Play interactive tourEdit tour

Windows Analysis Report
https://keenetownhall-my.sharepoint.com/:b:/g/personal/amanda_keenetownhall_org/EcczDXj2MNxGvMjrD3G-fs8BPFPEwegwwlCuPeGrToxzeg?e=l7POTP

Overview

General Information

Sample URL:	https://keenetownhall-my.sharepoint.com/:b:/g/personal/amanda_keenetownhall_org/EcczDXj2MNxGvMjrD3G-fs8BPFPEwegwwlCuPeGrToxzeg?e=l7POTP
Analysis ID:	1427640
Infos:

Detection

HTMLPhisher

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found potential malicious PDF (bad image similarity)

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Phishing site or detected (based on various text indicators)

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Invalid 'forgot password' link found

Phishing site detected (based on OCR NLP Model)

Classification

×

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://keenetownhall-my.sharepoint.com/:b:/g/personal/amanda_keenetownhall_org/EcczDXj2MNxGvMjrD3G-fs8BPFPEwegwwlCuPeGrToxzeg?e=l7POTP

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Phishing site detected (based on favicon image match)

Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html	Matcher: Template: microsoft matched with high similarity
Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html#	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish10

Source: Yara match	File source: 1.6.pages.csv, type: HTML
Source: Yara match	File source: 2.8.pages.csv, type: HTML
Source: Yara match	File source: 1.9.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html	Matcher: Template: microsoft matched
Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html	Matcher: Template: microsoft matched

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 0.4

OCR Text: View and Print Online.pdf Info 1/1 OneDrive for Business Nick Petrow shared a folder with Here' s the folder Nick Petrow shared with you. sent to ym to gott sensitive Date created: 04/15/2024 09:30 AM Ref : Review gwed Dxu-rents from Nizk Petrovv "Click View and Print Online" a. for Windows

HTML body contains low number of good links

Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML body with high number of embedded images detected

Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html

HTTP Parser: Total embedded image size: 31111

HTML page contains hidden URLs or javascript code

Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html

HTTP Parser: Base64 decoded: https://slnotexs.com/100/6cbbc89.php

HTML title does not match URL

Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html

HTTP Parser: Title: Sign in to Best Productivity Provider! does not match URL

Invalid 'forgot password' link found

Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html

HTTP Parser: Invalid link: Forgot my password

Phishing site detected (based on OCR NLP Model)

Source: Chrome DOM: 0.4

ML Model on OCR Text: Matched 99.6% probability on "View and Print Online.pdf Info 1/1 OneDrive for Business Nick Petrow shared a folder with Here' s the folder Nick Petrow shared with you. sent to ym to gott sensitive Date created: 04/15/2024 09:30 AM Ref : Review gwed Dxu-rents from Nizk Petrovv "Click View and Print Online" a. for Windows "

HTML body contains password input

Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html

HTTP Parser: <input type="password" .../> found

HTML page is missing a favicon

Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html

HTTP Parser: No favicon

META author tag missing

Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html	HTTP Parser: No <meta name="author".. found
Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html	HTTP Parser: No <meta name="copyright".. found
Source: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html	HTTP Parser: No <meta name="copyright".. found

Compliance

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 184.31.54.93:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.54.93:443 -> 192.168.2.4:49763 version: TLS 1.2

