Windows Analysis Report
ELECTRONIC RECEIPT_Augustahealth.html

Overview

General Information

Sample name: ELECTRONIC RECEIPT_Augustahealth.html
Analysis ID: 1446243
MD5: 2bfe1f1c4512a7f58bf4dd78dcd030be
SHA1: 0fc1342a71a452fdd3eed4977bc06156e30249d0
SHA256: b1e35d18448641e98ba06c34330e81963b04a970a17607ab31134c26a2aac157
Infos:

Detection

HTMLPhisher
Score: 84
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

AI detected phishing page
Yara detected HtmlPhish54
AI detected suspicious javascript
Detected javascript redirector / loader
HTML IFrame injector detected
HTML document with suspicious name
HTML document with suspicious title
Phishing site detected (based on image similarity)
Phishing site detected (based on logo match)
Detected hidden input values containing email addresses (often used in phishing pages)
Detected non-DNS traffic on DNS port
Found iframes
HTML body contains low number of good links
HTML page contains hidden URLs or javascript code
HTML title does not match URL
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Stores files to the Windows start menu directory

Classification

Phishing
barindex
AI detected phishing page
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true LLM: Score: 8 brands: Microsoft Reasons: The URL is highly suspicious as it contains a long, random-looking subdomain and query parameters, which is a common technique used in phishing attacks. The domain 'consultingexpertiseinc.com' does not match the legitimate domain associated with Microsoft login pages, which is typically 'microsoft.com' or 'live.com'. The page mimics the Microsoft login interface, which is a social engineering technique to trick users into providing their credentials. Therefore, this site is highly likely to be a phishing site. DOM: 2.7.pages.csv
Yara detected HtmlPhish54
Source: Yara match File source: 2.7.pages.csv, type: HTML
Source: Yara match File source: 2.6.pages.csv, type: HTML
Source: Yara match File source: 1.3.pages.csv, type: HTML
Source: Yara match File source: 2.4.pages.csv, type: HTML
Source: Yara match File source: 2.8.pages.csv, type: HTML
AI detected suspicious javascript
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com LLM: Score: 8 Reasons: The code appears to be obfuscated, which is a common technique used to hide malicious intent. It includes references to various HTML elements and functions that could be used to manipulate the DOM or capture user input. Additionally, the presence of terms like 'send', 'requestIdleCallback', and 'setImmediate' suggests potential for data exfiltration or unauthorized actions. The obfuscation and the nature of the functions used indicate a high risk of malicious activity. DOM: 1.1.pages.csv
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true LLM: Score: 8 Reasons: The provided JavaScript code is heavily obfuscated, making it difficult to understand its true functionality. Obfuscation is a common technique used by malicious actors to hide malicious behavior. Additionally, the code includes complex logic and function calls that could potentially be used to execute harmful actions. While obfuscation alone does not confirm malicious intent, it significantly increases the risk score due to the potential for hidden malicious activities. DOM: 2.4.pages.csv
Detected javascript redirector / loader
Source: ELECTRONIC RECEIPT_Augustahealth.html HTTP Parser: Low number of body elements: 0
HTML IFrame injector detected
Source: file:///C:/Users/user/Desktop/ELECTRONIC%20RECEIPT_Augustahealth.html HTTP Parser: New IFrame, src: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com
HTML document with suspicious title
Source: file:///C:/Users/user/Desktop/ELECTRONIC%20RECEIPT_Augustahealth.html Tab title: ELECTRONIC RECEIPT_Augustahealth.html
Phishing site detected (based on image similarity)
Source: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10 Matcher: Found strong image similarity, brand: MICROSOFT
Phishing site detected (based on logo match)
Source: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz Matcher: Template: microsoft matched
Source: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz Matcher: Template: microsoft matched
Source: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz Matcher: Template: microsoft matched
Detected hidden input values containing email addresses (often used in phishing pages)
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: dsmallwood@augustahealth.com
Found iframes
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: Iframe src: https://f4438677-04bafa98.consultingexpertiseinc.com/Prefetch/Prefetch.aspx
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: Iframe src: https://f4438677-04bafa98.consultingexpertiseinc.com/Prefetch/Prefetch.aspx
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: Iframe src: https://f4438677-04bafa98.consultingexpertiseinc.com/Prefetch/Prefetch.aspx
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: Iframe src: https://f4438677-04bafa98.consultingexpertiseinc.com/Prefetch/Prefetch.aspx
HTML body contains low number of good links
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: Number of links: 0
Source: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10 HTTP Parser: Number of links: 0
HTML page contains hidden URLs or javascript code
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com HTTP Parser: Base64 decoded: a[href="http://www.salidzini.lv/"][style="display: block; width: 88px; height: 31px; overflow: hidden; position: relative;"]
HTML title does not match URL
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: Title: Sign in to your account does not match URL
Source: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10 HTTP Parser: Title: Microsoft Online Password Reset does not match URL
