Play interactive tourEdit tour

Windows Analysis Report
https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USF&xsdata=MDV8MDJ8am1ja2lubGV5QGhhaWdyb3VwLmNvbXwyYzYxNmM3ZDhlNmU0YWM5MDJlMjA4ZGQyZTYzYjFmMnw4MjgxNWI4YzM3NzU0NTk5OTdjNzJiODc1MjhlNmY4M3wwfDB8NjM4NzE3Nz

Overview

General Information

Sample URL:	https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USF&xsdata=MDV8MDJ8am1ja2lubGV5QGhhaWdyb3VwLmNvbXwyYz
Analysis ID:	1584848
Infos:

Detection

HTMLPhisher

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected BlockedWebSite

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

×

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected BlockedWebSite

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_137, type: DROPPED

HTML body contains low number of good links

Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D%2D96776DF5B27FC7EDDC47DDCD3CAB3D42F8BAE950EE382D88150897A0DD266CFA&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ae674a1%2D30c9%2D7000%2D6fe3%2D423284321c14	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D%2D96776DF5B27FC7EDDC47DDCD3CAB3D42F8BAE950EE382D88150897A0DD266CFA&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ae674a1%2D30c9%2D7000%2D6fe3%2D423284321c14&sso_reload=true	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8%2DA22FE3FB9A7F23E7D4725C95F3E4821BA4076BB89A680D2540FD144B2EEEA234&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2de674a1%2D00ec%2D7000%2D6fe3%2D43062a43c75b	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6BF4F0595F48D92F641DE3CBFF0738E298D2303F897BFE45%2D75F8D0D0B564414B463FB1BC9C9712D7E46301C8A4FC8753AE2BD78BE77C0C30&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=33e674a1%2De0bf%2D7000%2D6fe3%2D474fbe5bd773	HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhacdct-my.sharepoint.com%2F%3Af%3A%2Fg%2Fpersonal%2Fdmarra_hacdct_org%2FEl0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ%3Femail%3Ddhodder%2540haigroup.com%26e%3Dd37USF&data=05%7C02%7Cjmckinley%40haigroup.com%7C2c616c7d8e6e4ac902e208dd2e63b1f2%7C82815b8c3775459997c72b87528e6f83%7C0%7C0%7C638717736975367538%7CBad%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyLCJBUCI6eyJGSWQiOiIxOTM5NjUiLCJGTGJsIjoiVVNfMzQyX0NvbnRlbnQiLCJHZW8iOiJOQU0iLCJSZXFJZCI6IjFkZTY3NGExLTgwMWYtNzAwMC02ZmUzLTQ4OTdkY2RhNWJmMyIsIk1JZCI6Ijc3OTgzMjQiLCJNTmFtZSI6IlVTUjE5Mzk2NS04MjUiLCJDbGllbnRJUCI6IjguNDYuMTIzLjE4OSIsIkNsaWVudC1BZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTcuMC4wLjAgU2FmYXJpLzUzNy4zNiIsIkNJRC1PcmlnaW4iOiJTUE8ifX0%3D%7C1%7CMmM2MTZjN2QtOGU2ZS00YWM5LTAyZTItMDhkZDJlNjNiMWYy%7C06f65864f902416df44308dd2e65d01e%7C1ee674a1d03770006fe34e327...

HTTP Parser: Base64 decoded: nstanceID> <xmpMM:DerivedFrom rdf:parseType="Resource"> <stRef:instanceID>xmp.iid:dc367036-9ff1-4136-a5bd-ad1cd2b8e5f9</stRef:instanceID> <stRef:documentID>adobe:docid:photoshop:f258af37-86a5-117a-b4d5-dc1df99d265f</stRef:document...

HTML title does not match URL

Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D%2D96776DF5B27FC7EDDC47DDCD3CAB3D42F8BAE950EE382D88150897A0DD266CFA&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ae674a1%2D30c9%2D7000%2D6fe3%2D423284321c14	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D%2D96776DF5B27FC7EDDC47DDCD3CAB3D42F8BAE950EE382D88150897A0DD266CFA&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ae674a1%2D30c9%2D7000%2D6fe3%2D423284321c14&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8%2DA22FE3FB9A7F23E7D4725C95F3E4821BA4076BB89A680D2540FD144B2EEEA234&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2de674a1%2D00ec%2D7000%2D6fe3%2D43062a43c75b	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6BF4F0595F48D92F641DE3CBFF0738E298D2303F897BFE45%2D75F8D0D0B564414B463FB1BC9C9712D7E46301C8A4FC8753AE2BD78BE77C0C30&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=33e674a1%2De0bf%2D7000%2D6fe3%2D474fbe5bd773	HTTP Parser: Title: Sign in to your account does not match URL

HTML body contains password input

Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8%2DA22FE3FB9A7F23E7D4725C95F3E4821BA4076BB89A680D2540FD144B2EEEA234&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2de674a1%2D00ec%2D7000%2D6fe3%2D43062a43c75b

HTTP Parser: <input type="password" .../> found

Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6BF4F0595F48D92F641DE3CBFF0738E298D2303F897BFE45%2D75F8D0D0B564414B463FB1BC9C9712D7E46301C8A4FC8753AE2BD78BE77C0C30&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=33e674a1%2De0bf%2D7000%2D6fe3%2D474fbe5bd773

HTTP Parser: <input type="password" .../> found

HTML page is missing a favicon

Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D%2D96776DF5B27FC7EDDC47DDCD3CAB3D42F8BAE950EE382D88150897A0DD266CFA&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ae674a1%2D30c9%2D7000%2D6fe3%2D423284321c14

HTTP Parser: No favicon

Source: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org

HTTP Parser: No favicon

META author tag missing

Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D%2D96776DF5B27FC7EDDC47DDCD3CAB3D42F8BAE950EE382D88150897A0DD266CFA&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ae674a1%2D30c9%2D7000%2D6fe3%2D423284321c14	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D%2D96776DF5B27FC7EDDC47DDCD3CAB3D42F8BAE950EE382D88150897A0DD266CFA&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ae674a1%2D30c9%2D7000%2D6fe3%2D423284321c14&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8%2DA22FE3FB9A7F23E7D4725C95F3E4821BA4076BB89A680D2540FD144B2EEEA234&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2de674a1%2D00ec%2D7000%2D6fe3%2D43062a43c75b	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8%2DA22FE3FB9A7F23E7D4725C95F3E4821BA4076BB89A680D2540FD144B2EEEA234&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2de674a1%2D00ec%2D7000%2D6fe3%2D43062a43c75b	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6BF4F0595F48D92F641DE3CBFF0738E298D2303F897BFE45%2D75F8D0D0B564414B463FB1BC9C9712D7E46301C8A4FC8753AE2BD78BE77C0C30&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=33e674a1%2De0bf%2D7000%2D6fe3%2D474fbe5bd773	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D%2D96776DF5B27FC7EDDC47DDCD3CAB3D42F8BAE950EE382D88150897A0DD266CFA&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ae674a1%2D30c9%2D7000%2D6fe3%2D423284321c14	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D%2D96776DF5B27FC7EDDC47DDCD3CAB3D42F8BAE950EE382D88150897A0DD266CFA&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2ae674a1%2D30c9%2D7000%2D6fe3%2D423284321c14&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8%2DA22FE3FB9A7F23E7D4725C95F3E4821BA4076BB89A680D2540FD144B2EEEA234&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2de674a1%2D00ec%2D7000%2D6fe3%2D43062a43c75b	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8%2DA22FE3FB9A7F23E7D4725C95F3E4821BA4076BB89A680D2540FD144B2EEEA234&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=2de674a1%2D00ec%2D7000%2D6fe3%2D43062a43c75b	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&response%5Ftype=code%20id%5Ftoken&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=6BF4F0595F48D92F641DE3CBFF0738E298D2303F897BFE45%2D75F8D0D0B564414B463FB1BC9C9712D7E46301C8A4FC8753AE2BD78BE77C0C30&redirect%5Furi=https%3A%2F%2Fhacdct%2Dmy%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0w&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=33e674a1%2De0bf%2D7000%2D6fe3%2D474fbe5bd773	HTTP Parser: No <meta name="copyright".. found

