Play interactive tourEdit tour

Windows Analysis Report
https://gatewaytradefunding1-my.sharepoint.com/:b:/g/personal/crudnick_gatewaytradefunding_com/EUosCOHGhEhAsK3iU7WhHwcBJD24rRwvDApMZEF12v0Z7A?e=5sAePV

Overview

General Information

Sample URL:	https://gatewaytradefunding1-my.sharepoint.com/:b:/g/personal/crudnick_gatewaytradefunding_com/EUosCOHGhEhAsK3iU7WhHwcBJD24rRwvDApMZEF12v0Z7A?e=5sAePV
Analysis ID:	1437721
Infos:

Detection

HtmlDropper, HTMLPhisher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Html Dropper

Yara detected HtmlPhish10

Multimodal LLM detected phishing page

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Phishing site or detected (based on various text indicators)

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Invalid 'sign-in options' or 'sign-up' link found

Phishing site detected (based on OCR NLP Model)

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

×

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://gatewaytradefunding1-my.sharepoint.com/:b:/g/personal/crudnick_gatewaytradefunding_com/EUosCOHGhEhAsK3iU7WhHwcBJD24rRwvDApMZEF12v0Z7A?e=5sAePV

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Yara detected HtmlPhish10

Source: Yara match	File source: 4.11.pages.csv, type: HTML
Source: Yara match	File source: 3.10.pages.csv, type: HTML

Multimodal LLM detected phishing page

Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0

LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://arcasdis.com/...' does not match the legitimate domain of Microsoft, which is typically hosted under domains like 'microsoft.com' or 'live.com'. The presence of a login form mimicking Microsoft's official sign-in page, combined with a suspicious and unrelated domain, strongly suggests a phishing attempt.

Phishing site detected (based on image similarity)

Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0	Matcher: Template: microsoft matched
Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0#	Matcher: Template: microsoft matched

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 2.7

OCR Text: Verifying... CLOUDFLARE Microsoft

HTML body contains low number of good links

Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0

HTTP Parser: Number of links: 0

HTML page contains hidden URLs or javascript code

Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal

HTTP Parser: Base64 decoded: http://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal

HTML title does not match URL

Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0

HTTP Parser: Title: d353641ef49fd655861a37237910dcdd663a77c241375 does not match URL

Invalid 'sign-in options' or 'sign-up' link found

Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0

HTTP Parser: Invalid link: get a new Microsoft account

Phishing site detected (based on OCR NLP Model)

Source: Chrome DOM: 0.3	ML Model on OCR Text: Matched 99.9% probability on "View and print Online....$f 1/1 JANAS SharePoint You have received 2 documents from Barton F. Webb click the button below to gain access. "Click Here and print PDF Documents Online" Sien in 363 to n u View and print Online .$f "
Source: Chrome DOM: 0.4	ML Model on OCR Text: Matched 99.1% probability on "View and print Online....$f Info 1/1 JANAS SharePoint You have received 2 documents trom Barton F. Webb click the button below to gain T.lick Here and Print PDF Documents Online" E Sign with "

HTML page is missing a favicon

Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal	HTTP Parser: No favicon
Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0	HTTP Parser: No favicon

META author tag missing

Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0

HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0

HTTP Parser: No <meta name="copyright".. found

Compliance

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49797 version: TLS 1.0

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 23.196.184.112:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.196.184.112:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:50053 version: TLS 1.2

Networking

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49797 version: TLS 1.0

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.196.184.112
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /:b:/g/personal/crudnick_gatewaytradefunding_com/EUosCOHGhEhAsK3iU7WhHwcBJD24rRwvDApMZEF12v0Z7A?e=5sAePV HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/crudnick_gatewaytradefunding_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%2FView%20and%20print%20Online%20%2Epdf&parent=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments&ga=1 HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/crudnick_gatewaytradefunding_com/_api/v2.1/graphql HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://gatewaytradefunding1-my.sharepoint.com/personal/crudnick_gatewaytradefunding_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%2FView%20and%20print%20Online%20%2Epdf&parent=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%5D&defaultBrotli=true&authenticateFast=true&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099905,3]&spStartApplicationWebBundle=true&enableIntegrities=true HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive Cache-Control: max-age=0 Accept: */* Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://gatewaytradefunding1-my.sharepoint.com/personal/crudnick_gatewaytradefunding_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%2FView%20and%20print%20Online%20%2Epdf&parent=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments&ga=1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/crudnick_gatewaytradefunding_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/crudnick_gatewaytradefunding_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/crudnick_gatewaytradefunding_com/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=M61aD+MCM+Ooh94&MD=+Nh2cHsc HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fgatewaytradefunding1-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!5GR2yiSk2UiBrXtE5X8CD9KTWY480GlIrbAmzbUcbGtB1jNzhJ1uRovh3VIxfck3%2Fitems%2F01WO64O3KKFQEODRUEJBALBLPCKO22CHYH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZ2F0ZXdheXRyYWRlZnVuZGluZzEtbXkuc2hhcmVwb2ludC5jb21AZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5IiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlOTJhNTU4Y2E0OThhZjQwYTQzM2NlNjAyNDI4ZGExMjlhMmUyNDk5ZGFmYmE0NzVmMDUyN2YxMmVmN2FlNjI3IiwiZW5kcG9pbnR1cmwiOiIwYVhYcEdublBRNldrU3RRNkFnejdQUnJMMksrNTNHRkpnbC9qdnUxWitRPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTMwIiwiZXhwIjoiMTcxNTEyNjQwMCIsImlwYWRkciI6IjE1Ni4xNDYuMzcuMTAyIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNyIsIm5iZiI6IjE3MTUxMDQ4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6IkJiWWF5ZmF6NUVXSG45U01TcTRjaWciLCJzaXRlaWQiOiJZMkUzTmpZMFpUUXRZVFF5TkMwME9HUTVMVGd4WVdRdE4ySTBOR1UxTjJZd01qQm0iLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.k9MpOH8hWrjZmQztMhenvKwRbUZlMhAhD0hxRXk0buI&cTag=%22c%3A%7BE1082C4A-84C6-4048-B0AD-E253B5A11F07%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1 Host: eastus1-mediap.svc.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://gatewaytradefunding1-my.sharepoint.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fgatewaytradefunding1-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!5GR2yiSk2UiBrXtE5X8CD9KTWY480GlIrbAmzbUcbGtB1jNzhJ1uRovh3VIxfck3%2Fitems%2F01WO64O3KKFQEODRUEJBALBLPCKO22CHYH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZ2F0ZXdheXRyYWRlZnVuZGluZzEtbXkuc2hhcmVwb2ludC5jb21AZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5IiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlOTJhNTU4Y2E0OThhZjQwYTQzM2NlNjAyNDI4ZGExMjlhMmUyNDk5ZGFmYmE0NzVmMDUyN2YxMmVmN2FlNjI3IiwiZW5kcG9pbnR1cmwiOiIwYVhYcEdublBRNldrU3RRNkFnejdQUnJMMksrNTNHRkpnbC9qdnUxWitRPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTMwIiwiZXhwIjoiMTcxNTEyNjQwMCIsImlwYWRkciI6IjE1Ni4xNDYuMzcuMTAyIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNyIsIm5iZiI6IjE3MTUxMDQ4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6IkJiWWF5ZmF6NUVXSG45U01TcTRjaWciLCJzaXRlaWQiOiJZMkUzTmpZMFpUUXRZVFF5TkMwME9HUTVMVGd4WVdRdE4ySTBOR1UxTjJZd01qQm0iLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.k9MpOH8hWrjZmQztMhenvKwRbUZlMhAhD0hxRXk0buI&cTag=%22c%3A%7BE1082C4A-84C6-4048-B0AD-E253B5A11F07%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1 Host: eastus1-mediap.svc.ms Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=odbmspdfwebworker&debug=false&bypass=false HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://gatewaytradefunding1-my.sharepoint.com/personal/crudnick_gatewaytradefunding_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%2FView%20and%20print%20Online%20%2Epdf&parent=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=a81c0de4-21db-4c2b-8e74-17c3504c0e08
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fgatewaytradefunding1-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!5GR2yiSk2UiBrXtE5X8CD9KTWY480GlIrbAmzbUcbGtB1jNzhJ1uRovh3VIxfck3%2Fitems%2F01WO64O3KKFQEODRUEJBALBLPCKO22CHYH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZ2F0ZXdheXRyYWRlZnVuZGluZzEtbXkuc2hhcmVwb2ludC5jb21AZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5IiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlOTJhNTU4Y2E0OThhZjQwYTQzM2NlNjAyNDI4ZGExMjlhMmUyNDk5ZGFmYmE0NzVmMDUyN2YxMmVmN2FlNjI3IiwiZW5kcG9pbnR1cmwiOiIwYVhYcEdublBRNldrU3RRNkFnejdQUnJMMksrNTNHRkpnbC9qdnUxWitRPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTMwIiwiZXhwIjoiMTcxNTEyNjQwMCIsImlwYWRkciI6IjE1Ni4xNDYuMzcuMTAyIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNyIsIm5iZiI6IjE3MTUxMDQ4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6IkJiWWF5ZmF6NUVXSG45U01TcTRjaWciLCJzaXRlaWQiOiJZMkUzTmpZMFpUUXRZVFF5TkMwME9HUTVMVGd4WVdRdE4ySTBOR1UxTjJZd01qQm0iLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.k9MpOH8hWrjZmQztMhenvKwRbUZlMhAhD0hxRXk0buI&cTag=%22c%3A%7BE1082C4A-84C6-4048-B0AD-E253B5A11F07%7D%2C1%22 HTTP/1.1 Host: eastus1-mediap.svc.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Origin: https://gatewaytradefunding1-my.sharepoint.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://gatewaytradefunding1-my.sharepoint.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Fgatewaytradefunding1-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!5GR2yiSk2UiBrXtE5X8CD9KTWY480GlIrbAmzbUcbGtB1jNzhJ1uRovh3VIxfck3%2Fitems%2F01WO64O3KKFQEODRUEJBALBLPCKO22CHYH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZ2F0ZXdheXRyYWRlZnVuZGluZzEtbXkuc2hhcmVwb2ludC5jb21AZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5IiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlOTJhNTU4Y2E0OThhZjQwYTQzM2NlNjAyNDI4ZGExMjlhMmUyNDk5ZGFmYmE0NzVmMDUyN2YxMmVmN2FlNjI3IiwiZW5kcG9pbnR1cmwiOiIwYVhYcEdublBRNldrU3RRNkFnejdQUnJMMksrNTNHRkpnbC9qdnUxWitRPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTMwIiwiZXhwIjoiMTcxNTEyNjQwMCIsImlwYWRkciI6IjE1Ni4xNDYuMzcuMTAyIiwiaXNsb29wYmFjayI6IlRydWUiLCJpc3MiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAiLCJpc3VzZXIiOiJ0cnVlIiwibmFtZWlkIjoiMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNyIsIm5iZiI6IjE3MTUxMDQ4MDAiLCJuaWkiOiJtaWNyb3NvZnQuc2hhcmVwb2ludCIsInNoYXJpbmdpZCI6IkJiWWF5ZmF6NUVXSG45U01TcTRjaWciLCJzaXRlaWQiOiJZMkUzTmpZMFpUUXRZVFF5TkMwME9HUTVMVGd4WVdRdE4ySTBOR1UxTjJZd01qQm0iLCJzbmlkIjoiNiIsInN0cCI6InQiLCJ0dCI6IjAiLCJ2ZXIiOiJoYXNoZWRwcm9vZnRva2VuIn0.k9MpOH8hWrjZmQztMhenvKwRbUZlMhAhD0hxRXk0buI&cTag=%22c%3A%7BE1082C4A-84C6-4048-B0AD-E253B5A11F07%7D%2C1%22 HTTP/1.1 Host: eastus1-mediap.svc.ms Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_api/v2.0/drive/apps?select=*%2Cpromoted%2CbuiltIn&%24expand=actions HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json Accept-Language: en-US sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://gatewaytradefunding1-my.sharepoint.com/personal/crudnick_gatewaytradefunding_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%2FView%20and%20print%20Online%20%2Epdf&parent=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=a81c0de4-21db-4c2b-8e74-17c3504c0e08; ai_session=PtRMF92F1HjOkzGos5VmPY|1715107738778|1715107738778
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/style.css HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507
Source: global traffic	HTTP traffic detected: GET /captcha/logo.svg HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?render=explicit HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/ce7818f50e39/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/logo.svg HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=880363a25fa41927 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/880363a25fa41927/1715107761623/5b2ec94cd2755da5b8dee16b18bb3984752d03f25fc1b35c06efc10de1aa12f7/4XcXflsc46eCVhl HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1526453538:1715106298:EMsL-zOLEuZTH_RL8hNyWVYYMnTC8yzk0e97xGjJOhs/880363a25fa41927/75124d1579fa2b1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/880363a25fa41927/1715107761626/ld4a_zNJFNUnG1B HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0kgbl/0x4AAAAAAAZkrkPbo8rL954s/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=M61aD+MCM+Ooh94&MD=+Nh2cHsc HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/880363a25fa41927/1715107761626/ld4a_zNJFNUnG1B HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1526453538:1715106298:EMsL-zOLEuZTH_RL8hNyWVYYMnTC8yzk0e97xGjJOhs/880363a25fa41927/75124d1579fa2b1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1526453538:1715106298:EMsL-zOLEuZTH_RL8hNyWVYYMnTC8yzk0e97xGjJOhs/880363a25fa41927/75124d1579fa2b1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/rc/880363a25fa41927 HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1 Host: arcasdis.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /CAPYUVBdWpTWFVCUEc2bG9r HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 HTTP/1.1 Host: arcasdis.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://arcasdis.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /jq/52ac054747b8993a52d7afd11df3f360663a77c288f7f HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /boot/52ac054747b8993a52d7afd11df3f360663a77c288f83 HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /js/52ac054747b8993a52d7afd11df3f360663a77c288f85 HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: */* Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /personal/crudnick_gatewaytradefunding_com/_layouts/15/AccessDenied.aspx?correlation=0a6926a1%2Da0b6%2D0000%2D0751%2D8309787473d6 HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=a81c0de4-21db-4c2b-8e74-17c3504c0e08; ai_session=PtRMF92F1HjOkzGos5VmPY|1715107738778|1715107738778; MSFPC=GUID=df2ace7213d24ca1b76b30ce45ca9fe9&HASH=df2a&LV=202405&V=4&LU=1715107742606
Source: global traffic	HTTP traffic detected: GET /APP-52ac054747b8993a52d7afd11df3f360663a77c41c2c9/52ac054747b8993a52d7afd11df3f360663a77c41c2ca HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,*/*;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /o/52ac054747b8993a52d7afd11df3f360663a77c41c2ee HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /ASSETS/img/sig-op.svg HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /x/52ac054747b8993a52d7afd11df3f360663a77c41c2cf HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /ASSETS/img/m_.svg HTTP/1.1 Host: arcasdis.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://arcasdis.com/44d3ca3eda584b5611e1610a38471977663a77c24139fLOG44d3ca3eda584b5611e1610a38471977663a77c2413a0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /ASSETS/img/sig-op.svg HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /ASSETS/img/m_.svg HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /o/52ac054747b8993a52d7afd11df3f360663a77c41c2ee HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA
Source: global traffic	HTTP traffic detected: GET /x/52ac054747b8993a52d7afd11df3f360663a77c41c2cf HTTP/1.1 Host: arcasdis.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=810035c4b37d28904b40053c125be507; cf_clearance=k_n.LxiaVuh18j5ECMmwEWYppE.3B3QKpjPZGGukMbc-1715107776-1.0.1.1-FLBOw1zffARbSevwMIk1JEgQL_cZKh8YyWuUURpk.BegfDCy7equXb.fv496NKuZW5dHGYL2QNUdo7932aoQRA