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: <input type="password" .../> found
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com HTTP Parser: No favicon
Source: https://f4438677-04bafa98.consultingexpertiseinc.com/Prefetch/Prefetch.aspx HTTP Parser: No favicon
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: No <meta name="author".. found
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: No <meta name="author".. found
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: No <meta name="author".. found
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: No <meta name="author".. found
Source: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10 HTTP Parser: No <meta name="author".. found
Source: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10 HTTP Parser: No <meta name="author".. found
Source: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10 HTTP Parser: No <meta name="author".. found
Source: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10 HTTP Parser: No <meta name="author".. found
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: No <meta name="copyright".. found
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: No <meta name="copyright".. found
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: No <meta name="copyright".. found
Source: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP Parser: No <meta name="copyright".. found
Source: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10 HTTP Parser: No <meta name="copyright".. found
Source: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10 HTTP Parser: No <meta name="copyright".. found
Source: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10 HTTP Parser: No <meta name="copyright".. found
Source: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10 HTTP Parser: No <meta name="copyright".. found
Source: unknown HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:51795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:51832 version: TLS 1.2
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.5:51786 -> 1.1.1.1:53
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: EONIX-COMMUNICATIONS-ASBLOCK-62904US EONIX-COMMUNICATIONS-ASBLOCK-62904US
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 2.19.244.127
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: global traffic HTTP traffic detected: GET /?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js HTTP/1.1Host: 2a14037b-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="Sec-WebSocket-Key: jxFnxlD2ftKMpD6qizu9NA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com&sso_reload=true HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=O9NkNMGtwl4YTdm&MD=1ab3ylzp HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_9oft0ybq1qhuafkqh5wryq2.css HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_T2EBBtMmyv072RjbQwNpoQ2.js HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_vtf__v_j2jh3v2otg9k3lq2.js HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: l1ve.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: sqBTPMDGG2SQFdV6uTX0GA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: f4438677-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_7c1aa7609345f99e4914.js HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: iNJ+caebs2nvQg2uRV0h9g==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /augustahealth.com/winauth/ssoprobe?client-request-id=a05bfd4e-559a-45db-94fe-9ed59c80ae60&_=1716421137728 HTTP/1.1Host: 6b520068-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_4d39c0367444c533fcd7.js HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: dCm1kqxfYKUqMPu3ef7qWg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /common/instrumentation/dssostatus HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; brcap=0
Source: global traffic HTTP traffic detected: GET /dbd5a2dd-eqo6yjrfa5hekkbmeiz0owo0oildavd3fvhq-cjoox0/logintenantbranding/0/bannerlogo?ts=637625620200194437 HTTP/1.1Host: a135181d-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /dbd5a2dd-eqo6yjrfa5hekkbmeiz0owo0oildavd3fvhq-cjoox0/logintenantbranding/0/bannerlogo?ts=637625620200194437 HTTP/1.1Host: a135181d-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg HTTP/1.1Host: 44069f49-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: sdRlW0yOHvcEhcgKHLxEXg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=O9NkNMGtwl4YTdm&MD=1ab3ylzp HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: JaQZnA4x+OyB/V8zWw9Pfw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: Zcsv2Ee12WhC33HMiS90hQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10 HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /js/Common.js HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /css/Style.css?v=1342177280 HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /css/ltrStyle.css?v=1342177280 HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /js/Webtrends.js HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /WebResource.axd?d=BJpRDuqCy8jKS1v_6vKOsxh3zE9lNKLrb8Rec-McG1BnwzCMCel1Lki8ufhpZ9kpfF0T7ubBHr71K6vXrYXFsT8KynRLodT1775_Kua5AKVjVezjf91fiudAF-jbQ88I0CDKjTbbF8cc40JG6Ibc4A2&t=638509456396079063 HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /js/Button.js?v=1342177280 HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /ajax/jQuery/jquery-3.6.0.min.js HTTP/1.1Host: fa3fa60b-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /ScriptResource.axd?d=1RRuBCtn1pIwYcY2WZlNa4e_HloL4buZFH35qBoQ9gtTR3Bj98Ss70nEWS3THvHgsWAxzdPElF6u1PcwBxbjiWty2HGhUFLJUMOECOAeAh8V_KFol6xmO5pphI7DC_9CAfXnLz4OLdL0Qv84wgBB78KwjfVr1nz_qKKKGIXucZ4XfICk1aGXvA88ahj3MGtVoRC44jJBbo6DNP5GCHaEXQ2&t=ffffffffa8ad04d3 HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /ScriptResource.axd?d=tTJUxd2-Xwg7Goikjksgas1CBbaMQW1SXLue4MyLo9hOSTFpkQKegmUZyWqYW3mCn19pIRQzwAzhFijSDowlcy21ZevxUeXfy7Wf40VwBuJpmPzYuhxx7I8_iZR-PGbFRv_dj-wIiIZHSpMNNsE7uKNMz84kKxHocyYAgb3m50X_eNq6_nwNNueWDbB7aY7UG7pu4C_ItRdwhJuCwEFhPrgIW4y6ym7GnXOBN7a-QXU1&t=74258c30 HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /ScriptResource.axd?d=Q6KfLgtY_7Q5kOyfhAUzWE0vCdVQo3kZxqR3cTMo5Mg0tMsIc261SR70usehkeBRh0jTgwJ1BghiKqvZgOgWXpln99BuKR084eYdyobk7XfLz2NWx9ze3MSPCDADB4ZOij8skrm2NRSvzHex2vMzyN9Kql5T-kSDr1yu1Zl3memjTswFUk8hRTVibYv2aKMeMz4xJI7cbcNIk1WkD9hAcnpvHizua5ADZiqkCY7g_Zg1&t=74258c30 HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; brcap=0Sec-WebSocket-Key: MwyEEy3m8kx/FGVyI15NyQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /WebResource.axd?d=noQ-NRy2ZIz1bUHme5MeuhamNa6C_BwqixBCCGo0wgmzbIebj3ZYEOeWoUytJr12gWPsDGW3S955m8mGkzQ5T5MX5DQRbCnh5mcNaiHzQHvTtvkFomZVHF4_KTNLClgSPdEEJwIJ_FIMQ4aWig1_1g2&t=638509456396079063 HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /Images/hipaudioplay.png?vv=100 HTTP/1.1Host: bcf693cc-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /images/header_microsoft.png HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /images/wait_animation.gif HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /images/hip_speaker.png HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /images/hip_text.gif HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /images/hip_reload.png HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /images/footer_logo_grey_bg.png HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /Default.aspx/GetCaptchaChallenge HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /images/header_microsoft.png HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /Images/hipaudioplay.png?vv=100 HTTP/1.1Host: bcf693cc-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /images/hip_speaker.png HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /images/wait_animation.gif HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /images/hip_reload.png HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /images/hip_text.gif HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /favicon.ico?v=1342177280 HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /images/header_Microsoft.png HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://97d79e89-04bafa98.consultingexpertiseinc.com/?ru=https%3a%2f%2fb7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com%2fcommon%2freprocess%3fctx%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAT8_kYvmBV623XKv3lX5zSsS1jFqEzYCP0LjIwvGBknMcmkFOcm5uSU5-enOCSWppcWlyRmpCbmlGSAVN1iEvQvSvdMCS92S01JLUosyczPe8SMV8sFFoFXLDwGzFYcHFwCDBIMCgw_WBgXsQLdmbNik9nxHcd9WgUePPhiL8lwilU_ySzUy7kkO8XP1MNA28IsPMwkIs2gMjgiKtzJ3K0q2yfTMc9SPzQs3Mc51NbEynACm9AENqZTbAwf2Bg72BlmsTMc4GQ8wMvwg69ld1Nz6_V57zxe8etEGVflm1UkVVlWBXlGmFkaBacl-RWb-XiXFpj4JmZY5Lo7Fnn5R3m4GBgE2m4QYAAA0&mkt=en-US&hosted=0&device_platform=Windows+10Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /images/footer_logo_grey_bg.png HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; brcap=0Sec-WebSocket-Key: pYFUMBnwzeRx8xQiikKotw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /images/header_Microsoft.png HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /favicon.ico?v=1342177280 HTTP/1.1Host: 97d79e89-04bafa98.consultingexpertiseinc.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; brcap=0Sec-WebSocket-Key: OIfOBA06thCUbMt8MFO2fQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; brcap=0Sec-WebSocket-Key: 3O9bL9nVXBRat6ybR4dQzQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; brcap=0Sec-WebSocket-Key: clO6JOlFWY8EjGz3KrkwzQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; brcap=0Sec-WebSocket-Key: ybr6GCOJuynZDPZP3LuQiA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; brcap=0Sec-WebSocket-Key: SHfU/1e+mfJ0cysMRweI7A==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; brcap=0Sec-WebSocket-Key: TNZczjoeGh9tQbV0XIFN1g==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic HTTP traffic detected: GET /04bafa9866804dfcbb53a6a58d087998/ HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: coc1Wu="MDRiYWZhOTgtNjY4MC00ZGZjLWJiNTMtYTZhNThkMDg3OTk4OmJkNGNlNzQ4LWY0MTEtNDg2NS1hNDIxLWRmOGY1YWJjYmU0YQ=="; AADSSO=NA|NoExtension; brcap=0Sec-WebSocket-Key: n7s7ltpc9rSOIu6zp26MPQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic DNS traffic detected: DNS query: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: 2a14037b-04bafa98.consultingexpertiseinc.com
Source: global traffic DNS traffic detected: DNS query: 44069f49-04bafa98.consultingexpertiseinc.com
Source: global traffic DNS traffic detected: DNS query: l1ve.consultingexpertiseinc.com
Source: global traffic DNS traffic detected: DNS query: f4438677-04bafa98.consultingexpertiseinc.com
Source: global traffic DNS traffic detected: DNS query: 6b520068-04bafa98.consultingexpertiseinc.com
Source: global traffic DNS traffic detected: DNS query: a135181d-04bafa98.consultingexpertiseinc.com
Source: global traffic DNS traffic detected: DNS query: 97d79e89-04bafa98.consultingexpertiseinc.com
Source: global traffic DNS traffic detected: DNS query: fa3fa60b-04bafa98.consultingexpertiseinc.com
Source: global traffic DNS traffic detected: DNS query: bcf693cc-04bafa98.consultingexpertiseinc.com