Networking

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.54.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.58
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.245.89
Source: unknown	TCP traffic detected without corresponding DNS query: 96.7.245.89
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.205.58
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /:b:/g/personal/amanda_keenetownhall_org/EcczDXj2MNxGvMjrD3G-fs8BPFPEwegwwlCuPeGrToxzeg?e=l7POTP HTTP/1.1Host: keenetownhall-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/amanda_keenetownhall_org/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Transformer%2FView%20and%20Print%20Online%2Epdf&parent=%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Transformer&ga=1 HTTP/1.1Host: keenetownhall-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSwxMzM1Nzg2MTEzMTAwMDAwMDAsMCwxMzM1Nzk0NzIzMTk0NDQ1MzgsMC4wLjAuMCwyNTgsMTg2MWIxY2QtNjM0Mi00MTdiLWE4ZDktYjlkMGQzMmY1MWM5LCwsMzMwMDIwYTEtYzAyMi01MDAwLTI4ZjYtNDYzMzA0NTRmZjQ3LDMzMDAyMGExLWMwMjItNTAwMC0yOGY2LTQ2MzMwNDU0ZmY0NyxRSUVyRHdETXYwV0ZIdlhmeG5QU1FnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2ODcsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGFmSFZGQ0Y3d3NkWis2MUV2M3E3RWFGZDlmOHkzbTNxNml2ZVlJTWtTaWlEeVBUT3M5dk9qMnBuSStsVDMvRFlDREJWTmFvY1pEZUFTODR4ZzRuL1MzSllwRWRteTVJUU1lSDFBVzY3cGFva0l6RE9UTTE3ZWFndmVlNS8rM2hyUHJqLzlwZ3JTRXU4OE5YTFF4TEE2VHZnVTB0bHU5cGdyQkQwdEZrR0VMSmx0bVgwSkY2OHJvY1JIQUhSMnc5bmtYeEtnUWlqYm0vOHZXa1d6TzlXQ3EyUERuVUxqbmh5THpFQTFwTkpNSE9iWXJqdkFoR2RQNS9hc3NmRE8vQzd2YUJ0OUkrUWZEZ2NzTEVYalFSa0xYVUd5T0E3aWdsMFpJYmZsZlFhbVYvcU5Pb3VTRzNCSFBqTmFnQ21WYU5vZldRY0wyZHJ5VG5YQnlabStQaGFFdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: keenetownhall-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSwxMzM1Nzg2MTEzMTAwMDAwMDAsMCwxMzM1Nzk0NzIzMTk0NDQ1MzgsMC4wLjAuMCwyNTgsMTg2MWIxY2QtNjM0Mi00MTdiLWE4ZDktYjlkMGQzMmY1MWM5LCwsMzMwMDIwYTEtYzAyMi01MDAwLTI4ZjYtNDYzMzA0NTRmZjQ3LDMzMDAyMGExLWMwMjItNTAwMC0yOGY2LTQ2MzMwNDU0ZmY0NyxRSUVyRHdETXYwV0ZIdlhmeG5QU1FnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2ODcsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGFmSFZGQ0Y3d3NkWis2MUV2M3E3RWFGZDlmOHkzbTNxNml2ZVlJTWtTaWlEeVBUT3M5dk9qMnBuSStsVDMvRFlDREJWTmFvY1pEZUFTODR4ZzRuL1MzSllwRWRteTVJUU1lSDFBVzY3cGFva0l6RE9UTTE3ZWFndmVlNS8rM2hyUHJqLzlwZ3JTRXU4OE5YTFF4TEE2VHZnVTB0bHU5cGdyQkQwdEZrR0VMSmx0bVgwSkY2OHJvY1JIQUhSMnc5bmtYeEtnUWlqYm0vOHZXa1d6TzlXQ3EyUERuVUxqbmh5THpFQTFwTkpNSE9iWXJqdkFoR2RQNS9hc3NmRE8vQzd2YUJ0OUkrUWZEZ2NzTEVYalFSa0xYVUd5T0E3aWdsMFpJYmZsZlFhbVYvcU5Pb3VTRzNCSFBqTmFnQ21WYU5vZldRY0wyZHJ5VG5YQnlabStQaGFFdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: keenetownhall-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSwxMzM1Nzg2MTEzMTAwMDAwMDAsMCwxMzM1Nzk0NzIzMTk0NDQ1MzgsMC4wLjAuMCwyNTgsMTg2MWIxY2QtNjM0Mi00MTdiLWE4ZDktYjlkMGQzMmY1MWM5LCwsMzMwMDIwYTEtYzAyMi01MDAwLTI4ZjYtNDYzMzA0NTRmZjQ3LDMzMDAyMGExLWMwMjItNTAwMC0yOGY2LTQ2MzMwNDU0ZmY0NyxRSUVyRHdETXYwV0ZIdlhmeG5QU1FnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2ODcsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGFmSFZGQ0Y3d3NkWis2MUV2M3E3RWFGZDlmOHkzbTNxNml2ZVlJTWtTaWlEeVBUT3M5dk9qMnBuSStsVDMvRFlDREJWTmFvY1pEZUFTODR4ZzRuL1MzSllwRWRteTVJUU1lSDFBVzY3cGFva0l6RE9UTTE3ZWFndmVlNS8rM2hyUHJqLzlwZ3JTRXU4OE5YTFF4TEE2VHZnVTB0bHU5cGdyQkQwdEZrR0VMSmx0bVgwSkY2OHJvY1JIQUhSMnc5bmtYeEtnUWlqYm0vOHZXa1d6TzlXQ3EyUERuVUxqbmh5THpFQTFwTkpNSE9iWXJqdkFoR2RQNS9hc3NmRE8vQzd2YUJ0OUkrUWZEZ2NzTEVYalFSa0xYVUd5T0E3aWdsMFpJYmZsZlFhbVYvcU5Pb3VTRzNCSFBqTmFnQ21WYU5vZldRY0wyZHJ5VG5YQnlabStQaGFFdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /personal/amanda_keenetownhall_org/_api/v2.1/graphql HTTP/1.1Host: keenetownhall-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSwxMzM1Nzg2MTEzMTAwMDAwMDAsMCwxMzM1Nzk0NzIzMTk0NDQ1MzgsMC4wLjAuMCwyNTgsMTg2MWIxY2QtNjM0Mi00MTdiLWE4ZDktYjlkMGQzMmY1MWM5LCwsMzMwMDIwYTEtYzAyMi01MDAwLTI4ZjYtNDYzMzA0NTRmZjQ3LDMzMDAyMGExLWMwMjItNTAwMC0yOGY2LTQ2MzMwNDU0ZmY0NyxRSUVyRHdETXYwV0ZIdlhmeG5QU1FnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2ODcsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGFmSFZGQ0Y3d3NkWis2MUV2M3E3RWFGZDlmOHkzbTNxNml2ZVlJTWtTaWlEeVBUT3M5dk9qMnBuSStsVDMvRFlDREJWTmFvY1pEZUFTODR4ZzRuL1MzSllwRWRteTVJUU1lSDFBVzY3cGFva0l6RE9UTTE3ZWFndmVlNS8rM2hyUHJqLzlwZ3JTRXU4OE5YTFF4TEE2VHZnVTB0bHU5cGdyQkQwdEZrR0VMSmx0bVgwSkY2OHJvY1JIQUhSMnc5bmtYeEtnUWlqYm0vOHZXa1d6TzlXQ3EyUERuVUxqbmh5THpFQTFwTkpNSE9iWXJqdkFoR2RQNS9hc3NmRE8vQzd2YUJ0OUkrUWZEZ2NzTEVYalFSa0xYVUd5T0E3aWdsMFpJYmZsZlFhbVYvcU5Pb3VTRzNCSFBqTmFnQ21WYU5vZldRY0wyZHJ5VG5YQnlabStQaGFFdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: keenetownhall-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://keenetownhall-my.sharepoint.com/personal/amanda_keenetownhall_org/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Transformer%2FView%20and%20Print%20Online%2Epdf&parent=%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Transformer&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSwxMzM1Nzg2MTEzMTAwMDAwMDAsMCwxMzM1Nzk0NzIzMTk0NDQ1MzgsMC4wLjAuMCwyNTgsMTg2MWIxY2QtNjM0Mi00MTdiLWE4ZDktYjlkMGQzMmY1MWM5LCwsMzMwMDIwYTEtYzAyMi01MDAwLTI4ZjYtNDYzMzA0NTRmZjQ3LDMzMDAyMGExLWMwMjItNTAwMC0yOGY2LTQ2MzMwNDU0ZmY0NyxRSUVyRHdETXYwV0ZIdlhmeG5QU1FnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2ODcsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGFmSFZGQ0Y3d3NkWis2MUV2M3E3RWFGZDlmOHkzbTNxNml2ZVlJTWtTaWlEeVBUT3M5dk9qMnBuSStsVDMvRFlDREJWTmFvY1pEZUFTODR4ZzRuL1MzSllwRWRteTVJUU1lSDFBVzY3cGFva0l6RE9UTTE3ZWFndmVlNS8rM2hyUHJqLzlwZ3JTRXU4OE5YTFF4TEE2VHZnVTB0bHU5cGdyQkQwdEZrR0VMSmx0bVgwSkY2OHJvY1JIQUhSMnc5bmtYeEtnUWlqYm0vOHZXa1d6TzlXQ3EyUERuVUxqbmh5THpFQTFwTkpNSE9iWXJqdkFoR2RQNS9hc3NmRE8vQzd2YUJ0OUkrUWZEZ2NzTEVYalFSa0xYVUd5T0E3aWdsMFpJYmZsZlFhbVYvcU5Pb3VTRzNCSFBqTmFnQ21WYU5vZldRY0wyZHJ5VG5YQnlabStQaGFFdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: keenetownhall-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSwxMzM1Nzg2MTEzMTAwMDAwMDAsMCwxMzM1Nzk0NzIzMTk0NDQ1MzgsMC4wLjAuMCwyNTgsMTg2MWIxY2QtNjM0Mi00MTdiLWE4ZDktYjlkMGQzMmY1MWM5LCwsMzMwMDIwYTEtYzAyMi01MDAwLTI4ZjYtNDYzMzA0NTRmZjQ3LDMzMDAyMGExLWMwMjItNTAwMC0yOGY2LTQ2MzMwNDU0ZmY0NyxRSUVyRHdETXYwV0ZIdlhmeG5QU1FnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2ODcsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGFmSFZGQ0Y3d3NkWis2MUV2M3E3RWFGZDlmOHkzbTNxNml2ZVlJTWtTaWlEeVBUT3M5dk9qMnBuSStsVDMvRFlDREJWTmFvY1pEZUFTODR4ZzRuL1MzSllwRWRteTVJUU1lSDFBVzY3cGFva0l6RE9UTTE3ZWFndmVlNS8rM2hyUHJqLzlwZ3JTRXU4OE5YTFF4TEE2VHZnVTB0bHU5cGdyQkQwdEZrR0VMSmx0bVgwSkY2OHJvY1JIQUhSMnc5bmtYeEtnUWlqYm0vOHZXa1d6TzlXQ3EyUERuVUxqbmh5THpFQTFwTkpNSE9iWXJqdkFoR2RQNS9hc3NmRE8vQzd2YUJ0OUkrUWZEZ2NzTEVYalFSa0xYVUd5T0E3aWdsMFpJYmZsZlFhbVYvcU5Pb3VTRzNCSFBqTmFnQ21WYU5vZldRY0wyZHJ5VG5YQnlabStQaGFFdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/amanda_keenetownhall_org/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: keenetownhall-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSwxMzM1Nzg2MTEzMTAwMDAwMDAsMCwxMzM1Nzk0NzIzMTk0NDQ1MzgsMC4wLjAuMCwyNTgsMTg2MWIxY2QtNjM0Mi00MTdiLWE4ZDktYjlkMGQzMmY1MWM5LCwsMzMwMDIwYTEtYzAyMi01MDAwLTI4ZjYtNDYzMzA0NTRmZjQ3LDMzMDAyMGExLWMwMjItNTAwMC0yOGY2LTQ2MzMwNDU0ZmY0NyxRSUVyRHdETXYwV0ZIdlhmeG5QU1FnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2ODcsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGFmSFZGQ0Y3d3NkWis2MUV2M3E3RWFGZDlmOHkzbTNxNml2ZVlJTWtTaWlEeVBUT3M5dk9qMnBuSStsVDMvRFlDREJWTmFvY1pEZUFTODR4ZzRuL1MzSllwRWRteTVJUU1lSDFBVzY3cGFva0l6RE9UTTE3ZWFndmVlNS8rM2hyUHJqLzlwZ3JTRXU4OE5YTFF4TEE2VHZnVTB0bHU5cGdyQkQwdEZrR0VMSmx0bVgwSkY2OHJvY1JIQUhSMnc5bmtYeEtnUWlqYm0vOHZXa1d6TzlXQ3EyUERuVUxqbmh5THpFQTFwTkpNSE9iWXJqdkFoR2RQNS9hc3NmRE8vQzd2YUJ0OUkrUWZEZ2NzTEVYalFSa0xYVUd5T0E3aWdsMFpJYmZsZlFhbVYvcU5Pb3VTRzNCSFBqTmFnQ21WYU5vZldRY0wyZHJ5VG5YQnlabStQaGFFdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/amanda_keenetownhall_org/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%27&RootFolder=%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Transformer&TryNewExperienceSingle=TRUE HTTP/1.1Host: keenetownhall-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSwxMzM1Nzg2MTEzMTAwMDAwMDAsMCwxMzM1Nzk0NzIzMTk0NDQ1MzgsMC4wLjAuMCwyNTgsMTg2MWIxY2QtNjM0Mi00MTdiLWE4ZDktYjlkMGQzMmY1MWM5LCwsMzMwMDIwYTEtYzAyMi01MDAwLTI4ZjYtNDYzMzA0NTRmZjQ3LDMzMDAyMGExLWMwMjItNTAwMC0yOGY2LTQ2MzMwNDU0ZmY0NyxRSUVyRHdETXYwV0ZIdlhmeG5QU1FnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2ODcsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGFmSFZGQ0Y3d3NkWis2MUV2M3E3RWFGZDlmOHkzbTNxNml2ZVlJTWtTaWlEeVBUT3M5dk9qMnBuSStsVDMvRFlDREJWTmFvY1pEZUFTODR4ZzRuL1MzSllwRWRteTVJUU1lSDFBVzY3cGFva0l6RE9UTTE3ZWFndmVlNS8rM2hyUHJqLzlwZ3JTRXU4OE5YTFF4TEE2VHZnVTB0bHU5cGdyQkQwdEZrR0VMSmx0bVgwSkY2OHJvY1JIQUhSMnc5bmtYeEtnUWlqYm0vOHZXa1d6TzlXQ3EyUERuVUxqbmh5THpFQTFwTkpNSE9iWXJqdkFoR2RQNS9hc3NmRE8vQzd2YUJ0OUkrUWZEZ2NzTEVYalFSa0xYVUd5T0E3aWdsMFpJYmZsZlFhbVYvcU5Pb3VTRzNCSFBqTmFnQ21WYU5vZldRY0wyZHJ5VG5YQnlabStQaGFFdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%5D&defaultBrotli=true&authenticateFast=true&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099649,3]&spStartApplicationWebBundle=true&enableIntegrities=true HTTP/1.1Host: keenetownhall-my.sharepoint.comConnection: keep-aliveCache-Control: max-age=0Accept: */*Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://keenetownhall-my.sharepoint.com/personal/amanda_keenetownhall_org/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Transformer%2FView%20and%20Print%20Online%2Epdf&parent=%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Transformer&ga=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSwxMzM1Nzg2MTEzMTAwMDAwMDAsMCwxMzM1Nzk0NzIzMTk0NDQ1MzgsMC4wLjAuMCwyNTgsMTg2MWIxY2QtNjM0Mi00MTdiLWE4ZDktYjlkMGQzMmY1MWM5LCwsMzMwMDIwYTEtYzAyMi01MDAwLTI4ZjYtNDYzMzA0NTRmZjQ3LDMzMDAyMGExLWMwMjItNTAwMC0yOGY2LTQ2MzMwNDU0ZmY0NyxRSUVyRHdETXYwV0ZIdlhmeG5QU1FnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2ODcsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGFmSFZGQ0Y3d3NkWis2MUV2M3E3RWFGZDlmOHkzbTNxNml2ZVlJTWtTaWlEeVBUT3M5dk9qMnBuSStsVDMvRFlDREJWTmFvY1pEZUFTODR4ZzRuL1MzSllwRWRteTVJUU1lSDFBVzY3cGFva0l6RE9UTTE3ZWFndmVlNS8rM2hyUHJqLzlwZ3JTRXU4OE5YTFF4TEE2VHZnVTB0bHU5cGdyQkQwdEZrR0VMSmx0bVgwSkY2OHJvY1JIQUhSMnc5bmtYeEtnUWlqYm0vOHZXa1d6TzlXQ3EyUERuVUxqbmh5THpFQTFwTkpNSE9iWXJqdkFoR2RQNS9hc3NmRE8vQzd2YUJ0OUkrUWZEZ2NzTEVYalFSa0xYVUd5T0E3aWdsMFpJYmZsZlFhbVYvcU5Pb3VTRzNCSFBqTmFnQ21WYU5vZldRY0wyZHJ5VG5YQnlabStQaGFFdz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fkeenetownhall-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!ubyE26q0mUCDI46yZcHY2DQmrV6S0R1OnVayxzxtcJbSumZzqemURZffYSPNCNb-%2Fitems%2F016X26RLWHGMGXR5RQ3RDLZSHLB5Y347WP%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAva2VlbmV0b3duaGFsbC1teS5zaGFyZXBvaW50LmNvbUAxODYxYjFjZC02MzQyLTQxN2ItYThkOS1iOWQwZDMyZjUxYzkiLCJjYWNoZWtleSI6IjBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUiLCJlbmRwb2ludHVybCI6ImZpTTJ5bVhqSDNXR0cxYU9kd3hPUlhKNHlJUThwUW9SUXdxRmFyZm5pZFU9IiwiZW5kcG9pbnR1cmxMZW5ndGgiOiIxMjMiLCJleHAiOiIxNzEzMzk4NDAwIiwiaXBhZGRyIjoiODEuMTgxLjU3LjUyIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSIsIm5iZiI6IjE3MTMzNzY4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6IlFJRXJEd0RNdjBXRkh2WGZ4blBTUWciLCJzaXRlaWQiOiJaR0k0TkdKallqa3RZalJoWVMwME1EazVMVGd6TWpNdE9HVmlNalkxWXpGa09HUTQiLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.bnxELl0WoIUY6WchEwUu-o3wOEObsYGNp-UaBFV0gmA&cTag=%22c%3A%7B780D33C7-30F6-46DC-BCC8-EB0F71BE7ECF%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1Host: eastus1-mediap.