Networking

Detected suspicious crossdomain redirect

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: hacdct-my.sharepoint.com to https://nam12.safelinks.protection.outlook.com/?url=https%3a%2f%2fhacdct-my.sharepoint.com%2f%3af%3a%2fg%2fpersonal%2fdmarra_hacdct_org%2fel0cfhnmvmnnuzpj6qgnrsqbywvlnw96w_xrx10udrlfmq%3femail%3ddhodder%2540haigroup.com%26e%3dd37usf&data=05%7c02%7cjmckinley%40haigroup.com%7c2c616c7d8e6e4ac902e208dd2e63b1f2%7c82815b8c3775459997c72b87528e6f83%7c0%7c0%7c638717736975367538%7cbad%7ctwfpbgzsb3d8eyjfbxb0eu1hcgkionrydwusilyioiiwljaumdawmcisilaioijxaw4zmiisikfoijoitwfpbcisilduijoylcjbuci6eyjgswqioiixotm5njuilcjgtgjsijoivvnfmzqyx0nvbnrlbnqilcjhzw8ioijoqu0ilcjszxfjzci6ijfkzty3ngexltgwmwytnzawmc02zmuzltq4otdky2rhnwjmmyisik1jzci6ijc3otgzmjqilcjntmftzsi6ilvtuje5mzk2ns04mjuilcjdbgllbnrjuci6ijgundyumtizlje4osisiknsawvudc1bz2vudci6ik1vemlsbgevns4wichxaw5kb3dzie5uidewlja7ifdpbjy0oyb4njqpiefwcgxlv2vis2l0lzuzny4zniaos0hutuwsigxpa2ugr2vja28pienocm9tzs8xmtcumc4wljagu2fmyxjplzuzny4zniisiknjrc1pcmlnaw4ioijtue8ifx0%3d%7c1%7cmmm2mtzjn2qtogu2zs00ywm5ltayztitmdhkzdjlnjnimwyy%7c06f65864f902416df44308dd2e65d01e%7c1ee674a1d03770006fe34e327d4fff52&sdata=ozlsvuaxqattthanlrg6c64pyd19zpyctj33ganf0xk%3d&reserved=0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: hacdct-my.sharepoint.com to https://login.microsoftonline.com:443/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5fid=00000003%2d0000%2d0ff1%2dce00%2d000000000000&response%5fmode=form%5fpost&response%5ftype=code%20id%5ftoken&resource=00000003%2d0000%2d0ff1%2dce00%2d000000000000&scope=openid&nonce=ce498209b61e19695f27f9da9a80e07e1573228e8ff8eb1d%2d96776df5b27fc7eddc47ddcd3cab3d42f8bae950ee382d88150897a0dd266cfa&redirect%5furi=https%3a%2f%2fhacdct%2dmy%2esharepoint%2ecom%2f%5fforms%2fdefault%2easpx&state=od0w&claims=%7b%22id%5ftoken%22%3a%7b%22xms%5fcc%22%3a%7b%22values%22%3a%5b%22cp1%22%5d%7d%7d%7d&wsucxt=1&cobrandid=11bd8083%2d87e0%2d41b5%2dbb78%2d0bc43c8a8e8a&client%2drequest%2did=2ae674a1%2d30c9%2d7000%2d6fe3%2d423284321c14
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: hacdct-my.sharepoint.com to https://login.microsoftonline.com:443/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5fid=00000003%2d0000%2d0ff1%2dce00%2d000000000000&response%5fmode=form%5fpost&response%5ftype=code%20id%5ftoken&resource=00000003%2d0000%2d0ff1%2dce00%2d000000000000&scope=openid&nonce=a1bb4389de3528713c3c41549f700ad7deea131e539d86e8%2da22fe3fb9a7f23e7d4725c95f3e4821ba4076bb89a680d2540fd144b2eeea234&redirect%5furi=https%3a%2f%2fhacdct%2dmy%2esharepoint%2ecom%2f%5fforms%2fdefault%2easpx&state=od0w&claims=%7b%22id%5ftoken%22%3a%7b%22xms%5fcc%22%3a%7b%22values%22%3a%5b%22cp1%22%5d%7d%7d%7d&wsucxt=1&cobrandid=11bd8083%2d87e0%2d41b5%2dbb78%2d0bc43c8a8e8a&client%2drequest%2did=2de674a1%2d00ec%2d7000%2d6fe3%2d43062a43c75b
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: hacdct-my.sharepoint.com to https://login.microsoftonline.com:443/e8146f2d-21bb-416b-8cc0-b65cc07621de/oauth2/authorize?client%5fid=00000003%2d0000%2d0ff1%2dce00%2d000000000000&response%5fmode=form%5fpost&response%5ftype=code%20id%5ftoken&resource=00000003%2d0000%2d0ff1%2dce00%2d000000000000&scope=openid&nonce=6bf4f0595f48d92f641de3cbff0738e298d2303f897bfe45%2d75f8d0d0b564414b463fb1bc9c9712d7e46301c8a4fc8753ae2bd78be77c0c30&redirect%5furi=https%3a%2f%2fhacdct%2dmy%2esharepoint%2ecom%2f%5fforms%2fdefault%2easpx&state=od0w&claims=%7b%22id%5ftoken%22%3a%7b%22xms%5fcc%22%3a%7b%22values%22%3a%5b%22cp1%22%5d%7d%7d%7d&wsucxt=1&cobrandid=11bd8083%2d87e0%2d41b5%2dbb78%2d0bc43c8a8e8a&client%2drequest%2did=33e674a1%2de0bf%2d7000%2d6fe3%2d474fbe5bd773