Source: unknown HTTP traffic detected: POST /?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.com HTTP/1.1Host: b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comConnection: keep-aliveContent-Length: 4916Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.comContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com/?v4hgHT=pUepMZ&username=dsmallwood%40augustahealth.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:38:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 443ce08b-326d-487f-8cbd-183c64982b00x-ms-ests-server: 2.1.18105.6 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:38:54 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ms-correlation-id: b262cc6d-0d5b-4b99-9ebf-51c76e8af67cx-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: B22065ED3E5040E9B2E51D4D3D86AEC7 Ref B: DFW311000106045 Ref C: 2024-05-22T23:38:53Zaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:38:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 3df2755e-8313-4e0b-a297-18ba00622200x-ms-ests-server: 2.1.18105.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:38:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 11273388-0531-4f58-968f-34fdbfcf2500x-ms-ests-server: 2.1.18105.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:39:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: ed91fb0b-220b-4aef-ab3c-a61302a02300x-ms-ests-server: 2.1.18105.6 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:39:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 222f1287-3e3c-49c4-b120-9aded5e12000x-ms-ests-server: 2.1.18105.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:39:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 35d0b984-5ac4-453c-b312-fcf260a01f00x-ms-ests-server: 2.1.18105.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:39:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 78a9d696-bbf6-472e-9271-1f8d015a2200x-ms-ests-server: 2.1.18105.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:39:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 553f0b96-fe84-42d6-b7f1-ddadd2d71d00x-ms-ests-server: 2.1.18105.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:40:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 6487bae1-f51d-404d-bb74-70f43f9d2200x-ms-ests-server: 2.1.18105.6 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:40:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: a5c01f0b-d928-42c9-8aff-bddb533a1d00x-ms-ests-server: 2.1.18105.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:40:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 57d85dfe-eaf6-43c4-8c6f-1a2970351f00x-ms-ests-server: 2.1.18105.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:40:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: ee086e9c-97b0-4439-866e-820314a11600x-ms-ests-server: 2.1.18105.6 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:41:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 5802fca3-919d-4672-bc35-fd12939b1d00x-ms-ests-server: 2.1.18105.6 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:41:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 1edaed9e-6e8c-4982-8a53-1fe1c8272300x-ms-ests-server: 2.1.18105.6 - SEC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 22 May 2024 23:41:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 33bd9be8-6cea-40f6-8147-107653c62200x-ms-ests-server: 2.1.18105.6 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://212c9372-04bafa98.consultingexpertiseinc.com/api/report?catId=GW+estsfd+dub2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: chromecache_172.2.dr String found in binary or memory: https://61b0b76c-04bafa98.consultingexpertiseinc.com/en-US/privacystatement
Source: chromecache_172.2.dr String found in binary or memory: https://account.consultingexpertiseinc.com/resetpassword.aspx
Source: chromecache_182.2.dr, chromecache_172.2.dr String found in binary or memory: https://bcf693cc-04bafa98.consultingexpertiseinc.com:443/Images/hipaudioplay.png?vv=100
Source: chromecache_172.2.dr String found in binary or memory: https://wwwms.consultingexpertiseinc.com/en-US/servicesagreement/
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51824
Source: unknown Network traffic detected: HTTP traffic on port 51872 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51822
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51827
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51828
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51825
Source: unknown Network traffic detected: HTTP traffic on port 51866 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51826
Source: unknown Network traffic detected: HTTP traffic on port 51828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51820
Source: unknown Network traffic detected: HTTP traffic on port 51805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51837 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51881 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51829
Source: unknown Network traffic detected: HTTP traffic on port 51852 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51835
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51832
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51833
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51838
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51839
Source: unknown Network traffic detected: HTTP traffic on port 51848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51836
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51837
Source: unknown Network traffic detected: HTTP traffic on port 51875 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51830
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51796
Source: unknown Network traffic detected: HTTP traffic on port 51861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51855 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51845
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51846
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51843
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51844
Source: unknown Network traffic detected: HTTP traffic on port 51849 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51849
Source: unknown Network traffic detected: HTTP traffic on port 51874 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51847
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51848