Performs DNS lookups

Source: global traffic	DNS traffic detected: DNS query: gatewaytradefunding1-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: eastus1-mediap.svc.ms
Source: global traffic	DNS traffic detected: DNS query: arcasdis.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: spo.nel.measure.office.net

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /personal/crudnick_gatewaytradefunding_com/_api/v2.1/graphql HTTP/1.1 Host: gatewaytradefunding1-my.sharepoint.com Connection: keep-alive Content-Length: 507 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json;odata=verbose Content-Type: application/json;odata=verbose X-ServiceWorker-Strategy: CacheFirst sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://gatewaytradefunding1-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://gatewaytradefunding1-my.sharepoint.com/personal/crudnick_gatewaytradefunding_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments%2FView%20and%20print%20Online%20%2Epdf&parent=%2Fpersonal%2Fcrudnick%5Fgatewaytradefunding%5Fcom%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U5MmE1NThjYTQ5OGFmNDBhNDMzY2U2MDI0MjhkYTEyOWEyZTI0OTlkYWZiYTQ3NWYwNTI3ZjEyZWY3YWU2MjcsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTkyYTU1OGNhNDk4YWY0MGE0MzNjZTYwMjQyOGRhMTI5YTJlMjQ5OWRhZmJhNDc1ZjA1MjdmMTJlZjdhZTYyNywxMzM1OTU4MTYxMzAwMDAwMDAsMCwxMzM1OTY2NzcxNDAxNzcyNDEsMC4wLjAuMCwyNTgsZTZkOGQwMjUtNTc2MC00YmZkLWI1MjktOGU2MjRmYWNmY2Y5LCwsZmE2ODI2YTEtNTBiMy0wMDAwLTA3NTEtODI4NDE1Mjc2YWYzLGZhNjgyNmExLTUwYjMtMDAwMC0wNzUxLTgyODQxNTI3NmFmMyxCYllheWZhejVFV0huOVNNU3E0Y2lnLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwyMDEwNjksRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LDBJK01TYnJTYUNVQWIrM2pEcmhhcWhQa3NuZFo3c0xveVNMcEZObnRyZXA4ajFXNGFJbUpweXc2YW9sbVNhSmNCc1FBZDZpQzZkQTBBa3p0cVB5THdUNloyVnJTMTZ6L1dBaS81TGNGMGZTYUNFN2hvWkpCWE16SjkzdkR2NllUanBZanRycFA4YlVUQkdqQUJIb0JCOWdxOVJLREI4L0M3ZG00Q285YmhucGdpZGd6Z3JHTExYcEJ0cC8wckxlaTl4ZFYyWGlqMXpvSGNKWGtHU1BIK2lJaFQ5OEE1SVMvT1FkdzN5STd1a0NFSDBZY2VsNzlQOEc0VHY5blVPeGF0ajZlYUpVMDMxZlg4TUFSby84Z25YRVE0eHMyeDVyQTMxTEZKckxaVzFRRUhhT0xqdlhqK21vZElJempmOTJud2pvNm9FQlRqNDBhQkJSY3RQM3A5dz09PC9TUD4=

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not Found Date: Tue, 07 May 2024 18:49:40 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cW0LNtGwodtvnKrz1o9dO3uwa6WnWMrR1YyVs%2FfZQIP%2BvsyVmFQwgea1g9npwZvUFWDdu9wLMCtDfpi%2F1goP0VzFNlvrwTsFldA7mm%2FDkdoJRxVX5ONV2PDNANrej%2BY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 880364292c7042fc-EWR alt-svc: h3=":443"; ma=86400

URLs found in memory or binary data

Source: chromecache_835.2.dr, chromecache_574.2.dr, chromecache_828.2.dr, chromecache_375.2.dr, chromecache_600.2.dr, chromecache_755.2.dr, chromecache_630.2.dr, chromecache_357.2.dr, chromecache_608.2.dr, chromecache_703.2.dr, chromecache_445.2.dr	String found in binary or memory: http://www.contoso.com
Source: chromecache_550.2.dr, chromecache_787.2.dr, chromecache_412.2.dr	String found in binary or memory: https://1drv.com/
Source: chromecache_696.2.dr, chromecache_415.2.dr	String found in binary or memory: https://200.hc.com/the-harpercollins-200/moby-dick/
Source: chromecache_810.2.dr	String found in binary or memory: https://arcasdis.com/)
Source: chromecache_550.2.dr, chromecache_787.2.dr, chromecache_412.2.dr	String found in binary or memory: https://centralus1-mediad.svc.ms
Source: chromecache_550.2.dr, chromecache_787.2.dr, chromecache_412.2.dr	String found in binary or memory: https://livefilestore.com/
Source: chromecache_625.2.dr	String found in binary or memory: https://loki.delve.office.com
Source: chromecache_358.2.dr	String found in binary or memory: https://make.powerautomate.com
Source: chromecache_358.2.dr	String found in binary or memory: https://make.preprod.powerautomate.com
Source: chromecache_358.2.dr	String found in binary or memory: https://make.test.powerautomate.com
Source: chromecache_550.2.dr, chromecache_514.2.dr, chromecache_787.2.dr, chromecache_412.2.dr	String found in binary or memory: https://media.cloudapp.net
Source: chromecache_699.2.dr, chromecache_818.2.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: chromecache_550.2.dr, chromecache_514.2.dr, chromecache_787.2.dr, chromecache_412.2.dr	String found in binary or memory: https://northcentralus1-medias.svc.ms
Source: chromecache_552.2.dr	String found in binary or memory: https://odspwebdevdeploy.blob.core.windows.net
Source: chromecache_699.2.dr, chromecache_818.2.dr	String found in binary or memory: https://outlook.office.com/search
Source: chromecache_705.2.dr, chromecache_550.2.dr, chromecache_787.2.dr, chromecache_412.2.dr	String found in binary or memory: https://portal.office.com/
Source: chromecache_736.2.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_679.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/fabric-cdn-prod_20230815.002/assets
Source: chromecache_749.2.dr, chromecache_637.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-26.003/
Source: chromecache_749.2.dr, chromecache_637.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-26.003/spwebworker.js
Source: chromecache_552.2.dr	String found in binary or memory: https://res.cdn.office.net/teams-js/2.0.0/js/MicrosoftTeams.min.js
Source: chromecache_552.2.dr	String found in binary or memory: https://securebroker.sharepointonline.com
Source: chromecache_768.2.dr	String found in binary or memory: https://sharepoint.uservoice.com/forums/329214-sites-and-collaboration
Source: chromecache_768.2.dr, chromecache_412.2.dr	String found in binary or memory: https://shellppe.msocdn.com
Source: chromecache_768.2.dr, chromecache_412.2.dr	String found in binary or memory: https://shellprod.msocdn.com
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-bold.w
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-regula
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/leelawadeeui-thai/leelawadeeui-semili
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-bold.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-light.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-regular.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semibold.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-arabic/segoeui-semilight.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-bold.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-light.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-regular.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semibold.wof
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-cyrillic/segoeui-semilight.wo
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-bold.wof
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-light.wo
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-regular.
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semibold
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-easteuropean/segoeui-semiligh
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-bold.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-light.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-regular.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semibold.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-greek/segoeui-semilight.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-bold.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-light.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-regular.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semibold.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-hebrew/segoeui-semilight.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-bold.woff2
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-light.woff
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-regular.wo
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semibold.w
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-vietnamese/segoeui-semilight.
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-bold.wof
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-light.wo
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-regular.
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semibold
Source: chromecache_436.2.dr	String found in binary or memory: https://static2.sharepointonline.com/files/fabric/assets/fonts/segoeui-westeuropean/segoeui-semiligh
Source: chromecache_787.2.dr, chromecache_412.2.dr	String found in binary or memory: https://substrate.office.com
Source: chromecache_699.2.dr	String found in binary or memory: https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48
Source: chromecache_696.2.dr, chromecache_415.2.dr	String found in binary or memory: https://www.littlebrown.com/titles/j-d-salinger/the-catcher-in-the-rye/9780316769488/
Source: chromecache_696.2.dr, chromecache_415.2.dr	String found in binary or memory: https://www.peachpit.com/store/dont-make-me-think-revisited-a-common-sense-approach-9780321965516
Source: chromecache_696.2.dr, chromecache_415.2.dr	String found in binary or memory: https://www.penguinrandomhouse.com/books/196330/great-tales-and-poems-of-edgar-allan-poe-by-edgar-al
Source: chromecache_696.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~007E;007E
Source: chromecache_415.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~:text=The
Source: chromecache_696.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~007E;007E
Source: chromecache_415.2.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~:text=The

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 23.196.184.112:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.196.184.112:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:50053 version: TLS 1.2

System Summary

Classification label

Source: classification engine

Classification label: mal80.phis.troj.win@19/1055@34/13

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2232,i,13783881880537239856,13022482548529057744,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gatewaytradefunding1-my.sharepoint.com/:b:/g/personal/crudnick_gatewaytradefunding_com/EUosCOHGhEhAsK3iU7WhHwcBJD24rRwvDApMZEF12v0Z7A?e=5sAePV"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2232,i,13783881880537239856,13022482548529057744,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Windows shortcut file (LNK) contains relative path

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Found GUI installer (many successful clicks)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

Yara detected Html Dropper

Source: Yara match	File source: 4.11.pages.csv, type: HTML
Source: Yara match	File source: 3.10.pages.csv, type: HTML

Persistence and Installation Behavior

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 810
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 488			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 810			Jump to dropped file

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior

Malware Analysis System Evasion

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: chromecache_334.2.dr	Binary or memory string: ",ConnectVirtualMachine:"
Source: chromecache_334.2.dr	Binary or memory string: ",DisconnectVirtualMachine:"