs1rXko15JwZFWY7sNWATii6DjOx9ZROSi18v8XlgC_N41NkokbPLP2MRUQTVI20PltWnoyAA sec-ch-ua-mobile: ?0 client-request-id: bc5597a1-b053-8000-ae3e-1a732b3d6f5d User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json hpgrequestid: 4bf5714a-86ea-4910-9e72-a05070ef6e00 Content-type: application/json; charset=UTF-8 Origin: https://login.microsoftonline.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://login.microsoftonline.com/83bece33-c444-450f-bc7d-e2db906db4bb/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=4D0A58E010049C5CEC6E7AE0ACEFB6A5009B22E318B5C6E6%2DFF696DE58C6764E2936E0FA2EEFADA13A0CFC230DE9E59FBF12FA3B1CFA8A6FF&redirect%5Furi=https%3A%2F%2Fcityofsolanabeach%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bc5597a1%2Db053%2D8000%2Dae3e%2D1a732b3d6f5d&sso_reload=true Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-FXV4sYLFtI=AQABCQEAAABVrSpeuWamRam2jAF1XRQExuOyBdSO3BZdUl3-qQBUY0gA84xA_yrP87XH6lgt0aPc0Gv7AwWZ7xCy41cbo3h1pxbU9mQYLrqAyuvkUB0EC0Q4hh64537Fti7zqKEHamb4i_2jRmrkU9kKIy0wfXybJKNJmv4DClugCy7fzSE7uiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AUUAM86-g0TED0W8feLbkG20uwMAAAAAAPEPzgAAAAAAAABFAABFAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEvFmW9LkO-CuueIHcx3n9NLH8YK9HczFS2kEKHUeDqi9cwvjJVOxuXTHgooQwEXjYPJuMXalvXd5nYyu3Ln0o_5PbJQVHOIwUjS06M1YsRBogAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEU6xihjuwEEDCEUitnDWQxdK-BQL47zqqe_-Xk0a4miA9mjWb-dlm6JXscc9tQsU1WaSaTncnDLlRutBD1f1hwheix8IDmZHczG3-kN1CgkUXVVfdWpEeTeFuqRe7ioiaQhj1M25GLqUSe2J8BAIW9Fa0-o9nAo8Wkdbi4HizMs4gAA; esctx-pRB8z4dIEDo=AQABCQEAAABVrSpeuWamRam2jAF1XRQEwjBWZW8QVbRoTrWyqUyGVD7exB2b4R_ippuqoD6HO7DiseG0VmsrSL6JO7cEb-hCxLErr1x4u8Jdwn8yRXadLXSHR8Sld1AoZ6_elFdEBLHa3mL0gJgo0lwMBm8qyO7T4gBA38xSP8H5GWyYYj5KsiAA; fpc=AuIFpnMgGx9Nnk-AJEH4ucF79WTGAQAAAMj4mt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=3c31e [TRUNCATED]
2025-04-23 15:06:02 UTC	1754	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 22 30 37 6e 73 6b 7a 40 71 73 6a 63 6b 2e 63 6f 22 2c 22 69 73 4f 74 68 65 72 49 64 70 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 63 68 65 63 6b 50 68 6f 6e 65 73 22 3a 66 61 6c 73 65 2c 22 69 73 52 65 6d 6f 74 65 4e 47 43 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 69 73 43 6f 6f 6b 69 65 42 61 6e 6e 65 72 53 68 6f 77 6e 22 3a 66 61 6c 73 65 2c 22 69 73 46 69 64 6f 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 6f 72 69 67 69 6e 61 6c 52 65 71 75 65 73 74 22 3a 22 72 51 51 49 41 52 41 41 70 56 45 5f 61 4e 52 67 48 45 32 61 61 2d 79 64 72 54 30 37 69 5a 4f 45 54 71 32 35 2d 5f 4c 5f 79 30 47 56 58 4f 34 4c 32 69 68 58 37 52 39 74 70 52 7a 4a 6c 79 39 65 37 4f 56 50 4c 37 6e 61 61 79 6d 49 6f 44 68 32 Data Ascii: {"username":"07nskz@qsjck.co","isOtherIdpSupported":true,"checkPhones":false,"isRemoteNGCSupported":true,"isCookieBannerShown":false,"isFidoSupported":true,"originalRequest":"rQQIARAApVE_aNRgHE2aa-ydrT07iZOETq25-_L_y0GVXO4L2ihX7R9tpRzJly9e7OVPL7naaymIoDh2