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://keenetownhall-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fkeenetownhall-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!ubyE26q0mUCDI46yZcHY2DQmrV6S0R1OnVayxzxtcJbSumZzqemURZffYSPNCNb-%2Fitems%2F016X26RLWHGMGXR5RQ3RDLZSHLB5Y347WP%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAva2VlbmV0b3duaGFsbC1teS5zaGFyZXBvaW50LmNvbUAxODYxYjFjZC02MzQyLTQxN2ItYThkOS1iOWQwZDMyZjUxYzkiLCJjYWNoZWtleSI6IjBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUiLCJlbmRwb2ludHVybCI6ImZpTTJ5bVhqSDNXR0cxYU9kd3hPUlhKNHlJUThwUW9SUXdxRmFyZm5pZFU9IiwiZW5kcG9pbnR1cmxMZW5ndGgiOiIxMjMiLCJleHAiOiIxNzEzMzk4NDAwIiwiaXBhZGRyIjoiODEuMTgxLjU3LjUyIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSIsIm5iZiI6IjE3MTMzNzY4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6IlFJRXJEd0RNdjBXRkh2WGZ4blBTUWciLCJzaXRlaWQiOiJaR0k0TkdKallqa3RZalJoWVMwME1EazVMVGd6TWpNdE9HVmlNalkxWXpGa09HUTQiLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.bnxELl0WoIUY6WchEwUu-o3wOEObsYGNp-UaBFV0gmA&cTag=%22c%3A%7B780D33C7-30F6-46DC-BCC8-EB0F71BE7ECF%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1Host: eastus1-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=odbmspdfwebworker&debug=false&bypass=false HTTP/1.1Host: keenetownhall-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://keenetownhall-my.sharepoint.com/personal/amanda_keenetownhall_org/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Transformer%2FView%20and%20Print%20Online%2Epdf&parent=%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Transformer&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSwxMzM1Nzg2MTEzMTAwMDAwMDAsMCwxMzM1Nzk0NzIzMTk0NDQ1MzgsMC4wLjAuMCwyNTgsMTg2MWIxY2QtNjM0Mi00MTdiLWE4ZDktYjlkMGQzMmY1MWM5LCwsMzMwMDIwYTEtYzAyMi01MDAwLTI4ZjYtNDYzMzA0NTRmZjQ3LDMzMDAyMGExLWMwMjItNTAwMC0yOGY2LTQ2MzMwNDU0ZmY0NyxRSUVyRHdETXYwV0ZIdlhmeG5QU1FnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2ODcsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGFmSFZGQ0Y3d3NkWis2MUV2M3E3RWFGZDlmOHkzbTNxNml2ZVlJTWtTaWlEeVBUT3M5dk9qMnBuSStsVDMvRFlDREJWTmFvY1pEZUFTODR4ZzRuL1MzSllwRWRteTVJUU1lSDFBVzY3cGFva0l6RE9UTTE3ZWFndmVlNS8rM2hyUHJqLzlwZ3JTRXU4OE5YTFF4TEE2VHZnVTB0bHU5cGdyQkQwdEZrR0VMSmx0bVgwSkY2OHJvY1JIQUhSMnc5bmtYeEtnUWlqYm0vOHZXa1d6TzlXQ3EyUERuVUxqbmh5THpFQTFwTkpNSE9iWXJqdkFoR2RQNS9hc3NmRE8vQzd2YUJ0OUkrUWZEZ2NzTEVYalFSa0xYVUd5T0E3aWdsMFpJYmZsZlFhbVYvcU5Pb3VTRzNCSFBqTmFnQ21WYU5vZldRY0wyZHJ5VG5YQnlabStQaGFFdz09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=d3f609ed-11e7-4ea8-bee4-be75d2080bcb
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fkeenetownhall-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!ubyE26q0mUCDI46yZcHY2DQmrV6S0R1OnVayxzxtcJbSumZzqemURZffYSPNCNb-%2Fitems%2F016X26RLWHGMGXR5RQ3RDLZSHLB5Y347WP%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAva2VlbmV0b3duaGFsbC1teS5zaGFyZXBvaW50LmNvbUAxODYxYjFjZC02MzQyLTQxN2ItYThkOS1iOWQwZDMyZjUxYzkiLCJjYWNoZWtleSI6IjBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUiLCJlbmRwb2ludHVybCI6ImZpTTJ5bVhqSDNXR0cxYU9kd3hPUlhKNHlJUThwUW9SUXdxRmFyZm5pZFU9IiwiZW5kcG9pbnR1cmxMZW5ndGgiOiIxMjMiLCJleHAiOiIxNzEzMzk4NDAwIiwiaXBhZGRyIjoiODEuMTgxLjU3LjUyIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSIsIm5iZiI6IjE3MTMzNzY4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6IlFJRXJEd0RNdjBXRkh2WGZ4blBTUWciLCJzaXRlaWQiOiJaR0k0TkdKallqa3RZalJoWVMwME1EazVMVGd6TWpNdE9HVmlNalkxWXpGa09HUTQiLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.bnxELl0WoIUY6WchEwUu-o3wOEObsYGNp-UaBFV0gmA&cTag=%22c%3A%7B780D33C7-30F6-46DC-BCC8-EB0F71BE7ECF%7D%2C1%22 HTTP/1.1Host: eastus1-mediap.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://keenetownhall-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://keenetownhall-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fkeenetownhall-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!ubyE26q0mUCDI46yZcHY2DQmrV6S0R1OnVayxzxtcJbSumZzqemURZffYSPNCNb-%2Fitems%2F016X26RLWHGMGXR5RQ3RDLZSHLB5Y347WP%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAva2VlbmV0b3duaGFsbC1teS5zaGFyZXBvaW50LmNvbUAxODYxYjFjZC02MzQyLTQxN2ItYThkOS1iOWQwZDMyZjUxYzkiLCJjYWNoZWtleSI6IjBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUiLCJlbmRwb2ludHVybCI6ImZpTTJ5bVhqSDNXR0cxYU9kd3hPUlhKNHlJUThwUW9SUXdxRmFyZm5pZFU9IiwiZW5kcG9pbnR1cmxMZW5ndGgiOiIxMjMiLCJleHAiOiIxNzEzMzk4NDAwIiwiaXBhZGRyIjoiODEuMTgxLjU3LjUyIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSIsIm5iZiI6IjE3MTMzNzY4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6IlFJRXJEd0RNdjBXRkh2WGZ4blBTUWciLCJzaXRlaWQiOiJaR0k0TkdKallqa3RZalJoWVMwME1EazVMVGd6TWpNdE9HVmlNalkxWXpGa09HUTQiLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.bnxELl0WoIUY6WchEwUu-o3wOEObsYGNp-UaBFV0gmA&cTag=%22c%3A%7B780D33C7-30F6-46DC-BCC8-EB0F71BE7ECF%7D%2C1%22 HTTP/1.1Host: eastus1-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_api/v2.0/drive/apps?select=*%2Cpromoted%2CbuiltIn&%24expand=actions HTTP/1.1Host: keenetownhall-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonAccept-Language: en-USsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://keenetownhall-my.sharepoint.com/personal/amanda_keenetownhall_org/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Transformer%2FView%20and%20Print%20Online%2Epdf&parent=%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Transformer&ga=1Accept-Encoding: gzip, deflate, brCookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSwxMzM1Nzg2MTEzMTAwMDAwMDAsMCwxMzM1Nzk0NzIzMTk0NDQ1MzgsMC4wLjAuMCwyNTgsMTg2MWIxY2QtNjM0Mi00MTdiLWE4ZDktYjlkMGQzMmY1MWM5LCwsMzMwMDIwYTEtYzAyMi01MDAwLTI4ZjYtNDYzMzA0NTRmZjQ3LDMzMDAyMGExLWMwMjItNTAwMC0yOGY2LTQ2MzMwNDU0ZmY0NyxRSUVyRHdETXYwV0ZIdlhmeG5QU1FnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2ODcsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGFmSFZGQ0Y3d3NkWis2MUV2M3E3RWFGZDlmOHkzbTNxNml2ZVlJTWtTaWlEeVBUT3M5dk9qMnBuSStsVDMvRFlDREJWTmFvY1pEZUFTODR4ZzRuL1MzSllwRWRteTVJUU1lSDFBVzY3cGFva0l6RE9UTTE3ZWFndmVlNS8rM2hyUHJqLzlwZ3JTRXU4OE5YTFF4TEE2VHZnVTB0bHU5cGdyQkQwdEZrR0VMSmx0bVgwSkY2OHJvY1JIQUhSMnc5bmtYeEtnUWlqYm0vOHZXa1d6TzlXQ3EyUERuVUxqbmh5THpFQTFwTkpNSE9iWXJqdkFoR2RQNS9hc3NmRE8vQzd2YUJ0OUkrUWZEZ2NzTEVYalFSa0xYVUd5T0E3aWdsMFpJYmZsZlFhbVYvcU5Pb3VTRzNCSFBqTmFnQ21WYU5vZldRY0wyZHJ5VG5YQnlabStQaGFFdz09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=d3f609ed-11e7-4ea8-bee4-be75d2080bcb; ai_session=5vQ2JrLxCIyL0KbcevlUMr|1713387265746|1713387265746; MSFPC=GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /100/admin/js/sc.php?r=ZW0sZW1haWwsYWRk HTTP/1.1Host: slnotexs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/54ea73d52131/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /100/6cbbc89.php HTTP/1.1Host: slnotexs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /100/6cbbc89.php HTTP/1.1Host: slnotexs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fbo7t01i086v06r1ictrel0tau
Source: global traffic	HTTP traffic detected: GET /personal/amanda_keenetownhall_org/_layouts/15/AccessDenied.aspx?correlation=440020a1%2D702f%2D5000%2D28f6%2D4e9c6fafb210 HTTP/1.1Host: keenetownhall-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSwxMzM1Nzg2MTEzMTAwMDAwMDAsMCwxMzM1Nzk0NzIzMTk0NDQ1MzgsMC4wLjAuMCwyNTgsMTg2MWIxY2QtNjM0Mi00MTdiLWE4ZDktYjlkMGQzMmY1MWM5LCwsMzMwMDIwYTEtYzAyMi01MDAwLTI4ZjYtNDYzMzA0NTRmZjQ3LDMzMDAyMGExLWMwMjItNTAwMC0yOGY2LTQ2MzMwNDU0ZmY0NyxRSUVyRHdETXYwV0ZIdlhmeG5QU1FnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2ODcsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGFmSFZGQ0Y3d3NkWis2MUV2M3E3RWFGZDlmOHkzbTNxNml2ZVlJTWtTaWlEeVBUT3M5dk9qMnBuSStsVDMvRFlDREJWTmFvY1pEZUFTODR4ZzRuL1MzSllwRWRteTVJUU1lSDFBVzY3cGFva0l6RE9UTTE3ZWFndmVlNS8rM2hyUHJqLzlwZ3JTRXU4OE5YTFF4TEE2VHZnVTB0bHU5cGdyQkQwdEZrR0VMSmx0bVgwSkY2OHJvY1JIQUhSMnc5bmtYeEtnUWlqYm0vOHZXa1d6TzlXQ3EyUERuVUxqbmh5THpFQTFwTkpNSE9iWXJqdkFoR2RQNS9hc3NmRE8vQzd2YUJ0OUkrUWZEZ2NzTEVYalFSa0xYVUd5T0E3aWdsMFpJYmZsZlFhbVYvcU5Pb3VTRzNCSFBqTmFnQ21WYU5vZldRY0wyZHJ5VG5YQnlabStQaGFFdz09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=d3f609ed-11e7-4ea8-bee4-be75d2080bcb; ai_session=5vQ2JrLxCIyL0KbcevlUMr|1713387265746|1713387265746; MSFPC=GUID=749eee6039c5489b9db3000c7ab3f399&HASH=749e&LV=202310&V=4&LU=1696413236917
Source: global traffic	HTTP traffic detected: GET /100/admin/js/sc.php?r=ZW0sZW1haWwsYWRk HTTP/1.1Host: slnotexs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /100/6cbbc89.php HTTP/1.1Host: slnotexs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fbo7t01i086v06r1ictrel0tau
Source: global traffic	HTTP traffic detected: GET /100/6cbbc89.php HTTP/1.1Host: slnotexs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=fbo7t01i086v06r1ictrel0tau

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: keenetownhall-my.sharepoint.com

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /personal/amanda_keenetownhall_org/_api/v2.1/graphql HTTP/1.1Host: keenetownhall-my.sharepoint.comConnection: keep-aliveContent-Length: 507sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/json;odata=verboseContent-Type: application/json;odata=verboseX-ServiceWorker-Strategy: CacheFirstsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://keenetownhall-my.sharepoint.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://keenetownhall-my.sharepoint.com/personal/amanda_keenetownhall_org/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Transformer%2FView%20and%20Print%20Online%2Epdf&parent=%2Fpersonal%2Famanda%5Fkeenetownhall%5Forg%2FDocuments%2FView%20and%20Print%20Online%20Transformer&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uIzhiY2ZjNzM3Njc3NDA2N2Q0MTk1M2Y2ZmYwYTllOTBlOTFmNWZkNDVlOGRjM2MxOWVhZGM4YzRhN2NiYWQzMWUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jOGJjZmM3Mzc2Nzc0MDY3ZDQxOTUzZjZmZjBhOWU5MGU5MWY1ZmQ0NWU4ZGMzYzE5ZWFkYzhjNGE3Y2JhZDMxZSwxMzM1Nzg2MTEzMTAwMDAwMDAsMCwxMzM1Nzk0NzIzMTk0NDQ1MzgsMC4wLjAuMCwyNTgsMTg2MWIxY2QtNjM0Mi00MTdiLWE4ZDktYjlkMGQzMmY1MWM5LCwsMzMwMDIwYTEtYzAyMi01MDAwLTI4ZjYtNDYzMzA0NTRmZjQ3LDMzMDAyMGExLWMwMjItNTAwMC0yOGY2LTQ2MzMwNDU0ZmY0NyxRSUVyRHdETXYwV0ZIdlhmeG5QU1FnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTE2ODcsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGFmSFZGQ0Y3d3NkWis2MUV2M3E3RWFGZDlmOHkzbTNxNml2ZVlJTWtTaWlEeVBUT3M5dk9qMnBuSStsVDMvRFlDREJWTmFvY1pEZUFTODR4ZzRuL1MzSllwRWRteTVJUU1lSDFBVzY3cGFva0l6RE9UTTE3ZWFndmVlNS8rM2hyUHJqLzlwZ3JTRXU4OE5YTFF4TEE2VHZnVTB0bHU5cGdyQkQwdEZrR0VMSmx0bVgwSkY2OHJvY1JIQUhSMnc5bmtYeEtnUWlqYm0vOHZXa1d6TzlXQ3EyUERuVUxqbmh5THpFQTFwTkpNSE9iWXJqdkFoR2RQNS9hc3NmRE8vQzd2YUJ0OUkrUWZEZ2NzTEVYalFSa0xYVUd5T0E3aWdsMFpJYmZsZlFhbVYvcU5Pb3VTRzNCSFBqTmFnQ21WYU5vZldRY0wyZHJ5VG5YQnlabStQaGFFdz09PC9TUD4=