Source: unknown Network traffic detected: HTTP traffic on port 51868 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51841 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51841
Source: unknown Network traffic detected: HTTP traffic on port 51807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51842
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51840
Source: unknown Network traffic detected: HTTP traffic on port 51835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51860 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 51854 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 51812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51846 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51856
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51854
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51855
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51858
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51859
Source: unknown Network traffic detected: HTTP traffic on port 51804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51877 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51852
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51853
Source: unknown Network traffic detected: HTTP traffic on port 51821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51850
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51851
Source: unknown Network traffic detected: HTTP traffic on port 51863 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51880 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 51815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 51832 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51867
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51847 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51868
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51865
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51866
Source: unknown Network traffic detected: HTTP traffic on port 51876 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51860
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51863
Source: unknown Network traffic detected: HTTP traffic on port 51824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51864
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51861
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51862
Source: unknown Network traffic detected: HTTP traffic on port 51809 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51856 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51879 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51871 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51878
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51879
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51876
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51844 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51877
Source: unknown Network traffic detected: HTTP traffic on port 51865 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51870
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51871
Source: unknown Network traffic detected: HTTP traffic on port 51827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51874
Source: unknown Network traffic detected: HTTP traffic on port 51806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51875
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51872
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51873
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51838 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51859 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51851 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51845 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51870 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51805
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51806
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51804
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51881
Source: unknown Network traffic detected: HTTP traffic on port 51864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51880
Source: unknown Network traffic detected: HTTP traffic on port 51858 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51809
Source: unknown Network traffic detected: HTTP traffic on port 51816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51839 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51808
Source: unknown Network traffic detected: HTTP traffic on port 51850 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51812
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51813
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51810
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51811
Source: unknown Network traffic detected: HTTP traffic on port 51819 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51816
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51817
Source: unknown Network traffic detected: HTTP traffic on port 51873 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51814
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51815
Source: unknown Network traffic detected: HTTP traffic on port 51867 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51842 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51836 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51878 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51853 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51818
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 51819
Source: unknown Network traffic detected: HTTP traffic on port 51796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 51811 -> 443
Source: unknown HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.19.244.127:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:51795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.5:51832 version: TLS 1.2