2025-04-23 15:06:02 UTC	1619	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" client-request-id: bc5597a1-b053-8000-ae3e-1a732b3d6f5d x-ms-request-id: b96ac114-a31e-43dc-8f98-2d1701226a00 x-ms-ests-server: 2.1.20540.5 - EUS ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-2cqPqKCopaw12OhaHnJ3vg' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: fpc=AuIFpnMgGx9Nnk-AJEH4ucF79WTGAQAAAMj4mt8OAAAA; expires=Fri, 23-May-2025 15:06:02 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 23 Apr 2025 15:06:02 GMT Connection: close Content-Length: 1265
2025-04-23 15:06:02 UTC	1265	IN	Data Raw: 7b 22 55 73 65 72 6e 61 6d 65 22 3a 22 30 37 6e 73 6b 7a 40 71 73 6a 63 6b 2e 63 6f 22 2c 22 44 69 73 70 6c 61 79 22 3a 22 30 37 6e 73 6b 7a 40 71 73 6a 63 6b 2e 63 6f 22 2c 22 49 66 45 78 69 73 74 73 52 65 73 75 6c 74 22 3a 31 2c 22 49 73 55 6e 6d 61 6e 61 67 65 64 22 3a 66 61 6c 73 65 2c 22 54 68 72 6f 74 74 6c 65 53 74 61 74 75 73 22 3a 31 2c 22 43 72 65 64 65 6e 74 69 61 6c 73 22 3a 7b 22 50 72 65 66 43 72 65 64 65 6e 74 69 61 6c 22 3a 31 2c 22 48 61 73 50 61 73 73 77 6f 72 64 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 65 4e 67 63 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 46 69 64 6f 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 51 72 43 6f 64 65 50 69 6e 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 53 61 73 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 43 65 72 74 Data Ascii: {"Username":"07nskz@qsjck.co","Display":"07nskz@qsjck.co","IfExistsResult":1,"IsUnmanaged":false,"ThrottleStatus":1,"Credentials":{"PrefCredential":1,"HasPassword":true,"RemoteNgcParams":null,"FidoParams":null,"QrCodePinParams":null,"SasParams":null,"Cert

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:06:03 UTC	1638	OUT	GET /common/GetCredentialType?mkt=en-US HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: esctx-FXV4sYLFtI=AQABCQEAAABVrSpeuWamRam2jAF1XRQExuOyBdSO3BZdUl3-qQBUY0gA84xA_yrP87XH6lgt0aPc0Gv7AwWZ7xCy41cbo3h1pxbU9mQYLrqAyuvkUB0EC0Q4hh64537Fti7zqKEHamb4i_2jRmrkU9kKIy0wfXybJKNJmv4DClugCy7fzSE7uiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AUUAM86-g0TED0W8feLbkG20uwMAAAAAAPEPzgAAAAAAAABFAABFAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEvFmW9LkO-CuueIHcx3n9NLH8YK9HczFS2kEKHUeDqi9cwvjJVOxuXTHgooQwEXjYPJuMXalvXd5nYyu3Ln0o_5PbJQVHOIwUjS06M1YsRBogAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEU6xihjuwEEDCEUitnDWQxdK-BQL47zqqe_-Xk0a4miA9mjWb-dlm6JXscc9tQsU1WaSaTncnDLlRutBD1f1hwheix8IDmZHczG3-kN1CgkUXVVfdWpEeTeFuqRe7ioiaQhj1M25GLqUSe2J8BAIW9Fa0-o9nAo8Wkdbi4HizMs4gAA; esctx-pRB8z4dIEDo=AQABCQEAAABVrSpeuWamRam2jAF1XRQEwjBWZW8QVbRoTrWyqUyGVD7exB2b4R_ippuqoD6HO7DiseG0VmsrSL6JO7cEb-hCxLErr1x4u8Jdwn8yRXadLXSHR8Sld1AoZ6_elFdEBLHa3mL0gJgo0lwMBm8qyO7T4gBA38xSP8H5GWyYYj5KsiAA; fpc=AuIFpnMgGx9Nnk-AJEH4ucF79WTGAQAAAMj4mt8OAAAA; MicrosoftApplicationsTelemetryDeviceId=3c31e [TRUNCATED]
2025-04-23 15:06:03 UTC	1581	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: f2b825f7-9451-49b8-9af5-f36bcd128700 x-ms-ests-server: 2.1.20540.5 - NCUS ProdSlices x-ms-httpver: 1.1 report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dms"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-g2efgjr_QVFKEbio26Px_w' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: fpc=AuIFpnMgGx9Nnk-AJEH4ucF79WTGAQAAAMj4mt8OAAAA; expires=Fri, 23-May-2025 15:06:03 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Wed, 23 Apr 2025 15:06:02 GMT Connection: close Content-Length: 164