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USF&xsdata=MDV8MDJ8am1ja2lubGV5QGhhaWdyb3VwLmNvbXwyYzYxNmM3ZDhlNmU0YWM5MDJlMjA4ZGQyZTYzYjFmMnw4MjgxNWI4YzM3NzU0NTk5OTdjNzJiODc1MjhlNmY4M3wwfDB8NjM4NzE3NzMyNjY3MjIxNDQzfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXw0MDAwfHx8&sdata=bXM5KzduUjdVc3RFaFJsU1ZBR1d1enMxT3I3VitIdmc4MUlhZ25WT3dmWT0%3d HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?url=https%3A%2F%2Fhacdct-my.sharepoint.com%2F%3Af%3A%2Fg%2Fpersonal%2Fdmarra_hacdct_org%2FEl0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ%3Femail%3Ddhodder%2540haigroup.com%26e%3Dd37USF&data=05%7C02%7Cjmckinley%40haigroup.com%7C2c616c7d8e6e4ac902e208dd2e63b1f2%7C82815b8c3775459997c72b87528e6f83%7C0%7C0%7C638717736975367538%7CBad%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyLCJBUCI6eyJGSWQiOiIxOTM5NjUiLCJGTGJsIjoiVVNfMzQyX0NvbnRlbnQiLCJHZW8iOiJOQU0iLCJSZXFJZCI6IjFkZTY3NGExLTgwMWYtNzAwMC02ZmUzLTQ4OTdkY2RhNWJmMyIsIk1JZCI6Ijc3OTgzMjQiLCJNTmFtZSI6IlVTUjE5Mzk2NS04MjUiLCJDbGllbnRJUCI6IjguNDYuMTIzLjE4OSIsIkNsaWVudC1BZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTcuMC4wLjAgU2FmYXJpLzUzNy4zNiIsIkNJRC1PcmlnaW4iOiJTUE8ifX0%3D%7C1%7CMmM2MTZjN2QtOGU2ZS00YWM5LTAyZTItMDhkZDJlNjNiMWYy%7C06f65864f902416df44308dd2e65d01e%7C1ee674a1d03770006fe34e327d4fff52&sdata=OzlsVuaXqAtTthAnLRG6c64PYd19zpYCTJ33GAnF0xk%3D&reserved=0 HTTP/1.1Host: nam12.safelinks.protection.outlook.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/Scripts/safelinksv2.css HTTP/1.1Host: nam12.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhacdct-my.sharepoint.com%2F%3Af%3A%2Fg%2Fpersonal%2Fdmarra_hacdct_org%2FEl0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ%3Femail%3Ddhodder%2540haigroup.com%26e%3Dd37USF&data=05%7C02%7Cjmckinley%40haigroup.com%7C2c616c7d8e6e4ac902e208dd2e63b1f2%7C82815b8c3775459997c72b87528e6f83%7C0%7C0%7C638717736975367538%7CBad%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyLCJBUCI6eyJGSWQiOiIxOTM5NjUiLCJGTGJsIjoiVVNfMzQyX0NvbnRlbnQiLCJHZW8iOiJOQU0iLCJSZXFJZCI6IjFkZTY3NGExLTgwMWYtNzAwMC02ZmUzLTQ4OTdkY2RhNWJmMyIsIk1JZCI6Ijc3OTgzMjQiLCJNTmFtZSI6IlVTUjE5Mzk2NS04MjUiLCJDbGllbnRJUCI6IjguNDYuMTIzLjE4OSIsIkNsaWVudC1BZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTcuMC4wLjAgU2FmYXJpLzUzNy4zNiIsIkNJRC1PcmlnaW4iOiJTUE8ifX0%3D%7C1%7CMmM2MTZjN2QtOGU2ZS00YWM5LTAyZTItMDhkZDJlNjNiMWYy%7C06f65864f902416df44308dd2e65d01e%7C1ee674a1d03770006fe34e327d4fff52&sdata=OzlsVuaXqAtTthAnLRG6c64PYd19zpYCTJ33GAnF0xk%3D&reserved=0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/Scripts/site.js HTTP/1.1Host: nam12.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhacdct-my.sharepoint.com%2F%3Af%3A%2Fg%2Fpersonal%2Fdmarra_hacdct_org%2FEl0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ%3Femail%3Ddhodder%2540haigroup.com%26e%3Dd37USF&data=05%7C02%7Cjmckinley%40haigroup.com%7C2c616c7d8e6e4ac902e208dd2e63b1f2%7C82815b8c3775459997c72b87528e6f83%7C0%7C0%7C638717736975367538%7CBad%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyLCJBUCI6eyJGSWQiOiIxOTM5NjUiLCJGTGJsIjoiVVNfMzQyX0NvbnRlbnQiLCJHZW8iOiJOQU0iLCJSZXFJZCI6IjFkZTY3NGExLTgwMWYtNzAwMC02ZmUzLTQ4OTdkY2RhNWJmMyIsIk1JZCI6Ijc3OTgzMjQiLCJNTmFtZSI6IlVTUjE5Mzk2NS04MjUiLCJDbGllbnRJUCI6IjguNDYuMTIzLjE4OSIsIkNsaWVudC1BZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTcuMC4wLjAgU2FmYXJpLzUzNy4zNiIsIkNJRC1PcmlnaW4iOiJTUE8ifX0%3D%7C1%7CMmM2MTZjN2QtOGU2ZS00YWM5LTAyZTItMDhkZDJlNjNiMWYy%7C06f65864f902416df44308dd2e65d01e%7C1ee674a1d03770006fe34e327d4fff52&sdata=OzlsVuaXqAtTthAnLRG6c64PYd19zpYCTJ33GAnF0xk%3D&reserved=0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/images/cross.png HTTP/1.1Host: nam12.safelinks.protection.outlook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhacdct-my.sharepoint.com%2F%3Af%3A%2Fg%2Fpersonal%2Fdmarra_hacdct_org%2FEl0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ%3Femail%3Ddhodder%2540haigroup.com%26e%3Dd37USF&data=05%7C02%7Cjmckinley%40haigroup.com%7C2c616c7d8e6e4ac902e208dd2e63b1f2%7C82815b8c3775459997c72b87528e6f83%7C0%7C0%7C638717736975367538%7CBad%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyLCJBUCI6eyJGSWQiOiIxOTM5NjUiLCJGTGJsIjoiVVNfMzQyX0NvbnRlbnQiLCJHZW8iOiJOQU0iLCJSZXFJZCI6IjFkZTY3NGExLTgwMWYtNzAwMC02ZmUzLTQ4OTdkY2RhNWJmMyIsIk1JZCI6Ijc3OTgzMjQiLCJNTmFtZSI6IlVTUjE5Mzk2NS04MjUiLCJDbGllbnRJUCI6IjguNDYuMTIzLjE4OSIsIkNsaWVudC1BZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTcuMC4wLjAgU2FmYXJpLzUzNy4zNiIsIkNJRC1PcmlnaW4iOiJTUE8ifX0%3D%7C1%7CMmM2MTZjN2QtOGU2ZS00YWM5LTAyZTItMDhkZDJlNjNiMWYy%7C06f65864f902416df44308dd2e65d01e%7C1ee674a1d03770006fe34e327d4fff52&sdata=OzlsVuaXqAtTthAnLRG6c64PYd19zpYCTJ33GAnF0xk%3D&reserved=0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/Scripts/site.js HTTP/1.1Host: nam12.safelinks.protection.outlook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Content/images/cross.png HTTP/1.1Host: nam12.safelinks.protection.outlook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USF HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/corev15.css?rev=QLDOqSwkd19yHhmt%2FbZqew%3D%3DTAG207 HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG207 HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=irTpeHjlWhMwlZFvOx98j_PUzKSSbaCLqqDL3FO-7cV2is1Rv-3XzXD_mBsy8iK-7FuEsYadnWEoK8_oZfd9fkRcJHJygM2m__cZdz5kyo4DO41jdHcBIOx0Z0Su8ECCu39hnqYMzbsjmMUFJFFV2PARDxQxs-XTmnELO5paEYyi_9eSSVBf5A53KlHSvnT90&t=ffffffffb201fd3f HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=0off-CLTQ84sjZWk39VCZYYSQeOt44LYAW7tpn1fQgAuJzUBqr33dtu5WnTNNFNHqFT0qOdQj2_Sy9k9UhCUIfi_XxCH_EED1yXuO8jSDITwlAzGbK50NqeT5dlpw18Tl--9LTMiE8svd_7V1GV3yIqCs8GOLb0D9kMQTRauU1AE4EMyt8Mr5D8v4t-dQ6ZR0&t=ffffffffb201fd3f HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=ejbUQQyql_QjK-oDw4SJFeWlztRvB3LSY6nFJDyeZrU4IwMyj_Uyoy_JXGOg6Dcajmipj7HoRJiElw8RnW_9I6QIdeG8iYFRBowZmmVp_yY1&t=638661570537377670 HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=0off-CLTQ84sjZWk39VCZYYSQeOt44LYAW7tpn1fQgAuJzUBqr33dtu5WnTNNFNHqFT0qOdQj2_Sy9k9UhCUIfi_XxCH_EED1yXuO8jSDITwlAzGbK50NqeT5dlpw18Tl--9LTMiE8svd_7V1GV3yIqCs8GOLb0D9kMQTRauU1AE4EMyt8Mr5D8v4t-dQ6ZR0&t=ffffffffb201fd3f HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=irTpeHjlWhMwlZFvOx98j_PUzKSSbaCLqqDL3FO-7cV2is1Rv-3XzXD_mBsy8iK-7FuEsYadnWEoK8_oZfd9fkRcJHJygM2m__cZdz5kyo4DO41jdHcBIOx0Z0Su8ECCu39hnqYMzbsjmMUFJFFV2PARDxQxs-XTmnELO5paEYyi_9eSSVBf5A53KlHSvnT90&t=ffffffffb201fd3f HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=ejbUQQyql_QjK-oDw4SJFeWlztRvB3LSY6nFJDyeZrU4IwMyj_Uyoy_JXGOg6Dcajmipj7HoRJiElw8RnW_9I6QIdeG8iYFRBowZmmVp_yY1&t=638661570537377670 HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/dmarra_hacdct_org/_layouts/15/help.aspx?Lcid=1033&Key=WSSEndUser_troubleshooting&ShowNav=true HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false