System Summary
barindex
HTML document with suspicious name
Source: Name includes: ELECTRONIC RECEIPT_Augustahealth.html Initial sample: receipt
Source: classification engine Classification label: mal84.phis.winHTML@34/94@34/5
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\ELECTRONIC RECEIPT_Augustahealth.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2188,i,11909889322955057231,7924698504520723390,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2188,i,11909889322955057231,7924698504520723390,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Google Drive.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Automated click: Next
Source: Window Recorder Window detected: More than 3 window changes detected
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1446243 Sample: ELECTRONIC RECEIPT_Augustah... Startdate: 23/05/2024 Architecture: WINDOWS Score: 84 22 AI detected phishing page 2->22 24 Yara detected HtmlPhish54 2->24 26 HTML document with suspicious name 2->26 28 6 other signatures 2->28 6 chrome.exe 9 2->6         started        process3 dnsIp4 12 192.168.2.5, 443, 49510, 49703 unknown unknown 6->12 14 239.255.255.250 unknown Reserved 6->14 9 chrome.exe 6->9         started        process5 dnsIp6 16 l1ve.consultingexpertiseinc.com 170.130.165.102, 443, 49707, 49710 EONIX-COMMUNICATIONS-ASBLOCK-62904US United States 9->16 18 b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com 9->18 20 10 other IPs or domains 9->20
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.184.228
 www.google.com United States
15169 GOOGLEUS false
170.130.165.102
 bcf693cc-04bafa98.consultingexpertiseinc.com United States
62904 EONIX-COMMUNICATIONS-ASBLOCK-62904US true
172.217.16.132
 unknown United States
15169 GOOGLEUS false

Private

IP
192.168.2.5

Contacted Domains

Name IP Active
bcf693cc-04bafa98.consultingexpertiseinc.com 170.130.165.102 true
b7lgkqdvzd4e4e72xtvpo7isqvjo1kzps0evdmzdhrdvc4qpcn2vlea3qo9nv2.consultingexpertiseinc.com 170.130.165.102 true
a135181d-04bafa98.consultingexpertiseinc.com 170.130.165.102 true
2a14037b-04bafa98.consultingexpertiseinc.com 170.130.165.102 true
www.google.com 142.250.184.228 true
fa3fa60b-04bafa98.consultingexpertiseinc.com 170.130.165.102 true
f4438677-04bafa98.consultingexpertiseinc.com 170.130.165.102 true
44069f49-04bafa98.consultingexpertiseinc.com 170.130.165.102 true
6b520068-04bafa98.consultingexpertiseinc.com 170.130.165.102 true
97d79e89-04bafa98.consultingexpertiseinc.com 170.130.165.102 true
l1ve.consultingexpertiseinc.com 170.130.165.102 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
file:///C:/Users/user/Desktop/ELECTRONIC%20RECEIPT_Augustahealth.html true
  • Avira URL Cloud: safe
 unknown