2025-04-23 15:06:03 UTC	164	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 36 31 30 30 2c 22 73 74 73 45 72 72 6f 72 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 30 38 30 38 62 64 33 62 2d 36 61 31 32 2d 34 35 38 30 2d 38 65 66 35 2d 33 31 35 37 64 35 64 30 37 61 39 34 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 35 2d 30 34 2d 32 33 20 31 35 3a 30 36 3a 30 33 5a 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 7d 7d Data Ascii: {"error":{"code":6100,"stsError":"AADSTS900561","correlationId":"0808bd3b-6a12-4580-8ef5-3157d5d07a94","timestamp":"2025-04-23 15:06:03Z","message":"AADSTS900561"}}

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:06:45 UTC	450	OUT	OPTIONS /api/report?catId=GW+estsfd+est HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Origin: https://autologon.microsoftazuread-sso.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:06:45 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Wed, 23 Apr 2025 15:06:45 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-04-23 15:06:45 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Timestamp	Bytes transferred	Direction	Data
2025-04-23 15:06:46 UTC	425	OUT	POST /api/report?catId=GW+estsfd+est HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Content-Length: 566 Content-Type: application/reports+json Origin: https://autologon.microsoftazuread-sso.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-23 15:06:46 UTC	566	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 33 36 34 34 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 35 35 35 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 32 30 2e 31 39 30 2e 31 35 31 2e 37 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d Data Ascii: [{"age":53644,"body":{"elapsed_time":1555,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://login.microsoftonline.com/","sampling_fraction":1.0,"server_ip":"20.190.151.7","status_code":401,"type":"http.error"},"type":"network-
2025-04-23 15:06:46 UTC	399	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 x-ms-middleware-request-id: 00000000-0000-0000-0000-000000000000 Request-Context: appId=cid-v1:43ccb73c-0dfb-456b-9d4c-ddf7f5584002 Date: Wed, 23 Apr 2025 15:06:46 GMT Connection: close Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://cityofsolanabeach-my.sharepoint.com/:b:/r/personal/lyim_cosb_org/Documents/Microsoft Teams Chat Files/04212025141353-0001.pdf?csf=1&web=1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
https://cityofsolanabeach-my.sharepoint.com/:b:/r/personal/lyim_cosb_org/Documents/Microsoft Teams Chat Files/04212025141353-0001.pdf?csf=1&web=1

Target ID:	2
Start time:	11:05:27
Start date:	23/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	11:05:32
Start date:	23/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2156,i,11171481201563504429,16075537620969772834,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	13
Start time:	11:05:38
Start date:	23/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://cityofsolanabeach-my.sharepoint.com/:b:/r/personal/lyim_cosb_org/Documents/Microsoft%20Teams%20Chat%20Files/04212025141353-0001.pdf?csf=1&web=1"
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre