Windows Analysis Report
https://gatewaytradefunding1-my.sharepoint.com/:b:/g/personal/crudnick_gatewaytradefunding_com/EUosCOHGhEhAsK3iU7WhHwcBJD24rRwvDApMZEF12v0Z7A?e=5sAePV

Overview

General Information

Sample URL: https://gatewaytradefunding1-my.sharepoint.com/:b:/g/personal/crudnick_gatewaytradefunding_com/EUosCOHGhEhAsK3iU7WhHwcBJD24rRwvDApMZEF12v0Z7A?e=5sAePV
Analysis ID: 1437721
Infos:

Detection

HtmlDropper, HTMLPhisher
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Html Dropper
Yara detected HtmlPhish10
Multimodal LLM detected phishing page
Phishing site detected (based on image similarity)
Phishing site detected (based on logo match)
Phishing site or detected (based on various text indicators)
Drops files with a non-matching file extension (content does not match file extension)
HTML body contains low number of good links
HTML page contains hidden URLs or javascript code
HTML title does not match URL
Invalid 'sign-in options' or 'sign-up' link found
Phishing site detected (based on OCR NLP Model)
Stores files to the Windows start menu directory
Uses insecure TLS / SSL version for HTTPS connection

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: https://gatewaytradefunding1-my.sharepoint.com/:b:/g/personal/crudnick_gatewaytradefunding_com/EUosCOHGhEhAsK3iU7WhHwcBJD24rRwvDApMZEF12v0Z7A?e=5sAePV SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing
barindex
Yara detected HtmlPhish10
Source: Yara match File source: 4.11.pages.csv, type: HTML
Source: Yara match File source: 3.10.pages.csv, type: HTML
Multimodal LLM detected phishing page
Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://arcasdis.com/...' does not match the legitimate domain of Microsoft, which is typically hosted under domains like 'microsoft.com' or 'live.com'. The presence of a login form mimicking Microsoft's official sign-in page, combined with a suspicious and unrelated domain, strongly suggests a phishing attempt.
Phishing site detected (based on image similarity)
Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Matcher: Found strong image similarity, brand: MICROSOFT
Phishing site detected (based on logo match)
Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Matcher: Template: microsoft matched
Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0# Matcher: Template: microsoft matched
Phishing site or detected (based on various text indicators)
Source: Chrome DOM: 2.7 OCR Text: Verifying... CLOUDFLARE Microsoft
HTML body contains low number of good links
Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 HTTP Parser: Number of links: 0
HTML page contains hidden URLs or javascript code
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal HTTP Parser: Base64 decoded: http://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal
HTML title does not match URL
Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 HTTP Parser: Title: d353641ef49fd655861a37237910dcdd663a77c241375 does not match URL
Invalid 'sign-in options' or 'sign-up' link found
Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 HTTP Parser: Invalid link: get a new Microsoft account
Phishing site detected (based on OCR NLP Model)
Source: Chrome DOM: 0.3 ML Model on OCR Text: Matched 99.9% probability on "View and print Online....$f 1/1 JANAS SharePoint You have received 2 documents from Barton F. Webb click the button below to gain access. "Click Here and print PDF Documents Online" Sien in 363 to n u View and print Online .$f "
Source: Chrome DOM: 0.4 ML Model on OCR Text: Matched 99.1% probability on "View and print Online....$f Info 1/1 JANAS SharePoint You have received 2 documents trom Barton F. Webb click the button below to gain T.lick Here and Print PDF Documents Online" E Sign with "
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal HTTP Parser: No favicon
Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 HTTP Parser: No favicon
Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 HTTP Parser: No <meta name="author".. found
Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 HTTP Parser: No <meta name="copyright".. found
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49797 version: TLS 1.0
Source: unknown HTTPS traffic detected: 23.196.184.112:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.196.184.112:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:50053 version: TLS 1.2
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49797 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: global traffic HTTP traffic detected: GET /:b:/g/personal/crudnick_gatewaytradefunding_com/EUosCOHGhEhAsK3iU7WhHwcBJD24rRwvDApMZEF12v0Z7A?e=5sAePV HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /personal/crudnick_gatewaytradefunding_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%2FView%20and%20print%20Online%20%2Epdf&parent=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments&ga=1 HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic HTTP traffic detected: GET /personal/crudnick_gatewaytradefunding_com/_api/v2.1/graphql HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://gatewaytradefunding1-my.sharepoint.com/personal/crudnick_gatewaytradefunding_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%2FView%20and%20print%20Online%20%2Epdf&parent=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%5D&defaultBrotli=true&authenticateFast=true&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive Cache-Control: max-age=0 Accept: */* Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://gatewaytradefunding1-my.sharepoint.com/personal/crudnick_gatewaytradefunding_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%2FView%20and%20print%20Online%20%2Epdf&parent=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments&ga=1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic HTTP traffic detected: GET /personal/crudnick_gatewaytradefunding_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic HTTP traffic detected: GET /personal/crudnick_gatewaytradefunding_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic HTTP traffic detected: GET /personal/crudnick_gatewaytradefunding_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=M61aD+MCM+Ooh94&MD=+Nh2cHsc HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fgatewaytradefunding1-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!5GR2yiSk2UiBrXtE5X8CD9KTWY480GlIrbAmzbUcbGtB1jNzhJ1uRovh3VIxfck3%2Fitems%2F01WO64O3KKFQEODRUEJBALBLPCKO22CHYH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZ2F0ZXdheXRyYWRlZnVuZGluZzEtbXkuc2hhcmVwb2ludC5jb21AZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5IiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlOTJhNTU4Y2E0OThhZjQwYTQzM2NlNjAyNDI4ZGExMjlhMmUyNDk5ZGFmYmE0NzVmMDUyN2YxMmVmN2FlNjI3IiwiZW5kcG9pbnR1cmwiOiIwYVhYcEdublBRNldrU3RRNkFnejdQUnJMMksrNTNHRkpnbC9qdnUxWitRPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTMwIiwiZXhwIjoiMTcxNTEyNjQwMCIsImlwYWRkciI6IjE1Ni4xNDYuMzcuMTAyIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNyIsIm5iZiI6IjE3MTUxMDQ4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6IkJiWWF5ZmF6NUVXSG45U01TcTRjaWciLCJzaXRlaWQiOiJZMkUzTmpZMFpUUXRZVFF5TkMwME9HUTVMVGd4WVdRdE4ySTBOR1UxTjJZd01qQm0iLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.k9MpOH8hWrjZmQztMhenvKwRbUZlMhAhD0hxRXk0buI&cTag=%22c%3A%7BE1082C4A-84C6-4048-B0AD-E253B5A11F07%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1 Host: eastus1-mediap.svc.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://gatewaytradefunding1-my.sharepoint.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fgatewaytradefunding1-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!5GR2yiSk2UiBrXtE5X8CD9KTWY480GlIrbAmzbUcbGtB1jNzhJ1uRovh3VIxfck3%2Fitems%2F01WO64O3KKFQEODRUEJBALBLPCKO22CHYH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZ2F0ZXdheXRyYWRlZnVuZGluZzEtbXkuc2hhcmVwb2ludC5jb21AZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5IiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlOTJhNTU4Y2E0OThhZjQwYTQzM2NlNjAyNDI4ZGExMjlhMmUyNDk5ZGFmYmE0NzVmMDUyN2YxMmVmN2FlNjI3IiwiZW5kcG9pbnR1cmwiOiIwYVhYcEdublBRNldrU3RRNkFnejdQUnJMMksrNTNHRkpnbC9qdnUxWitRPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTMwIiwiZXhwIjoiMTcxNTEyNjQwMCIsImlwYWRkciI6IjE1Ni4xNDYuMzcuMTAyIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNyIsIm5iZiI6IjE3MTUxMDQ4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6IkJiWWF5ZmF6NUVXSG45U01TcTRjaWciLCJzaXRlaWQiOiJZMkUzTmpZMFpUUXRZVFF5TkMwME9HUTVMVGd4WVdRdE4ySTBOR1UxTjJZd01qQm0iLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.k9MpOH8hWrjZmQztMhenvKwRbUZlMhAhD0hxRXk0buI&cTag=%22c%3A%7BE1082C4A-84C6-4048-B0AD-E253B5A11F07%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1 Host: eastus1-mediap.svc.ms Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=odbmspdfwebworker&debug=false&bypass=false HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://gatewaytradefunding1-my.sharepoint.com/personal/crudnick_gatewaytradefunding_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%2FView%20and%20print%20Online%20%2Epdf&parent=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=a81c0de4-21db-4c2b-8e74-17c3504c0e08
Source: global traffic HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fgatewaytradefunding1-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!5GR2yiSk2UiBrXtE5X8CD9KTWY480GlIrbAmzbUcbGtB1jNzhJ1uRovh3VIxfck3%2Fitems%2F01WO64O3KKFQEODRUEJBALBLPCKO22CHYH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZ2F0ZXdheXRyYWRlZnVuZGluZzEtbXkuc2hhcmVwb2ludC5jb21AZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5IiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlOTJhNTU4Y2E0OThhZjQwYTQzM2NlNjAyNDI4ZGExMjlhMmUyNDk5ZGFmYmE0NzVmMDUyN2YxMmVmN2FlNjI3IiwiZW5kcG9pbnR1cmwiOiIwYVhYcEdublBRNldrU3RRNkFnejdQUnJMMksrNTNHRkpnbC9qdnUxWitRPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTMwIiwiZXhwIjoiMTcxNTEyNjQwMCIsImlwYWRkciI6IjE1Ni4xNDYuMzcuMTAyIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNyIsIm5iZiI6IjE3MTUxMDQ4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6IkJiWWF5ZmF6NUVXSG45U01TcTRjaWciLCJzaXRlaWQiOiJZMkUzTmpZMFpUUXRZVFF5TkMwME9HUTVMVGd4WVdRdE4ySTBOR1UxTjJZd01qQm0iLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.k9MpOH8hWrjZmQztMhenvKwRbUZlMhAhD0hxRXk0buI&cTag=%22c%3A%7BE1082C4A-84C6-4048-B0AD-E253B5A11F07%7D%2C1%22 HTTP/1.1 Host: eastus1-mediap.svc.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Origin: https://gatewaytradefunding1-my.sharepoint.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://gatewaytradefunding1-my.sharepoint.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fgatewaytradefunding1-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!5GR2yiSk2UiBrXtE5X8CD9KTWY480GlIrbAmzbUcbGtB1jNzhJ1uRovh3VIxfck3%2Fitems%2F01WO64O3KKFQEODRUEJBALBLPCKO22CHYH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZ2F0ZXdheXRyYWRlZnVuZGluZzEtbXkuc2hhcmVwb2ludC5jb21AZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5IiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlOTJhNTU4Y2E0OThhZjQwYTQzM2NlNjAyNDI4ZGExMjlhMmUyNDk5ZGFmYmE0NzVmMDUyN2YxMmVmN2FlNjI3IiwiZW5kcG9pbnR1cmwiOiIwYVhYcEdublBRNldrU3RRNkFnejdQUnJMMksrNTNHRkpnbC9qdnUxWitRPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTMwIiwiZXhwIjoiMTcxNTEyNjQwMCIsImlwYWRkciI6IjE1Ni4xNDYuMzcuMTAyIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNyIsIm5iZiI6IjE3MTUxMDQ4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6IkJiWWF5ZmF6NUVXSG45U01TcTRjaWciLCJzaXRlaWQiOiJZMkUzTmpZMFpUUXRZVFF5TkMwME9HUTVMVGd4WVdRdE4ySTBOR1UxTjJZd01qQm0iLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.k9MpOH8hWrjZmQztMhenvKwRbUZlMhAhD0hxRXk0buI&cTag=%22c%3A%7BE1082C4A-84C6-4048-B0AD-E253B5A11F07%7D%2C1%22 HTTP/1.1 Host: eastus1-mediap.svc.ms Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /_api/v2.0/drive/apps?select=*%2Cpromoted%2CbuiltIn&%24expand=actions HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json Accept-Language: en-US sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://gatewaytradefunding1-my.sharepoint.com/personal/crudnick_gatewaytradefunding_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%2FView%20and%20print%20Online%20%2Epdf&parent=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=a81c0de4-21db-4c2b-8e74-17c3504c0e08; ai_session=PtRMF92F1HjOkzGos5VmPY|1715107738778|1715107738778
Source: global traffic HTTP traffic detected: GET / HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /captcha/style.css HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507
Source: global traffic HTTP traffic detected: GET /captcha/logo.svg HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507
Source: global traffic HTTP traffic detected: GET /turnstile/v0/api.js?render=explicit HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /turnstile/v0/b/ce7818f50e39/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /captcha/logo.svg HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=880363a25fa41927 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/880363a25fa41927/1715107761623/5b2ec94cd2755da5b8dee16b18bb3984752d03f25fc1b35c06efc10de1aa12f7/4XcXflsc46eCVhl HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1526453538:1715106298:EMsL-zOLEuZTH_RL8hNyWVYYMnTC8yzk0e97xGjJOhs/880363a25fa41927/75124d1579fa2b1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/880363a25fa41927/1715107761626/ld4a_zNJFNUnG1B HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=M61aD+MCM+Ooh94&MD=+Nh2cHsc HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/880363a25fa41927/1715107761626/ld4a_zNJFNUnG1B HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1526453538:1715106298:EMsL-zOLEuZTH_RL8hNyWVYYMnTC8yzk0e97xGjJOhs/880363a25fa41927/75124d1579fa2b1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1526453538:1715106298:EMsL-zOLEuZTH_RL8hNyWVYYMnTC8yzk0e97xGjJOhs/880363a25fa41927/75124d1579fa2b1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/rc/880363a25fa41927 HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET / HTTP/1.1 Host: arcasdis.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /CAPYUVBdWpTWFVCUEc2bG9r HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 HTTP/1.1 Host: arcasdis.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /jq/52ac054747b8993a52d7afd11df3f360663a77c288f7f HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /boot/52ac054747b8993a52d7afd11df3f360663a77c288f83 HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /js/52ac054747b8993a52d7afd11df3f360663a77c288f85 HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /personal/crudnick_gatewaytradefunding_com/_layouts/15/AccessDenied.aspx?correlation=0a6926a1%2Da0b6%2D0000%2D0751%2D8309787473d6 HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=a81c0de4-21db-4c2b-8e74-17c3504c0e08; ai_session=PtRMF92F1HjOkzGos5VmPY|1715107738778|1715107738778; MSFPC=GUID=df2ace7213d24ca1b76b30ce45ca9fe9&HASH=df2a&LV=202405&V=4&LU=1715107742606
Source: global traffic HTTP traffic detected: GET /APP-52ac054747b8993a52d7afd11df3f360663a77c41c2c9/52ac054747b8993a52d7afd11df3f360663a77c41c2ca HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /o/52ac054747b8993a52d7afd11df3f360663a77c41c2ee HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /ASSETS/img/sig-op.svg HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /x/52ac054747b8993a52d7afd11df3f360663a77c41c2cf HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /ASSETS/img/m_.svg HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /ASSETS/img/sig-op.svg HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /ASSETS/img/m_.svg HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /o/52ac054747b8993a52d7afd11df3f360663a77c41c2ee HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic HTTP traffic detected: GET /x/52ac054747b8993a52d7afd11df3f360663a77c41c2cf HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic DNS traffic detected: DNS query: gatewaytradefunding1-my.sharepoint.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic DNS traffic detected: DNS query: eastus1-mediap.svc.ms
Source: global traffic DNS traffic detected: DNS query: arcasdis.com
Source: global traffic DNS traffic detected: DNS query: code.jquery.com
Source: global traffic DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: spo.nel.measure.office.net
Source: unknown HTTP traffic detected: POST /personal/crudnick_gatewaytradefunding_com/_api/v2.1/graphql HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive Content-Length: 507 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json;odata=verbose Content-Type: application/json;odata=verbose X-ServiceWorker-Strategy: CacheFirst sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://gatewaytradefunding1-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://gatewaytradefunding1-my.sharepoint.com/personal/crudnick_gatewaytradefunding_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%2FView%20and%20print%20Online%20%2Epdf&parent=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Found Date: Tue, 07 May 2024 18:49:40 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cW0LNtGwodtvnKrz1o9dO3uwa6WnWMrR1YyVs%2FfZQIP%2BvsyVmFQwgea1g9npwZvUFWDdu9wLMCtDfpi%2F1goP0VzFNlvrwTsFldA7mm%2FDkdoJRxVX5ONV2PDNANrej%2BY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 880364292c7042fc-EWR alt-svc: h3=":443"; ma=86400
Source: chromecache_835.2.dr, chromecache_574.2.dr, chromecache_828.2.dr, chromecache_375.2.dr, chromecache_600.2.dr, chromecache_755.2.dr, chromecache_630.2.dr, chromecache_357.2.dr, chromecache_608.2.dr, chromecache_703.2.dr, chromecache_445.2.dr String found in binary or memory: http://www.contoso.com
Source: chromecache_550.2.dr, chromecache_787.2.dr, chromecache_412.2.dr String found in binary or memory: https://1drv.com/
Source: chromecache_696.2.dr, chromecache_415.2.dr String found in binary or memory: https://200.hc.com/the-harpercollins-200/moby-dick/
Source: chromecache_810.2.dr String found in binary or memory: https://arcasdis.com/)
Source: chromecache_550.2.dr, chromecache_787.2.dr, chromecache_412.2.dr String found in binary or memory: https://centralus1-mediad.svc.ms
Source: chromecache_550.2.dr, chromecache_787.2.dr, chromecache_412.2.dr String found in binary or memory: https://livefilestore.com/
Source: chromecache_625.2.dr String found in binary or memory: https://loki.delve.office.com
Source: chromecache_358.2.dr String found in binary or memory: https://make.powerautomate.com
Source: chromecache_358.2.dr String found in binary or memory: https://make.preprod.powerautomate.com
Source: chromecache_358.2.dr String found in binary or memory: https://make.test.powerautomate.com
Source: chromecache_550.2.dr, chromecache_514.2.dr, chromecache_787.2.dr, chromecache_412.2.dr String found in binary or memory: https://media.cloudapp.net
Source: chromecache_699.2.dr, chromecache_818.2.dr String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: chromecache_550.2.dr, chromecache_514.2.dr, chromecache_787.2.dr, chromecache_412.2.dr String found in binary or memory: https://northcentralus1-medias.svc.ms
Source: chromecache_552.2.dr String found in binary or memory: https://odspwebdevdeploy.blob.core.windows.net
Source: chromecache_699.2.dr, chromecache_818.2.dr String found in binary or memory: https://outlook.office.com/search
Source: chromecache_705.2.dr, chromecache_550.2.dr, chromecache_787.2.dr, chromecache_412.2.dr String found in binary or memory: https://portal.office.com/
Source: chromecache_736.2.dr String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_679.2.dr String found in binary or memory: https://res-1.cdn.office.net/files/fabric-cdn-prod_20230815.002/assets
Source: chromecache_749.2.dr, chromecache_637.2.dr String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-26.003/
Source: chromecache_749.2.dr, chromecache_637.2.dr String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-26.003/spwebworker.js
Source: chromecache_552.2.dr String found in binary or memory: https://res.cdn.office.net/teams-js/2.0.0/js/MicrosoftTeams.min.js
Source: chromecache_552.2.dr String found in binary or memory: https://securebroker.sharepointonline.com
Source: chromecache_768.2.dr String found in binary or memory: https://sharepoint.uservoice.com/forums/329214-sites-and-collaboration
Source: chromecache_768.2.dr, chromecache_412.2.dr String found in binary or memory: https://shellppe.msocdn.com
Source: chromecache_768.2.dr, chromecache_412.2.dr String found in binary or memory: https://shellprod.msocdn.com
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold
Source: chromecache_436.2.dr String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semiligh
Source: chromecache_787.2.dr, chromecache_412.2.dr String found in binary or memory: https://substrate.office.com
Source: chromecache_699.2.dr String found in binary or memory: https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48
Source: chromecache_696.2.dr, chromecache_415.2.dr String found in binary or memory: https://www.littlebrown.com/titles/j-d-salinger/the-catcher-in-the-rye/9780316769488/
Source: chromecache_696.2.dr, chromecache_415.2.dr String found in binary or memory: https://www.peachpit.com/store/dont-make-me-think-revisited-a-common-sense-approach-9780321965516
Source: chromecache_696.2.dr, chromecache_415.2.dr String found in binary or memory: https://www.penguinrandomhouse.com/books/196330/great-tales-and-poems-of-edgar-allan-poe-by-edgar-al
Source: chromecache_696.2.dr String found in binary or memory: https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~007E;007E
Source: chromecache_415.2.dr String found in binary or memory: https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~:text=The
Source: chromecache_696.2.dr String found in binary or memory: https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~007E;007E
Source: chromecache_415.2.dr String found in binary or memory: https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~:text=The
Source: unknown Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50300 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50162
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50161
Source: unknown Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50173
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown HTTPS traffic detected: 23.196.184.112:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.196.184.112:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:50053 version: TLS 1.2
Source: classification engine Classification label: mal80.phis.troj.win@19/1055@34/13
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2232,i,13783881880537239856,13022482548529057744,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gatewaytradefunding1-my.sharepoint.com/:b:/g/personal/crudnick_gatewaytradefunding_com/EUosCOHGhEhAsK3iU7WhHwcBJD24rRwvDApMZEF12v0Z7A?e=5sAePV"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2232,i,13783881880537239856,13022482548529057744,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Google Drive.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: Window Recorder Window detected: More than 3 window changes detected

Data Obfuscation
barindex
Yara detected Html Dropper
Source: Yara match File source: 4.11.pages.csv, type: HTML
Source: Yara match File source: 3.10.pages.csv, type: HTML
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: Chrome Cache Entry: 810
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: Chrome Cache Entry: 488 Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: Chrome Cache Entry: 810 Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Source: chromecache_334.2.dr Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_334.2.dr Binary or memory string: ",DisconnectVirtualMachine:"
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1437721 URL: https://gatewaytradefunding... Startdate: 07/05/2024 Architecture: WINDOWS Score: 80 26 Antivirus / Scanner detection for submitted sample 2->26 28 Yara detected Html Dropper 2->28 30 Yara detected HtmlPhish10 2->30 32 4 other signatures 2->32 6 chrome.exe 9 2->6         started        9 chrome.exe 2->9         started        process3 dnsIp4 14 192.168.2.16 unknown unknown 6->14 16 192.168.2.5, 443, 49197, 49265 unknown unknown 6->16 18 2 other IPs or domains 6->18 11 chrome.exe 6->11         started        process5 dnsIp6 20 arcasdis.com 172.67.163.112, 443, 50012, 50013 CLOUDFLARENETUS United States 11->20 22 13.107.136.10, 443, 49854, 49878 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 11->22 24 15 other IPs or domains 11->24
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.138.10
 dual-spo-0005.spo-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
13.107.136.10
 unknown United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
104.17.3.184
 challenges.cloudflare.com United States
13335 CLOUDFLARENETUS false
151.101.66.137
 code.jquery.com United States
54113 FASTLYUS false
35.190.80.1
 a.nel.cloudflare.com United States
15169 GOOGLEUS false
150.171.40.10
 dual-spo-0005.spo-dc-msedge.net United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
172.67.163.112
 arcasdis.com United States
13335 CLOUDFLARENETUS true
239.255.255.250
 unknown Reserved
unknown unknown false
142.251.35.164
 www.google.com United States
15169 GOOGLEUS false
104.17.2.184
 unknown United States
13335 CLOUDFLARENETUS false

Private

IP
192.168.2.16
192.168.2.7
192.168.2.5

Contacted Domains

Name IP Active
dual-spo-0005.spo-msedge.net 13.107.138.10 true
a.nel.cloudflare.com 35.190.80.1 true
code.jquery.com 151.101.66.137 true
arcasdis.com 172.67.163.112 true
challenges.cloudflare.com 104.17.3.184 true
dual-spo-0005.spo-dc-msedge.net 150.171.40.10 true
www.google.com 142.251.35.164 true
gatewaytradefunding1-my.sharepoint.com unknown unknown
eastus1-mediap.svc.ms unknown unknown
m365cdn.nel.measure.office.net unknown unknown
spo.nel.measure.office.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=880363a25fa41927 false
    		high
    https://arcasdis.com/cdn-cgi/challenge-platform/h/b/rc/880363a25fa41927 false
    • Avira URL Cloud: safe
    		 unknown
    https://eastus1-mediap.svc.ms/transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fgatewaytradefunding1-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!5GR2yiSk2UiBrXtE5X8CD9KTWY480GlIrbAmzbUcbGtB1jNzhJ1uRovh3VIxfck3%2Fitems%2F01WO64O3KKFQEODRUEJBALBLPCKO22CHYH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZ2F0ZXdheXRyYWRlZnVuZGluZzEtbXkuc2hhcmVwb2ludC5jb21AZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5IiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlOTJhNTU4Y2E0OThhZjQwYTQzM2NlNjAyNDI4ZGExMjlhMmUyNDk5ZGFmYmE0NzVmMDUyN2YxMmVmN2FlNjI3IiwiZW5kcG9pbnR1cmwiOiIwYVhYcEdublBRNldrU3RRNkFnejdQUnJMMksrNTNHRkpnbC9qdnUxWitRPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTMwIiwiZXhwIjoiMTcxNTEyNjQwMCIsImlwYWRkciI6IjE1Ni4xNDYuMzcuMTAyIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNyIsIm5iZiI6IjE3MTUxMDQ4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6IkJiWWF5ZmF6NUVXSG45U01TcTRjaWciLCJzaXRlaWQiOiJZMkUzTmpZMFpUUXRZVFF5TkMwME9HUTVMVGd4WVdRdE4ySTBOR1UxTjJZd01qQm0iLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.k9MpOH8hWrjZmQztMhenvKwRbUZlMhAhD0hxRXk0buI&cTag=%22c%3A%7BE1082C4A-84C6-4048-B0AD-E253B5A11F07%7D%2C1%22 false
    • Avira URL Cloud: safe
    		 unknown
    https://code.jquery.com/jquery-3.6.0.min.js false
      		high
      https://arcasdis.com/jq/52ac054747b8993a52d7afd11df3f360663a77c288f7f false
      • Avira URL Cloud: safe
      		 unknown
      https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1526453538:1715106298:EMsL-zOLEuZTH_RL8hNyWVYYMnTC8yzk0e97xGjJOhs/880363a25fa41927/75124d1579fa2b1 false
        		high
        https://gatewaytradefunding1-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=odbmspdfwebworker&debug=false&bypass=false false
        • Avira URL Cloud: safe
        		 unknown
        https://gatewaytradefunding1-my.sharepoint.com/:b:/g/personal/crudnick_gatewaytradefunding_com/EUosCOHGhEhAsK3iU7WhHwcBJD24rRwvDApMZEF12v0Z7A?e=5sAePV true
          		unknown
          https://arcasdis.com/ASSETS/img/sig-op.svg false
          • Avira URL Cloud: safe
          		 unknown
          https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D false
            		high
            https://arcasdis.com/1 false
            • Avira URL Cloud: safe
            		 unknown
            https://gatewaytradefunding1-my.sharepoint.com/personal/crudnick_gatewaytradefunding_com/_layouts/15/AccessDenied.aspx?correlation=0a6926a1%2Da0b6%2D0000%2D0751%2D8309787473d6 false
            • Avira URL Cloud: safe
            		 unknown
            https://arcasdis.com/ true
              		unknown
              https://arcasdis.com/favicon.ico false
              • Avira URL Cloud: safe
              		 unknown
              https://gatewaytradefunding1-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx false
              • Avira URL Cloud: safe
              		 unknown
              https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal false
                		high
                https://gatewaytradefunding1-my.sharepoint.com/personal/crudnick_gatewaytradefunding_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%2FView%20and%20print%20Online%20%2Epdf&parent=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments&ga=1 false
                  		unknown
                  https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/880363a25fa41927/1715107761623/5b2ec94cd2755da5b8dee16b18bb3984752d03f25fc1b35c06efc10de1aa12f7/4XcXflsc46eCVhl false
                    		high
                    https://arcasdis.com/js/52ac054747b8993a52d7afd11df3f360663a77c288f85 false
                    • Avira URL Cloud: safe
                    		 unknown
                    https://arcasdis.com/o/52ac054747b8993a52d7afd11df3f360663a77c41c2ee false
                    • Avira URL Cloud: safe
                    		 unknown
                    https://arcasdis.com/CAPYUVBdWpTWFVCUEc2bG9r false
                    • Avira URL Cloud: safe
                    		 unknown
                    https://gatewaytradefunding1-my.sharepoint.com/personal/crudnick_gatewaytradefunding_com/_api/v2.1/graphql false
                    • Avira URL Cloud: safe
                    		 unknown
                    https://gatewaytradefunding1-my.sharepoint.com/personal/crudnick_gatewaytradefunding_com/_api/SP.OAuth.Token/Acquire() false
                    • Avira URL Cloud: safe
                    		 unknown
                    https://arcasdis.com/APP-52ac054747b8993a52d7afd11df3f360663a77c41c2c9/52ac054747b8993a52d7afd11df3f360663a77c41c2ca false
                    • Avira URL Cloud: safe
                    		 unknown
                    https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0# true
                      		unknown
                      https://eastus1-mediap.svc.ms/transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fgatewaytradefunding1-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!5GR2yiSk2UiBrXtE5X8CD9KTWY480GlIrbAmzbUcbGtB1jNzhJ1uRovh3VIxfck3%2Fitems%2F01WO64O3KKFQEODRUEJBALBLPCKO22CHYH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZ2F0ZXdheXRyYWRlZnVuZGluZzEtbXkuc2hhcmVwb2ludC5jb21AZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5IiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlOTJhNTU4Y2E0OThhZjQwYTQzM2NlNjAyNDI4ZGExMjlhMmUyNDk5ZGFmYmE0NzVmMDUyN2YxMmVmN2FlNjI3IiwiZW5kcG9pbnR1cmwiOiIwYVhYcEdublBRNldrU3RRNkFnejdQUnJMMksrNTNHRkpnbC9qdnUxWitRPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTMwIiwiZXhwIjoiMTcxNTEyNjQwMCIsImlwYWRkciI6IjE1Ni4xNDYuMzcuMTAyIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNyIsIm5iZiI6IjE3MTUxMDQ4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6IkJiWWF5ZmF6NUVXSG45U01TcTRjaWciLCJzaXRlaWQiOiJZMkUzTmpZMFpUUXRZVFF5TkMwME9HUTVMVGd4WVdRdE4ySTBOR1UxTjJZd01qQm0iLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.k9MpOH8hWrjZmQztMhenvKwRbUZlMhAhD0hxRXk0buI&cTag=%22c%3A%7BE1082C4A-84C6-4048-B0AD-E253B5A11F07%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= false
                      • Avira URL Cloud: safe
                      		 unknown
                      https://arcasdis.com/captcha/logo.svg false
                      • Avira URL Cloud: safe
                      		 unknown
                      https://gatewaytradefunding1-my.sharepoint.com/_layouts/15/images/odbfavicon.ico?rev=47 false
                      • Avira URL Cloud: safe
                      		 unknown
                      https://arcasdis.com/boot/52ac054747b8993a52d7afd11df3f360663a77c288f83 false
                      • Avira URL Cloud: safe
                      		 unknown
                      https://arcasdis.com/ASSETS/img/m_.svg false
                      • Avira URL Cloud: safe
                      		 unknown
                      https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/880363a25fa41927/1715107761626/ld4a_zNJFNUnG1B false
                        		high