Source: global traffic	HTTP traffic detected: GET /personal/dmarra_hacdct_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fdmarra%5Fhacdct%5Forg%2F%5Flayouts%2F15%2Fhelp%2Easpx%3FLcid%3D1033%26Key%3DWSSEndUser%5Ftroubleshooting%26ShowNav%3Dtrue HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false
Source: global traffic	HTTP traffic detected: GET /_forms/default.aspx?ReturnUrl=%2fpersonal%2fdmarra_hacdct_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fdmarra%255Fhacdct%255Forg%252F%255Flayouts%252F15%252Fhelp%252Easpx%253FLcid%253D1033%2526Key%253DWSSEndUser%255Ftroubleshooting%2526ShowNav%253Dtrue&Source=cookie HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false; RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGaGVscCUyRWFzcHglM0ZMY2lkJTNEMTAzMyUyNktleSUzRFdTU0VuZFVzZXIlNUZ0cm91Ymxlc2hvb3RpbmclMjZTaG93TmF2JTNEdHJ1ZQ==
Source: global traffic	HTTP traffic detected: GET /personal/dmarra_hacdct_org HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false; nSGt-CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D=gYEwNUY4N0VCNjEyMEU2MUJBQjQ2NzVBMjdCNTVENDEyQzREREYzNEQ0MDA2NjE2OUMwMENFNDk4MjA5QjYxRTE5Njk1RjI3RjlEQTlBODBFMDdFMTU3MzIyOEU4RkY4RUIxRBIxMzM4MDY1MDc4ODM4NzE0MzMYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tH+bDSiW8NMu02y5WzbfcoqUZ7Dsow8DOb2bRHYtjbWa6XRH6Pqp2AvxjdbM1UOi3yHw9BN0FrkGwe0OmtSYzwv3gtX2QYX2BcdlxRicdCPcvdvGYpc9EUfuCFyPQRAA6I4eghqiefFVeLJb6I8Jye8YY0lbDLgB/zXDwtKeWrSb2P9n/6l/j8kwgrZ+CcIAMlvfXepThaMlTnp8G424YYaIDJppw/BSTxnBCEK4BuEt6buRPY6KnGd0ejYoBQEMBMiG44OSgMSH/Wkifm4GQMd0AkQ8RXHctP1mLWvz9JmjkkcE7eDqrxRIki5JDg39OGeBZgiJI3qRYtNNh82lH25AAAAA=; RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGaGVscCUyRWFzcHglM0ZMY2lkJTNEMTAzMyUyNktleSUzRFdTU0VuZFVzZXIlNUZ0cm91Ymxlc2hvb3RpbmclMjZTaG93TmF2JTNEdHJ1ZSZQcmV2aW91c1JlcXVlc3RDb3JyZWxhdGlvbklkPTJhZTY3NGExJTJEMzBjOSUyRDcwMDAlMkQ2ZmUzJTJENDIzMjg0MzIxYzE0JlJldHVyblVybD0lMkZwZXJzb25hbCUyRmRtYXJyYSU1RmhhY2RjdCU1Rm9yZyUyRiU1RmxheW91dHMlMkYxNSUyRkF1dGhlbnRpY2F0ZSUyRWFzcHglM0ZTb3VyY2UlM0QlMjUyRnBlcnNvbmFsJTI1MkZkbWFycmElMjU1RmhhY2RjdCUyNTVGb3JnJTI1MkYlMjU1RmxheW91dHMlMjUyRjE1JTI1MkZoZWxwJTI1MkVhc3B4JTI1M0ZMY2lkJTI1M0QxMDMzJTI1MjZLZXklMjUzRFdTU0VuZFVzZXIlMjU1RnRyb3VibGVzaG9vdGluZyUyNTI2U2hvd05hdiUyNTNEdHJ1ZQ==
Source: global traffic	HTTP traffic detected: GET /personal/dmarra_hacdct_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fdmarra%5Fhacdct%5Forg HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false; nSGt-CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D=gYEwNUY4N0VCNjEyMEU2MUJBQjQ2NzVBMjdCNTVENDEyQzREREYzNEQ0MDA2NjE2OUMwMENFNDk4MjA5QjYxRTE5Njk1RjI3RjlEQTlBODBFMDdFMTU3MzIyOEU4RkY4RUIxRBIxMzM4MDY1MDc4ODM4NzE0MzMYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tH+bDSiW8NMu02y5WzbfcoqUZ7Dsow8DOb2bRHYtjbWa6XRH6Pqp2AvxjdbM1UOi3yHw9BN0FrkGwe0OmtSYzwv3gtX2QYX2BcdlxRicdCPcvdvGYpc9EUfuCFyPQRAA6I4eghqiefFVeLJb6I8Jye8YY0lbDLgB/zXDwtKeWrSb2P9n/6l/j8kwgrZ+CcIAMlvfXepThaMlTnp8G424YYaIDJppw/BSTxnBCEK4BuEt6buRPY6KnGd0ejYoBQEMBMiG44OSgMSH/Wkifm4GQMd0AkQ8RXHctP1mLWvz9JmjkkcE7eDqrxRIki5JDg39OGeBZgiJI3qRYtNNh82lH25AAAAA=; RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGaGVscCUyRWFzcHglM0ZMY2lkJTNEMTAzMyUyNktleSUzRFdTU0VuZFVzZXIlNUZ0cm91Ymxlc2hvb3RpbmclMjZTaG93TmF2JTNEdHJ1ZSZQcmV2aW91c1JlcXVlc3RDb3JyZWxhdGlvbklkPTJhZTY3NGExJTJEMzBjOSUyRDcwMDAlMkQ2ZmUzJTJENDIzMjg0MzIxYzE0JlJldHVyblVybD0lMkZwZXJzb25hbCUyRmRtYXJyYSU1RmhhY2RjdCU1Rm9yZyUyRiU1RmxheW91dHMlMkYxNSUyRkF1dGhlbnRpY2F0ZSUyRWFzcHglM0ZTb3VyY2UlM0QlMjUyRnBlcnNvbmFsJTI1MkZkbWFycmElMjU1RmhhY2RjdCUyNTVGb3JnJTI1MkYlMjU1RmxheW91dHMlMjUyRjE1JTI1MkZoZWxwJTI1MkVhc3B4JTI1M0ZMY2lkJTI1M0QxMDMzJTI1MjZLZXklMjUzRFdTU0VuZFVzZXIlMjU1RnRyb3VibGVzaG9vdGluZyUyNTI2U2hvd05hdiUyNTNEdHJ1ZQ==
Source: global traffic	HTTP traffic detected: GET /_forms/default.aspx?ReturnUrl=%2fpersonal%2fdmarra_hacdct_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fdmarra%255Fhacdct%255Forg&Source=cookie HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false; nSGt-CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D=gYEwNUY4N0VCNjEyMEU2MUJBQjQ2NzVBMjdCNTVENDEyQzREREYzNEQ0MDA2NjE2OUMwMENFNDk4MjA5QjYxRTE5Njk1RjI3RjlEQTlBODBFMDdFMTU3MzIyOEU4RkY4RUIxRBIxMzM4MDY1MDc4ODM4NzE0MzMYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tH+bDSiW8NMu02y5WzbfcoqUZ7Dsow8DOb2bRHYtjbWa6XRH6Pqp2AvxjdbM1UOi3yHw9BN0FrkGwe0OmtSYzwv3gtX2QYX2BcdlxRicdCPcvdvGYpc9EUfuCFyPQRAA6I4eghqiefFVeLJb6I8Jye8YY0lbDLgB/zXDwtKeWrSb2P9n/6l/j8kwgrZ+CcIAMlvfXepThaMlTnp8G424YYaIDJppw/BSTxnBCEK4BuEt6buRPY6KnGd0ejYoBQEMBMiG44OSgMSH/Wkifm4GQMd0AkQ8RXHctP1mLWvz9JmjkkcE7eDqrxRIki5JDg39OGeBZgiJI3qRYtNNh82lH25AAAAA=; RpsContextCookie=UmV0dXJuVXJsPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGQXV0aGVudGljYXRlJTJFYXNweCUzRlNvdXJjZSUzRCUyNTJGcGVyc29uYWwlMjUyRmRtYXJyYSUyNTVGaGFjZGN0JTI1NUZvcmclMjUyRiUyNTVGbGF5b3V0cyUyNTJGMTUlMjUyRmhlbHAlMjUyRWFzcHglMjUzRkxjaWQlMjUzRDEwMzMlMjUyNktleSUyNTNEV1NTRW5kVXNlciUyNTVGdHJvdWJsZXNob290aW5nJTI1MjZTaG93TmF2JTI1M0R0cnVlJlNvdXJjZT0lMkZwZXJzb25hbCUyRmRtYXJyYSU1RmhhY2RjdCU1Rm9yZw==