URLs found in memory or binary data

Source: chromecache_732.2.dr	String found in binary or memory: http://linkless.header/
Source: chromecache_630.2.dr, chromecache_331.2.dr, chromecache_711.2.dr, chromecache_541.2.dr, chromecache_713.2.dr, chromecache_640.2.dr, chromecache_368.2.dr, chromecache_634.2.dr, chromecache_326.2.dr	String found in binary or memory: http://www.contoso.com
Source: chromecache_435.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_409.2.dr, chromecache_619.2.dr	String found in binary or memory: https://1drv.com/
Source: chromecache_657.2.dr, chromecache_742.2.dr	String found in binary or memory: https://200.hc.com/the-harpercollins-200/moby-dick/
Source: chromecache_409.2.dr, chromecache_619.2.dr	String found in binary or memory: https://centralus1-mediad.svc.ms
Source: chromecache_785.2.dr	String found in binary or memory: https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute
Source: chromecache_574.2.dr	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: chromecache_409.2.dr, chromecache_619.2.dr	String found in binary or memory: https://livefilestore.com/
Source: chromecache_487.2.dr	String found in binary or memory: https://make.powerautomate.com
Source: chromecache_487.2.dr	String found in binary or memory: https://make.preprod.powerautomate.com
Source: chromecache_487.2.dr	String found in binary or memory: https://make.test.powerautomate.com
Source: chromecache_826.2.dr, chromecache_660.2.dr, chromecache_409.2.dr, chromecache_619.2.dr	String found in binary or memory: https://media.cloudapp.net
Source: chromecache_826.2.dr, chromecache_660.2.dr, chromecache_409.2.dr, chromecache_619.2.dr	String found in binary or memory: https://northcentralus1-medias.svc.ms
Source: chromecache_812.2.dr	String found in binary or memory: https://odspwebdevdeploy.blob.core.windows.net
Source: chromecache_812.2.dr	String found in binary or memory: https://onedrive.live.com/?gologin=1
Source: chromecache_705.2.dr, chromecache_721.2.dr, chromecache_487.2.dr, chromecache_605.2.dr, chromecache_353.2.dr, chromecache_583.2.dr	String found in binary or memory: https://outlook.office.com/search
Source: chromecache_387.2.dr	String found in binary or memory: https://outlook.office365.com
Source: chromecache_387.2.dr	String found in binary or memory: https://outlook.office365.com/SchedulingB2/api/v1.0/me/findmeetinglocations
Source: chromecache_444.2.dr, chromecache_487.2.dr, chromecache_605.2.dr, chromecache_353.2.dr, chromecache_463.2.dr, chromecache_592.2.dr, chromecache_736.2.dr, chromecache_766.2.dr, chromecache_409.2.dr, chromecache_589.2.dr, chromecache_722.2.dr	String found in binary or memory: https://portal.office.com/
Source: chromecache_409.2.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_826.2.dr	String found in binary or memory: https://sharepoint.uservoice.com/forums/329214-sites-and-collaboration
Source: chromecache_826.2.dr, chromecache_766.2.dr, chromecache_619.2.dr	String found in binary or memory: https://shellppe.msocdn.com
Source: chromecache_826.2.dr, chromecache_766.2.dr, chromecache_619.2.dr	String found in binary or memory: https://shellprod.msocdn.com
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold
Source: chromecache_575.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semiligh
Source: chromecache_642.2.dr, chromecache_722.2.dr	String found in binary or memory: https://substrate.office.com
Source: chromecache_657.2.dr, chromecache_742.2.dr	String found in binary or memory: https://www.littlebrown.com/titles/j-d-salinger/the-catcher-in-the-rye/9780316769488/
Source: chromecache_812.2.dr	String found in binary or memory: https://www.office.com/login?prompt=select_account&ru=%2Flaunch%2F$
Source: chromecache_812.2.dr	String found in binary or memory: https://www.office.com/login?ru=%2Flaunch%2F$
Source: chromecache_657.2.dr, chromecache_742.2.dr	String found in binary or memory: https://www.peachpit.com/store/dont-make-me-think-revisited-a-common-sense-approach-9780321965516
Source: chromecache_657.2.dr, chromecache_742.2.dr	String found in binary or memory: https://www.penguinrandomhouse.com/books/196330/great-tales-and-poems-of-edgar-allan-poe-by-edgar-al
Source: chromecache_742.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~007E;007E
Source: chromecache_657.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~007E;:tex
Source: chromecache_742.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~007E;007E
Source: chromecache_657.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~:text=The

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 50206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50222
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50271
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 184.31.54.93:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.54.93:443 -> 192.168.2.4:49763 version: TLS 1.2

System Summary

Found potential malicious PDF (bad image similarity)

Source: chromecache_614.2.dr	Static PDF information: Image stream: 14
Source: chromecache_405.2.dr	Static PDF information: Image stream: 14

Classification label

Source: classification engine

Classification label: mal84.phis.win@18/1032@32/11

Clickable URLs found in PDF

Source: chromecache_405.2.dr

Initial sample: https://construction-contractorapplicationdraw9973.us-iad-1.linodeobjects.com/0nedrivedoc.html

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2640 --field-trial-handle=2508,i,17212219979617064733,6871612600165021567,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://keenetownhall-my.sharepoint.com/:b:/g/personal/amanda_keenetownhall_org/EcczDXj2MNxGvMjrD3G-fs8BPFPEwegwwlCuPeGrToxzeg?e=l7POTP"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2640 --field-trial-handle=2508,i,17212219979617064733,6871612600165021567,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 614			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 405
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 405			Jump to dropped file

Malware Analysis System Evasion

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: chromecache_665.2.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_665.2.dr	Binary or memory string: ",DisconnectVirtualMachine:"