Source: global traffic	HTTP traffic detected: GET /:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USF HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false; nSGt-CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D=gYEwNUY4N0VCNjEyMEU2MUJBQjQ2NzVBMjdCNTVENDEyQzREREYzNEQ0MDA2NjE2OUMwMENFNDk4MjA5QjYxRTE5Njk1RjI3RjlEQTlBODBFMDdFMTU3MzIyOEU4RkY4RUIxRBIxMzM4MDY1MDc4ODM4NzE0MzMYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tH+bDSiW8NMu02y5WzbfcoqUZ7Dsow8DOb2bRHYtjbWa6XRH6Pqp2AvxjdbM1UOi3yHw9BN0FrkGwe0OmtSYzwv3gtX2QYX2BcdlxRicdCPcvdvGYpc9EUfuCFyPQRAA6I4eghqiefFVeLJb6I8Jye8YY0lbDLgB/zXDwtKeWrSb2P9n/6l/j8kwgrZ+CcIAMlvfXepThaMlTnp8G424YYaIDJppw/BSTxnBCEK4BuEt6buRPY6KnGd0ejYoBQEMBMiG44OSgMSH/Wkifm4GQMd0AkQ8RXHctP1mLWvz9JmjkkcE7eDqrxRIki5JDg39OGeBZgiJI3qRYtNNh82lH25AAAAA=; nSGt-A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8=gYEwMDUwMjNGNzFDOUNGRjEzNkM2RjBBOEY1M0UzNENFNDk0M0Q0N0MzRjY5MzlDMjdBMEExQkI0Mzg5REUzNTI4NzEzQzNDNDE1NDlGNzAwQUQ3REVFQTEzMUU1MzlEODZFOBIxMzM4MDY1MDgwMTIzMTcwOTgYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tjbsFcU+C983ELMnrcPtDsd6omtrY+LUrr44T9KLDmyMMwCublROquio4cLkKq1M3b2BD2ztv2IZN8tAL8DiYrwGCfqfXG+AQJfOegx6hYIjzvA5Qhh/VAYtUbKOYYL3zLU4e6NKyzI/b0Nu0K4jHDMKDwObNzAIU+VxltfEte0mhNSGK7dKOto1MdD/DLUJ55MjxcIZ0l4+/q6p+SQqMCADEO3mT4w0IZMAJcv/E7nRuqk6F2jY0qMdDBufS4gFs+WnJsbN7Aoj7UvXijObDUaUQkaaHPtlRhc25Z2yF8Fm2XLrzD8oMVJnhn2fLkQmCq5p18LBZCbc3KQapVBLDcZAAAAA=; RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJlByZXZpb3VzUmVxdWVzdENvcnJlbGF0aW9uSWQ9MmRlNjc0YTElMkQwMGVjJTJENzAwMCUyRDZmZTMlMkQ0MzA2MmE0M2M3NWImUmV0dXJuVXJsPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGQXV0aGVudGljYXRlJTJFYXNweCUzRlNvdXJjZSUzRCUyNTJGcGVyc29uYWwlMjUyRmRtYXJyYSUyNTVGaGFjZGN0JTI1NUZvcmc=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/corev15.css?rev=QLDOqSwkd19yHhmt%2FbZqew%3D%3DTAG207 HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false; nSGt-CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D=gYEwNUY4N0VCNjEyMEU2MUJBQjQ2NzVBMjdCNTVENDEyQzREREYzNEQ0MDA2NjE2OUMwMENFNDk4MjA5QjYxRTE5Njk1RjI3RjlEQTlBODBFMDdFMTU3MzIyOEU4RkY4RUIxRBIxMzM4MDY1MDc4ODM4NzE0MzMYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tH+bDSiW8NMu02y5WzbfcoqUZ7Dsow8DOb2bRHYtjbWa6XRH6Pqp2AvxjdbM1UOi3yHw9BN0FrkGwe0OmtSYzwv3gtX2QYX2BcdlxRicdCPcvdvGYpc9EUfuCFyPQRAA6I4eghqiefFVeLJb6I8Jye8YY0lbDLgB/zXDwtKeWrSb2P9n/6l/j8kwgrZ+CcIAMlvfXepThaMlTnp8G424YYaIDJppw/BSTxnBCEK4BuEt6buRPY6KnGd0ejYoBQEMBMiG44OSgMSH/Wkifm4GQMd0AkQ8RXHctP1mLWvz9JmjkkcE7eDqrxRIki5JDg39OGeBZgiJI3qRYtNNh82lH25AAAAA=; nSGt-A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8=gYEwMDUwMjNGNzFDOUNGRjEzNkM2RjBBOEY1M0UzNENFNDk0M0Q0N0MzRjY5MzlDMjdBMEExQkI0Mzg5REUzNTI4NzEzQzNDNDE1NDlGNzAwQUQ3REVFQTEzMUU1MzlEODZFOBIxMzM4MDY1MDgwMTIzMTcwOTgYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tjbsFcU+C983ELMnrcPtDsd6omtrY+LUrr44T9KLDmyMMwCublROquio4cLkKq1M3b2BD2ztv2IZN8tAL8DiYrwGCfqfXG+AQJfOegx6hYIjzvA5Qhh/VAYtUbKOYYL3zLU4e6NKyzI/b0Nu0K4jHDMKDwObNzAIU+VxltfEte0mhNSGK7dKOto1MdD/DLUJ55MjxcIZ0l4+/q6p+SQqMCADEO3mT4w0IZMAJcv/E7nRuqk6F2jY0qMdDBufS4gFs+WnJsbN7Aoj7UvXijObDUaUQkaaHPtlRhc25Z2yF8Fm2XLrzD8oMVJnhn2fLkQmCq5p18LBZCbc3KQapVBLDcZAAAAA=; RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJlByZXZpb3VzUmVxdWVzdENvcnJlbGF0aW9uSWQ9MmRlNjc0YTElMkQwMGVjJTJENzAwMCUyRDZmZTMlMkQ0MzA2MmE0M2M3NWImUmV0dXJuVXJsPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGQXV0aGVudGljYXRlJTJFYXNweCUzRlNvdXJjZSUzRCUyNTJGcGVyc29uYWwlMjUyRmRtYXJyYSUyNTVGaGFjZGN0JTI1NUZvcmc=Range: bytes=294299-294299If-Range: "40b0eefbcd51db1:0"
Source: global traffic	HTTP traffic detected: GET /_layouts/15/1033/styles/corev15.css?rev=QLDOqSwkd19yHhmt%2FbZqew%3D%3DTAG207 HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false; nSGt-CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D=gYEwNUY4N0VCNjEyMEU2MUJBQjQ2NzVBMjdCNTVENDEyQzREREYzNEQ0MDA2NjE2OUMwMENFNDk4MjA5QjYxRTE5Njk1RjI3RjlEQTlBODBFMDdFMTU3MzIyOEU4RkY4RUIxRBIxMzM4MDY1MDc4ODM4NzE0MzMYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tH+bDSiW8NMu02y5WzbfcoqUZ7Dsow8DOb2bRHYtjbWa6XRH6Pqp2AvxjdbM1UOi3yHw9BN0FrkGwe0OmtSYzwv3gtX2QYX2BcdlxRicdCPcvdvGYpc9EUfuCFyPQRAA6I4eghqiefFVeLJb6I8Jye8YY0lbDLgB/zXDwtKeWrSb2P9n/6l/j8kwgrZ+CcIAMlvfXepThaMlTnp8G424YYaIDJppw/BSTxnBCEK4BuEt6buRPY6KnGd0ejYoBQEMBMiG44OSgMSH/Wkifm4GQMd0AkQ8RXHctP1mLWvz9JmjkkcE7eDqrxRIki5JDg39OGeBZgiJI3qRYtNNh82lH25AAAAA=; nSGt-A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8=gYEwMDUwMjNGNzFDOUNGRjEzNkM2RjBBOEY1M0UzNENFNDk0M0Q0N0MzRjY5MzlDMjdBMEExQkI0Mzg5REUzNTI4NzEzQzNDNDE1NDlGNzAwQUQ3REVFQTEzMUU1MzlEODZFOBIxMzM4MDY1MDgwMTIzMTcwOTgYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tjbsFcU+C983ELMnrcPtDsd6omtrY+LUrr44T9KLDmyMMwCublROquio4cLkKq1M3b2BD2ztv2IZN8tAL8DiYrwGCfqfXG+AQJfOegx6hYIjzvA5Qhh/VAYtUbKOYYL3zLU4e6NKyzI/b0Nu0K4jHDMKDwObNzAIU+VxltfEte0mhNSGK7dKOto1MdD/DLUJ55MjxcIZ0l4+/q6p+SQqMCADEO3mT4w0IZMAJcv/E7nRuqk6F2jY0qMdDBufS4gFs+WnJsbN7Aoj7UvXijObDUaUQkaaHPtlRhc25Z2yF8Fm2XLrzD8oMVJnhn2fLkQmCq5p18LBZCbc3KQapVBLDcZAAAAA=; RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJlByZXZpb3VzUmVxdWVzdENvcnJlbGF0aW9uSWQ9MmRlNjc0YTElMkQwMGVjJTJENzAwMCUyRDZmZTMlMkQ0MzA2MmE0M2M3NWImUmV0dXJuVXJsPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGQXV0aGVudGljYXRlJTJFYXNweCUzRlNvdXJjZSUzRCUyNTJGcGVyc29uYWwlMjUyRmRtYXJyYSUyNTVGaGFjZGN0JTI1NUZvcmc=Range: bytes=294299-341639If-Range: "40b0eefbcd51db1:0"
Source: global traffic	HTTP traffic detected: GET /personal/dmarra_hacdct_org/_layouts/15/help.aspx?Lcid=1033&Key=WSSEndUser_troubleshooting&ShowNav=true HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false; nSGt-CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D=gYEwNUY4N0VCNjEyMEU2MUJBQjQ2NzVBMjdCNTVENDEyQzREREYzNEQ0MDA2NjE2OUMwMENFNDk4MjA5QjYxRTE5Njk1RjI3RjlEQTlBODBFMDdFMTU3MzIyOEU4RkY4RUIxRBIxMzM4MDY1MDc4ODM4NzE0MzMYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tH+bDSiW8NMu02y5WzbfcoqUZ7Dsow8DOb2bRHYtjbWa6XRH6Pqp2AvxjdbM1UOi3yHw9BN0FrkGwe0OmtSYzwv3gtX2QYX2BcdlxRicdCPcvdvGYpc9EUfuCFyPQRAA6I4eghqiefFVeLJb6I8Jye8YY0lbDLgB/zXDwtKeWrSb2P9n/6l/j8kwgrZ+CcIAMlvfXepThaMlTnp8G424YYaIDJppw/BSTxnBCEK4BuEt6buRPY6KnGd0ejYoBQEMBMiG44OSgMSH/Wkifm4GQMd0AkQ8RXHctP1mLWvz9JmjkkcE7eDqrxRIki5JDg39OGeBZgiJI3qRYtNNh82lH25AAAAA=; nSGt-A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8=gYEwMDUwMjNGNzFDOUNGRjEzNkM2RjBBOEY1M0UzNENFNDk0M0Q0N0MzRjY5MzlDMjdBMEExQkI0Mzg5REUzNTI4NzEzQzNDNDE1NDlGNzAwQUQ3REVFQTEzMUU1MzlEODZFOBIxMzM4MDY1MDgwMTIzMTcwOTgYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tjbsFcU+C983ELMnrcPtDsd6omtrY+LUrr44T9KLDmyMMwCublROquio4cLkKq1M3b2BD2ztv2IZN8tAL8DiYrwGCfqfXG+AQJfOegx6hYIjzvA5Qhh/VAYtUbKOYYL3zLU4e6NKyzI/b0Nu0K4jHDMKDwObNzAIU+VxltfEte0mhNSGK7dKOto1MdD/DLUJ55MjxcIZ0l4+/q6p+SQqMCADEO3mT4w0IZMAJcv/E7nRuqk6F2jY0qMdDBufS4gFs+WnJsbN7Aoj7UvXijObDUaUQkaaHPtlRhc25Z2yF8Fm2XLrzD8oMVJnhn2fLkQmCq5p18LBZCbc3KQapVBLDcZAAAAA=; RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJlByZXZpb3VzUmVxdWVzdENvcnJlbGF0aW9uSWQ9MmRlNjc0YTElMkQwMGVjJTJENzAwMCUyRDZmZTMlMkQ0MzA2MmE0M2M3NWImUmV0dXJuVXJsPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGQXV0aGVudGljYXRlJTJFYXNweCUzRlNvdXJjZSUzRCUyNTJGcGVyc29uYWwlMjUyRmRtYXJyYSUyNTVGaGFjZGN0JTI1NUZvcmc=
Source: global traffic	HTTP traffic detected: GET /personal/dmarra_hacdct_org/_layouts/15/Authenticate.aspx?Source=%2Fpersonal%2Fdmarra%5Fhacdct%5Forg%2F%5Flayouts%2F15%2Fhelp%2Easpx%3FLcid%3D1033%26Key%3DWSSEndUser%5Ftroubleshooting%26ShowNav%3Dtrue HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false; nSGt-CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D=gYEwNUY4N0VCNjEyMEU2MUJBQjQ2NzVBMjdCNTVENDEyQzREREYzNEQ0MDA2NjE2OUMwMENFNDk4MjA5QjYxRTE5Njk1RjI3RjlEQTlBODBFMDdFMTU3MzIyOEU4RkY4RUIxRBIxMzM4MDY1MDc4ODM4NzE0MzMYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tH+bDSiW8NMu02y5WzbfcoqUZ7Dsow8DOb2bRHYtjbWa6XRH6Pqp2AvxjdbM1UOi3yHw9BN0FrkGwe0OmtSYzwv3gtX2QYX2BcdlxRicdCPcvdvGYpc9EUfuCFyPQRAA6I4eghqiefFVeLJb6I8Jye8YY0lbDLgB/zXDwtKeWrSb2P9n/6l/j8kwgrZ+CcIAMlvfXepThaMlTnp8G424YYaIDJppw/BSTxnBCEK4BuEt6buRPY6KnGd0ejYoBQEMBMiG44OSgMSH/Wkifm4GQMd0AkQ8RXHctP1mLWvz9JmjkkcE7eDqrxRIki5JDg39OGeBZgiJI3qRYtNNh82lH25AAAAA=; nSGt-A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8=gYEwMDUwMjNGNzFDOUNGRjEzNkM2RjBBOEY1M0UzNENFNDk0M0Q0N0MzRjY5MzlDMjdBMEExQkI0Mzg5REUzNTI4NzEzQzNDNDE1NDlGNzAwQUQ3REVFQTEzMUU1MzlEODZFOBIxMzM4MDY1MDgwMTIzMTcwOTgYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tjbsFcU+C983ELMnrcPtDsd6omtrY+LUrr44T9KLDmyMMwCublROquio4cLkKq1M3b2BD2ztv2IZN8tAL8DiYrwGCfqfXG+AQJfOegx6hYIjzvA5Qhh/VAYtUbKOYYL3zLU4e6NKyzI/b0Nu0K4jHDMKDwObNzAIU+VxltfEte0mhNSGK7dKOto1MdD/DLUJ55MjxcIZ0l4+/q6p+SQqMCADEO3mT4w0IZMAJcv/E7nRuqk6F2jY0qMdDBufS4gFs+WnJsbN7Aoj7UvXijObDUaUQkaaHPtlRhc25Z2yF8Fm2XLrzD8oMVJnhn2fLkQmCq5p18LBZCbc3KQapVBLDcZAAAAA=; RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJlByZXZpb3VzUmVxdWVzdENvcnJlbGF0aW9uSWQ9MmRlNjc0YTElMkQwMGVjJTJENzAwMCUyRDZmZTMlMkQ0MzA2MmE0M2M3NWImUmV0dXJuVXJsPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGQXV0aGVudGljYXRlJTJFYXNweCUzRlNvdXJjZSUzRCUyNTJGcGVyc29uYWwlMjUyRmRtYXJyYSUyNTVGaGFjZGN0JTI1NUZvcmc=
Source: global traffic	HTTP traffic detected: GET /_forms/default.aspx?ReturnUrl=%2fpersonal%2fdmarra_hacdct_org%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252Fpersonal%252Fdmarra%255Fhacdct%255Forg%252F%255Flayouts%252F15%252Fhelp%252Easpx%253FLcid%253D1033%2526Key%253DWSSEndUser%255Ftroubleshooting%2526ShowNav%253Dtrue&Source=cookie HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USFAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false; nSGt-CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D=gYEwNUY4N0VCNjEyMEU2MUJBQjQ2NzVBMjdCNTVENDEyQzREREYzNEQ0MDA2NjE2OUMwMENFNDk4MjA5QjYxRTE5Njk1RjI3RjlEQTlBODBFMDdFMTU3MzIyOEU4RkY4RUIxRBIxMzM4MDY1MDc4ODM4NzE0MzMYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tH+bDSiW8NMu02y5WzbfcoqUZ7Dsow8DOb2bRHYtjbWa6XRH6Pqp2AvxjdbM1UOi3yHw9BN0FrkGwe0OmtSYzwv3gtX2QYX2BcdlxRicdCPcvdvGYpc9EUfuCFyPQRAA6I4eghqiefFVeLJb6I8Jye8YY0lbDLgB/zXDwtKeWrSb2P9n/6l/j8kwgrZ+CcIAMlvfXepThaMlTnp8G424YYaIDJppw/BSTxnBCEK4BuEt6buRPY6KnGd0ejYoBQEMBMiG44OSgMSH/Wkifm4GQMd0AkQ8RXHctP1mLWvz9JmjkkcE7eDqrxRIki5JDg39OGeBZgiJI3qRYtNNh82lH25AAAAA=; nSGt-A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8=gYEwMDUwMjNGNzFDOUNGRjEzNkM2RjBBOEY1M0UzNENFNDk0M0Q0N0MzRjY5MzlDMjdBMEExQkI0Mzg5REUzNTI4NzEzQzNDNDE1NDlGNzAwQUQ3REVFQTEzMUU1MzlEODZFOBIxMzM4MDY1MDgwMTIzMTcwOTgYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tjbsFcU+C983ELMnrcPtDsd6omtrY+LUrr44T9KLDmyMMwCublROquio4cLkKq1M3b2BD2ztv2IZN8tAL8DiYrwGCfqfXG+AQJfOegx6hYIjzvA5Qhh/VAYtUbKOYYL3zLU4e6NKyzI/b0Nu0K4jHDMKDwObNzAIU+VxltfEte0mhNSGK7dKOto1MdD/DLUJ55MjxcIZ0l4+/q6p+SQqMCADEO3mT4w0IZMAJcv/E7nRuqk6F2jY0qMdDBufS4gFs+WnJsbN7Aoj7UvXijObDUaUQkaaHPtlRhc25Z2yF8Fm2XLrzD8oMVJnhn2fLkQmCq5p18LBZCbc3KQapVBLDcZAAAAA=; RpsContextCookie=UmV0dXJuVXJsPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGQXV0aGVudGljYXRlJTJFYXNweCUzRlNvdXJjZSUzRCUyNTJGcGVyc29uYWwlMjUyRmRtYXJyYSUyNTVGaGFjZGN0JTI1NUZvcmcmU291cmNlPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGaGVscCUyRWFzcHglM0ZMY2lkJTNEMTAzMyUyNktleSUzRFdTU0VuZFVzZXIlNUZ0cm91Ymxlc2hvb3RpbmclMjZTaG93TmF2JTNEdHJ1ZQ==
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=qcGWWXZNV9PUB93tAUG8SAkswuR1lCWuDpAorFP_U0d6F91BVS2uRDgKo7aSRIImbmMl3DmTIf3GXL3Vvs3cCy2Ene_Tdub_9gDbyyCEz7uPKPyiGN0j7f1O0peACZnr40p2SvptoIyPcn-ofDD4f4YMGU1lSfeC_O9UaaxgP6u_sJoXk84YbQCOW1tQdjRI
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=qcGWWXZNV9PUB93tAUG8SAkswuR1lCWuDpAorFP_U0d6F91BVS2uRDgKo7aSRIImbmMl3DmTIf3GXL3Vvs3cCy2Ene_Tdub_9gDbyyCEz7uPKPyiGN0j7f1O0peACZnr40p2SvptoIyPcn-ofDD4f4YMGU1lSfeC_O9UaaxgP6u_sJoXk84YbQCOW1tQdjRI
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=qcGWWXZNV9PUB93tAUG8SAkswuR1lCWuDpAorFP_U0d6F91BVS2uRDgKo7aSRIImbmMl3DmTIf3GXL3Vvs3cCy2Ene_Tdub_9gDbyyCEz7uPKPyiGN0j7f1O0peACZnr40p2SvptoIyPcn-ofDD4f4YMGU1lSfeC_O9UaaxgP6u_sJoXk84YbQCOW1tQdjRI
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=qcGWWXZNV9PUB93tAUG8SAkswuR1lCWuDpAorFP_U0d6F91BVS2uRDgKo7aSRIImbmMl3DmTIf3GXL3Vvs3cCy2Ene_Tdub_9gDbyyCEz7uPKPyiGN0j7f1O0peACZnr40p2SvptoIyPcn-ofDD4f4YMGU1lSfeC_O9UaaxgP6u_sJoXk84YbQCOW1tQdjRI
Source: global traffic	HTTP traffic detected: GET /:f:/g/personal/dmarra_hacdct_org HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false; nSGt-CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D=gYEwNUY4N0VCNjEyMEU2MUJBQjQ2NzVBMjdCNTVENDEyQzREREYzNEQ0MDA2NjE2OUMwMENFNDk4MjA5QjYxRTE5Njk1RjI3RjlEQTlBODBFMDdFMTU3MzIyOEU4RkY4RUIxRBIxMzM4MDY1MDc4ODM4NzE0MzMYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tH+bDSiW8NMu02y5WzbfcoqUZ7Dsow8DOb2bRHYtjbWa6XRH6Pqp2AvxjdbM1UOi3yHw9BN0FrkGwe0OmtSYzwv3gtX2QYX2BcdlxRicdCPcvdvGYpc9EUfuCFyPQRAA6I4eghqiefFVeLJb6I8Jye8YY0lbDLgB/zXDwtKeWrSb2P9n/6l/j8kwgrZ+CcIAMlvfXepThaMlTnp8G424YYaIDJppw/BSTxnBCEK4BuEt6buRPY6KnGd0ejYoBQEMBMiG44OSgMSH/Wkifm4GQMd0AkQ8RXHctP1mLWvz9JmjkkcE7eDqrxRIki5JDg39OGeBZgiJI3qRYtNNh82lH25AAAAA=; nSGt-A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8=gYEwMDUwMjNGNzFDOUNGRjEzNkM2RjBBOEY1M0UzNENFNDk0M0Q0N0MzRjY5MzlDMjdBMEExQkI0Mzg5REUzNTI4NzEzQzNDNDE1NDlGNzAwQUQ3REVFQTEzMUU1MzlEODZFOBIxMzM4MDY1MDgwMTIzMTcwOTgYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tjbsFcU+C983ELMnrcPtDsd6omtrY+LUrr44T9KLDmyMMwCublROquio4cLkKq1M3b2BD2ztv2IZN8tAL8DiYrwGCfqfXG+AQJfOegx6hYIjzvA5Qhh/VAYtUbKOYYL3zLU4e6NKyzI/b0Nu0K4jHDMKDwObNzAIU+VxltfEte0mhNSGK7dKOto1MdD/DLUJ55MjxcIZ0l4+/q6p+SQqMCADEO3mT4w0IZMAJcv/E7nRuqk6F2jY0qMdDBufS4gFs+WnJsbN7Aoj7UvXijObDUaUQkaaHPtlRhc25Z2yF8Fm2XLrzD8oMVJnhn2fLkQmCq5p18LBZCbc3KQapVBLDcZAAAAA=; nSGt-6BF4F0595F48D92F641DE3CBFF0738E298D2303F897BFE45=gYEwQjU1MUExQkMyRjgxOUUyMkY2QTNCMjZGMjFBRDJCMDdFOEJCQkNCQjQ1N0Q3QzFDMDZCRjRGMDU5NUY0OEQ5MkY2NDFERTNDQkZGMDczOEUyOThEMjMwM0Y4OTdCRkU0NRIxMzM4MDY1MDgyNTEwMjU3MzAYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tSZD+SgvhsMwhG/8vyIUuZMY/nP8b8jvSlLh7H6Q5ZhYhx6hM+FZPllNCgILQQ6ORe3aXFt0STql2u+qlLxAg4UIrDYppcuPFpXv3/wO++3ji52P8Hh3deG6NirBdl/PE+HWWkzfBTEE8nrv5fVQrA97LMHR7pvtxyjcxISUVz2PY8DEVsBrcNRdSA/bB35+5NQiN+CEe35tjNkm0qmG7NGU9tueOdji3/eCXJqdNwzNK2NM+Vut2CigWAmDekAcqecAGAd4WdY8N81KvoMyEKEZwsLwuVZRrZPBqfx0eHjQrOsV6+ZI89g6W2lK2bRAZDVkE2ZDHBlkM4W/OaZS+k5AAAAA=; RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGaGVscCUyRWFzcHglM0ZMY2lkJTNEMTAzMyUyNktleSUzRFdTU0VuZFVzZXIlNUZ0cm91Ymxlc2hvb3RpbmclMjZTaG93TmF2JTNEdHJ1ZSZQcmV2aW91c1JlcXVlc3RDb3JyZWxhdGlvbklkPTMzZTY3NGExJTJEZTBiZiUyRDcwMDAlMkQ2ZmUzJTJENDc0ZmJlNWJkNzczJlJldHVyblVybD0lMkZwZXJzb25hbCUyRmRtYXJyYSU1RmhhY2RjdCU1Rm9yZyUyRiU1RmxheW91dHMlMkYxNSUyRkF1dGhlbnRpY2F0ZSUyRWFzcHglM0ZTb3VyY2UlM0QlMjUyRnBlcnNvbmFsJTI1MkZkbWFycmElMjU1RmhhY2Rj
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_orgAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false; nSGt-CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D=gYEwNUY4N0VCNjEyMEU2MUJBQjQ2NzVBMjdCNTVENDEyQzREREYzNEQ0MDA2NjE2OUMwMENFNDk4MjA5QjYxRTE5Njk1RjI3RjlEQTlBODBFMDdFMTU3MzIyOEU4RkY4RUIxRBIxMzM4MDY1MDc4ODM4NzE0MzMYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tH+bDSiW8NMu02y5WzbfcoqUZ7Dsow8DOb2bRHYtjbWa6XRH6Pqp2AvxjdbM1UOi3yHw9BN0FrkGwe0OmtSYzwv3gtX2QYX2BcdlxRicdCPcvdvGYpc9EUfuCFyPQRAA6I4eghqiefFVeLJb6I8Jye8YY0lbDLgB/zXDwtKeWrSb2P9n/6l/j8kwgrZ+CcIAMlvfXepThaMlTnp8G424YYaIDJppw/BSTxnBCEK4BuEt6buRPY6KnGd0ejYoBQEMBMiG44OSgMSH/Wkifm4GQMd0AkQ8RXHctP1mLWvz9JmjkkcE7eDqrxRIki5JDg39OGeBZgiJI3qRYtNNh82lH25AAAAA=; nSGt-A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8=gYEwMDUwMjNGNzFDOUNGRjEzNkM2RjBBOEY1M0UzNENFNDk0M0Q0N0MzRjY5MzlDMjdBMEExQkI0Mzg5REUzNTI4NzEzQzNDNDE1NDlGNzAwQUQ3REVFQTEzMUU1MzlEODZFOBIxMzM4MDY1MDgwMTIzMTcwOTgYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tjbsFcU+C983ELMnrcPtDsd6omtrY+LUrr44T9KLDmyMMwCublROquio4cLkKq1M3b2BD2ztv2IZN8tAL8DiYrwGCfqfXG+AQJfOegx6hYIjzvA5Qhh/VAYtUbKOYYL3zLU4e6NKyzI/b0Nu0K4jHDMKDwObNzAIU+VxltfEte0mhNSGK7dKOto1MdD/DLUJ55MjxcIZ0l4+/q6p+SQqMCADEO3mT4w0IZMAJcv/E7nRuqk6F2jY0qMdDBufS4gFs+WnJsbN7Aoj7UvXijObDUaUQkaaHPtlRhc25Z2yF8Fm2XLrzD8oMVJnhn2fLkQmCq5p18LBZCbc3KQapVBLDcZAAAAA=; nSGt-6BF4F0595F48D92F641DE3CBFF0738E298D2303F897BFE45=gYEwQjU1MUExQkMyRjgxOUUyMkY2QTNCMjZGMjFBRDJCMDdFOEJCQkNCQjQ1N0Q3QzFDMDZCRjRGMDU5NUY0OEQ5MkY2NDFERTNDQkZGMDczOEUyOThEMjMwM0Y4OTdCRkU0NRIxMzM4MDY1MDgyNTEwMjU3MzAYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tSZD+SgvhsMwhG/8vyIUuZMY/nP8b8jvSlLh7H6Q5ZhYhx6hM+FZPllNCgILQQ6ORe3aXFt0STql2u+qlLxAg4UIrDYppcuPFpXv3/wO++3ji52P8Hh3deG6NirBdl/PE+HWWkzfBTEE8nrv5fVQrA97LMHR7pvtxyjcxISUVz2PY8DEVsBrcNRdSA/bB35+5NQiN+CEe35tjNkm0qmG7NGU9tueOdji3/eCXJqdNwzNK2NM+Vut2CigWAmDekAcqecAGAd4WdY8N81KvoMyEKEZwsLwuVZRrZPBqfx0eHjQrOsV6+ZI89g6W2lK2bRAZDVkE2ZDHBlkM4W/OaZS+k5AAAAA=; RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGaGVscCUyRWFzcHglM0ZMY2lkJTNEMTAzMyUyNktleSUzRFdTU0VuZFVzZXIlNUZ0cm91Ymxlc2hvb3RpbmclMjZTaG93TmF2JTNEdHJ1ZSZQcmV2aW91c1JlcXVlc3RDb3JyZWxhdGlvbklkPTMzZTY3NGExJTJEZTBiZiUyRDcwMDAlMkQ2ZmUzJTJENDc0ZmJlNWJkNzczJlJldHVyblVybD0lMkZwZXJzb25hbCUyRmRtYXJyYSU1RmhhY2RjdCU1Rm9yZyUyRiU1RmxheW91dHMlMkYxNSUyRkF1dGhlbnRpY2F0ZSUyRWFzcHglM0ZTb3VyY2UlM0QlMjUyRnBlcnNvbmFsJTI1MkZkbWFycmElMjU1RmhhY2RjdCUyNTVGb3JnJTI1MkYlMjU1RmxheW91dHMlMjUyRjE1JTI1MkZoZWxwJTI1MkV
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=520=qcGWWXZNV9PUB93tAUG8SAkswuR1lCWuDpAorFP_U0d6F91BVS2uRDgKo7aSRIImbmMl3DmTIf3GXL3Vvs3cCy2Ene_Tdub_9gDbyyCEz7uPKPyiGN0j7f1O0peACZnr40p2SvptoIyPcn-ofDD4f4YMGU1lSfeC_O9UaaxgP6u_sJoXk84YbQCOW1tQdjRI
Source: global traffic	HTTP traffic detected: GET /:f:/g/personal/ HTTP/1.1Host: hacdct-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: WSS_FullScreenMode=false; nSGt-CE498209B61E19695F27F9DA9A80E07E1573228E8FF8EB1D=gYEwNUY4N0VCNjEyMEU2MUJBQjQ2NzVBMjdCNTVENDEyQzREREYzNEQ0MDA2NjE2OUMwMENFNDk4MjA5QjYxRTE5Njk1RjI3RjlEQTlBODBFMDdFMTU3MzIyOEU4RkY4RUIxRBIxMzM4MDY1MDc4ODM4NzE0MzMYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tH+bDSiW8NMu02y5WzbfcoqUZ7Dsow8DOb2bRHYtjbWa6XRH6Pqp2AvxjdbM1UOi3yHw9BN0FrkGwe0OmtSYzwv3gtX2QYX2BcdlxRicdCPcvdvGYpc9EUfuCFyPQRAA6I4eghqiefFVeLJb6I8Jye8YY0lbDLgB/zXDwtKeWrSb2P9n/6l/j8kwgrZ+CcIAMlvfXepThaMlTnp8G424YYaIDJppw/BSTxnBCEK4BuEt6buRPY6KnGd0ejYoBQEMBMiG44OSgMSH/Wkifm4GQMd0AkQ8RXHctP1mLWvz9JmjkkcE7eDqrxRIki5JDg39OGeBZgiJI3qRYtNNh82lH25AAAAA=; nSGt-A1BB4389DE3528713C3C41549F700AD7DEEA131E539D86E8=gYEwMDUwMjNGNzFDOUNGRjEzNkM2RjBBOEY1M0UzNENFNDk0M0Q0N0MzRjY5MzlDMjdBMEExQkI0Mzg5REUzNTI4NzEzQzNDNDE1NDlGNzAwQUQ3REVFQTEzMUU1MzlEODZFOBIxMzM4MDY1MDgwMTIzMTcwOTgYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tjbsFcU+C983ELMnrcPtDsd6omtrY+LUrr44T9KLDmyMMwCublROquio4cLkKq1M3b2BD2ztv2IZN8tAL8DiYrwGCfqfXG+AQJfOegx6hYIjzvA5Qhh/VAYtUbKOYYL3zLU4e6NKyzI/b0Nu0K4jHDMKDwObNzAIU+VxltfEte0mhNSGK7dKOto1MdD/DLUJ55MjxcIZ0l4+/q6p+SQqMCADEO3mT4w0IZMAJcv/E7nRuqk6F2jY0qMdDBufS4gFs+WnJsbN7Aoj7UvXijObDUaUQkaaHPtlRhc25Z2yF8Fm2XLrzD8oMVJnhn2fLkQmCq5p18LBZCbc3KQapVBLDcZAAAAA=; nSGt-6BF4F0595F48D92F641DE3CBFF0738E298D2303F897BFE45=gYEwQjU1MUExQkMyRjgxOUUyMkY2QTNCMjZGMjFBRDJCMDdFOEJCQkNCQjQ1N0Q3QzFDMDZCRjRGMDU5NUY0OEQ5MkY2NDFERTNDQkZGMDczOEUyOThEMjMwM0Y4OTdCRkU0NRIxMzM4MDY1MDgyNTEwMjU3MzAYaGFjZGN0LW15LnNoYXJlcG9pbnQuY29tSZD+SgvhsMwhG/8vyIUuZMY/nP8b8jvSlLh7H6Q5ZhYhx6hM+FZPllNCgILQQ6ORe3aXFt0STql2u+qlLxAg4UIrDYppcuPFpXv3/wO++3ji52P8Hh3deG6NirBdl/PE+HWWkzfBTEE8nrv5fVQrA97LMHR7pvtxyjcxISUVz2PY8DEVsBrcNRdSA/bB35+5NQiN+CEe35tjNkm0qmG7NGU9tueOdji3/eCXJqdNwzNK2NM+Vut2CigWAmDekAcqecAGAd4WdY8N81KvoMyEKEZwsLwuVZRrZPBqfx0eHjQrOsV6+ZI89g6W2lK2bRAZDVkE2ZDHBlkM4W/OaZS+k5AAAAA=; RpsContextCookie=U291cmNlPSUyRnBlcnNvbmFsJTJGZG1hcnJhJTVGaGFjZGN0JTVGb3JnJTJGJTVGbGF5b3V0cyUyRjE1JTJGaGVscCUyRWFzcHglM0ZMY2lkJTNEMTAzMyUyNktleSUzRFdTU0VuZFVzZXIlNUZ0cm91Ymxlc2hvb3RpbmclMjZTaG93TmF2JTNEdHJ1ZSZQcmV2aW91c1JlcXVlc3RDb3JyZWxhdGlvbklkPTMzZTY3NGExJTJEZTBiZiUyRDcwMDAlMkQ2ZmUzJTJENDc0ZmJlNWJkNzczJlJldHVyblVybD0lMkZwZXJzb25hbCUyRmRtYXJyYSU1RmhhY2RjdCU1Rm9yZyUyRiU1RmxheW91dHMlMkYxNSUyRkF1dGhlbnRpY2F0ZSUyRWFzcHglM0ZTb3VyY2UlM0QlMjUyRnBlcnNvbmFsJTI1MkZkbWFycmElMjU1RmhhY2RjdCUyNTVGb3JnJTI1M

Performs DNS lookups

Source: global traffic	DNS traffic detected: DNS query: hacdct-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: nam12.safelinks.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlaHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateContent-Length: 18Content-Type: text/plain; charset=utf-8P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"X-NetworkStatistics: 0,1051136,0,0,1364288,0,1051136,10X-SharePointHealthScore: 2SPRequestGuid: 36e674a1-a047-7000-6fe3-4453b77a4352request-id: 36e674a1-a047-7000-6fe3-4453b77a4352MS-CV: oXTmNkegAHBv40RTt3pDUg.0Strict-Transport-Security: max-age=31536000X-AspNet-Version: 4.0.30319SPRequestDuration: 412SPIisLatency: 4X-Powered-By: ASP.NETMicrosoftSharePointTeamServices: 16.0.0.25520X-Content-Type-Options: nosniffX-MS-InvokeApp: 1; RequireReadOnlyX-Cache: CONFIG_NOCACHEX-MSEdge-Ref: Ref A: A4928261616D48268FD4B9092B249C90 Ref B: EWR311000103031 Ref C: 2025-01-06T15:23:15ZDate: Mon, 06 Jan 2025 15:23:15 GMTConnection: close

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundP3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"X-NetworkStatistics: 0,2102272,79,46,5283199,0,2102272,11SPRequestDuration: 22SPIisLatency: 0X-Powered-By: ASP.NETMicrosoftSharePointTeamServices: 16.0.0.25520X-Content-Type-Options: nosniffX-MS-InvokeApp: 1; RequireReadOnlyX-Cache: CONFIG_NOCACHEX-MSEdge-Ref: Ref A: 070A589B0A4E4396BA95C8652AB524BA Ref B: EWR311000108031 Ref C: 2025-01-06T15:23:15ZDate: Mon, 06 Jan 2025 15:23:15 GMTConnection: closeContent-Length: 0

URLs found in memory or binary data

Source: chromecache_153.1.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_136.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_136.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_153.1.dr, chromecache_136.1.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_136.1.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_136.1.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_136.1.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_153.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_153.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_153.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_153.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_137.1.dr	String found in binary or memory: https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_
Source: chromecache_122.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_122.1.dr	String found in binary or memory: https://login.windows-ppe.net
Source: chromecache_137.1.dr	String found in binary or memory: https://nam12.safelinks.protection.outlook.com
Source: chromecache_153.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_136.1.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_136.1.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_157.1.dr, chromecache_129.1.dr	String found in binary or memory: https://res-2-gcc.cdn.office.net/bld/_layouts/15/16.0.25520.12010/1033/initstrings.js
Source: chromecache_129.1.dr	String found in binary or memory: https://res-2-gcc.cdn.office.net/bld/_layouts/15/16.0.25520.12010/blank.js
Source: chromecache_157.1.dr, chromecache_129.1.dr	String found in binary or memory: https://res-2-gcc.cdn.office.net/bld/_layouts/15/16.0.25520.12010/init.js
Source: chromecache_157.1.dr, chromecache_129.1.dr	String found in binary or memory: https://res-2-gcc.cdn.office.net/bld/_layouts/15/16.0.25520.12010/theming.js
Source: chromecache_157.1.dr, chromecache_129.1.dr	String found in binary or memory: https://res.cdn.office.net/teams-js/2.21.0/js/MicrosoftTeams.min.js
Source: chromecache_136.1.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_136.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_136.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_153.1.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_153.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_153.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

System Summary

Classification label

Source: classification engine

Classification label: mal48.phis.win@33/113@30/8

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1952,i,11390141235313020324,6115882319602124651,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://hacdct-my.sharepoint.com/:f:/g/personal/dmarra_hacdct_org/El0CfhNMVMNNuzPj6QGnrSQBywVLNW96w_XrX10UdRlfmQ?email=dhodder%40haigroup.com&e=d37USF&xsdata=MDV8MDJ8am1ja2lubGV5QGhhaWdyb3VwLmNvbXwyYzYxNmM3ZDhlNmU0YWM5MDJlMjA4ZGQyZTYzYjFmMnw4MjgxNWI4YzM3NzU0NTk5OTdjNzJiODc1MjhlNmY4M3wwfDB8NjM4NzE3NzMyNjY3MjIxNDQzfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXw0MDAwfHx8&sdata=bXM5KzduUjdVc3RFaFJsU1ZBR1d1enMxT3I3VitIdmc4MUlhZ25WT3dmWT0%3d"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1952,i,11390141235313020324,6115882319602124651,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Windows shortcut file (LNK) contains relative path

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior