Windows Analysis Report
https://pepe-memes.com/d/ax/q?user=mbraedel@hilcorp.com

AV Detection

Source: https://pepe-memes.com/d/ax/q?user=mbraedel@hilcorp.com

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Phishing

Source: https://royaldesignbuild.site

Matcher: Template: microsoft matched with high similarity

Source: Yara match	File source: 2.5.pages.csv, type: HTML
Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: 3.8.pages.csv, type: HTML
Source: Yara match	File source: 3.9.pages.csv, type: HTML
Source: Yara match	File source: 3.10.pages.csv, type: HTML

Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true

Matcher: Template: microsoft matched

Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true

HTTP Parser: mbraedel@hilcorp.com

Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true	HTTP Parser: Iframe src: https://2f2fa290-e19815ab.royaldesignbuild.site/Prefetch/Prefetch.aspx
Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true	HTTP Parser: Iframe src: https://2f2fa290-e19815ab.royaldesignbuild.site/Prefetch/Prefetch.aspx
Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true	HTTP Parser: Iframe src: https://2f2fa290-e19815ab.royaldesignbuild.site/Prefetch/Prefetch.aspx
Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true	HTTP Parser: Iframe src: https://2f2fa290-e19815ab.royaldesignbuild.site/Prefetch/Prefetch.aspx

Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true

HTTP Parser: Number of links: 0

Source: https://pepe-memes.com/d/ax/q?user=mbraedel@hilcorp.com

Sample URL: PII: mbraedel@hilcorp.com

Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true

HTTP Parser: <input type="password" .../> found

Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com	HTTP Parser: No favicon
Source: https://2f2fa290-e19815ab.royaldesignbuild.site/Prefetch/Prefetch.aspx	HTTP Parser: No favicon

Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.com&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Compliance

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49753 version: TLS 1.2

Networking

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /d/ax/q?user=mbraedel@hilcorp.com HTTP/1.1Host: pepe-memes.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /index.html%7D?i=mbraedel@hilcorp.com HTTP/1.1Host: hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/19/sharepoint-aspx/////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/?u=bW9ucm9lbGFyZWFsdG9yLmNvbS9hYWEvc2hzampzanMvbWJyYWVkZWxAaGlsY29ycC5jb20=&x=////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/ HTTP/1.1Host: hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/main.1b019d38.css HTTP/1.1Host: hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.com/_layouts/19/sharepoint-aspx/////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/?u=bW9ucm9lbGFyZWFsdG9yLmNvbS9hYWEvc2hzampzanMvbWJyYWVkZWxAaGlsY29ycC5jb20=&x=////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/bundle.js HTTP/1.1Host: hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.com/_layouts/19/sharepoint-aspx/////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/?u=bW9ucm9lbGFyZWFsdG9yLmNvbS9hYWEvc2hzampzanMvbWJyYWVkZWxAaGlsY29ycC5jb20=&x=////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/main.bdf2bc27.js HTTP/1.1Host: hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.com/_layouts/19/sharepoint-aspx/////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/?u=bW9ucm9lbGFyZWFsdG9yLmNvbS9hYWEvc2hzampzanMvbWJyYWVkZWxAaGlsY29ycC5jb20=&x=////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /im/shar2.jpg HTTP/1.1Host: hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.com/_layouts/19/sharepoint-aspx/////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/?u=bW9ucm9lbGFyZWFsdG9yLmNvbS9hYWEvc2hzampzanMvbWJyYWVkZWxAaGlsY29ycC5jb20=&x=////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /im/spina.gif HTTP/1.1Host: hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.com/_layouts/19/sharepoint-aspx/////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/?u=bW9ucm9lbGFyZWFsdG9yLmNvbS9hYWEvc2hzampzanMvbWJyYWVkZWxAaGlsY29ycC5jb20=&x=////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/19/sharepoint-aspx/////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/public/favicon.ico HTTP/1.1Host: hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.com/_layouts/19/sharepoint-aspx/////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/?u=bW9ucm9lbGFyZWFsdG9yLmNvbS9hYWEvc2hzampzanMvbWJyYWVkZWxAaGlsY29ycC5jb20=&x=////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/19/sharepoint-aspx/////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/public/manifest.json HTTP/1.1Host: hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.com/_layouts/19/sharepoint-aspx/////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/?u=bW9ucm9lbGFyZWFsdG9yLmNvbS9hYWEvc2hzampzanMvbWJyYWVkZWxAaGlsY29ycC5jb20=&x=////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /im/shar2.jpg HTTP/1.1Host: hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /im/spina.gif HTTP/1.1Host: hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/19/sharepoint-aspx/////////////e/r//r/e//d/d//w/s//fd//f/w///s/s/df//f//w/s//s/s/s/sfs/fd///s////////////sd/sw////////g/////////////vvs/////////////////////ss//////////////se///////////////////h////////////h/////////////h//////////////////vvvvd//bdds/hgffddds//////////////dss/ssssssssss/ssssssssssssssssssssss///////////////////////////////////////////////////////////////////////////////////////////////////////////w///////////////////w//////v//n/////////////////a//////////////////m///////////////////////k//////////////////r///////////////q///////////eyydsyywttwtwiww///w//w/w/d////a///q///c/v////f//g///j//j//k/k/y//n//////r///e//e//r/r/public/favicon.ico HTTP/1.1Host: hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /aaa/shsjjsjs/mbraedel@hilcorp.com HTTP/1.1Host: monroelarealtor.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://hilcorpcom-netorgft4082839-sharepoint-com-f3.pepe-memes.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: monroelarealtor.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://monroelarealtor.com/aaa/shsjjsjs/mbraedel@hilcorp.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?username=mbraedel@hilcorp.com HTTP/1.1Host: 0nline.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://monroelarealtor.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?username=mbraedel@hilcorp.com HTTP/1.1Host: 0nline.royaldesignbuild.siteConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_HC7t4HZ_o96i0-T341lIwg2.js HTTP/1.1Host: 053a3106-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nline.royaldesignbuild.sitesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /websocket/hook/?6B8zYC=ZTE5ODE1YWIzZDNhNDYzMjgwYzJhZWU2Mzk3ZTAxNzA= HTTP/1.1Host: 0nline.royaldesignbuild.siteConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nline.royaldesignbuild.siteSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="Sec-WebSocket-Key: 9m5wHEqTASUHyXAp+7AUuA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /?username=mbraedel@hilcorp.com&sso_reload=true HTTP/1.1Host: 0nline.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 0nline.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nline.royaldesignbuild.sitesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_QMJbZSc_Phofl-lfd63BLw2.js HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nline.royaldesignbuild.sitesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_pevuvrbnnz-5coi_b4jtbw2.js HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://0nline.royaldesignbuild.sitesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: l1ve.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /websocket/hook/?6B8zYC=ZTE5ODE1YWIzZDNhNDYzMjgwYzJhZWU2Mzk3ZTAxNzA= HTTP/1.1Host: 0nline.royaldesignbuild.siteConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nline.royaldesignbuild.siteSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: 3RtFLeeE/LuiVKE71XBaaA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: 2f2fa290-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /websocket/hook/?6B8zYC=ZTE5ODE1YWIzZDNhNDYzMjgwYzJhZWU2Mzk3ZTAxNzA= HTTP/1.1Host: 0nline.royaldesignbuild.siteConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nline.royaldesignbuild.siteSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: KQHsj3T8/0mPjGmePh3guw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4d4b76a02ae121e3b20c.js HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /hilcorp.com/winauth/ssoprobe?client-request-id=ceb7a41a-b756-43bf-b7d3-066e9fffa22a&_=1711654473870 HTTP/1.1Host: 898f3bcd-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /websocket/hook/?6B8zYC=ZTE5ODE1YWIzZDNhNDYzMjgwYzJhZWU2Mzk3ZTAxNzA= HTTP/1.1Host: 0nline.royaldesignbuild.siteConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nline.royaldesignbuild.siteSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: df0ahfCF54XPgMKjVf513A==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_ppassword_beba75e58c98af016c6f.js HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /common/instrumentation/dssostatus HTTP/1.1Host: 0nline.royaldesignbuild.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; brcap=0
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-dnukdvcuyrxzajeghhlkgrsw0mn8cw2uhbxodkn-5f8/logintenantbranding/0/illustration?ts=637898708869671586 HTTP/1.1Host: 795496cd-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-dnukdvcuyrxzajeghhlkgrsw0mn8cw2uhbxodkn-5f8/logintenantbranding/0/bannerlogo?ts=638254708363776654 HTTP/1.1Host: 795496cd-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-dnukdvcuyrxzajeghhlkgrsw0mn8cw2uhbxodkn-5f8/logintenantbranding/0/favicon?ts=638254683966698186 HTTP/1.1Host: 795496cd-e19815ab.royaldesignbuild.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://0nline.royaldesignbuild.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg HTTP/1.1Host: 4178995e-e19815ab.royaldesignbuild.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-dnukdvcuyrxzajeghhlkgrsw0mn8cw2uhbxodkn-5f8/logintenantbranding/0/illustration?ts=637898708869671586 HTTP/1.1Host: 795496cd-e19815ab.royaldesignbuild.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-dnukdvcuyrxzajeghhlkgrsw0mn8cw2uhbxodkn-5f8/logintenantbranding/0/favicon?ts=638254683966698186 HTTP/1.1Host: 795496cd-e19815ab.royaldesignbuild.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /dbd5a2dd-dnukdvcuyrxzajeghhlkgrsw0mn8cw2uhbxodkn-5f8/logintenantbranding/0/bannerlogo?ts=638254708363776654 HTTP/1.1Host: 795496cd-e19815ab.royaldesignbuild.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="
Source: global traffic	HTTP traffic detected: GET /websocket/hook/?6B8zYC=ZTE5ODE1YWIzZDNhNDYzMjgwYzJhZWU2Mzk3ZTAxNzA= HTTP/1.1Host: 0nline.royaldesignbuild.siteConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nline.royaldesignbuild.siteSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: Y/25clMboyGggEprGHYS6g==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /websocket/hook/?6B8zYC=ZTE5ODE1YWIzZDNhNDYzMjgwYzJhZWU2Mzk3ZTAxNzA= HTTP/1.1Host: 0nline.royaldesignbuild.siteConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nline.royaldesignbuild.siteSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: h15Y/5gIrRQA0eK5ZMpvZA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /websocket/hook/?6B8zYC=ZTE5ODE1YWIzZDNhNDYzMjgwYzJhZWU2Mzk3ZTAxNzA= HTTP/1.1Host: 0nline.royaldesignbuild.siteConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nline.royaldesignbuild.siteSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: N1zpA2R/uqMX50/0SLFJaQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /websocket/hook/?6B8zYC=ZTE5ODE1YWIzZDNhNDYzMjgwYzJhZWU2Mzk3ZTAxNzA= HTTP/1.1Host: 0nline.royaldesignbuild.siteConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://0nline.royaldesignbuild.siteSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 6B8zYC="ZTE5ODE1YWItM2QzYS00NjMyLTgwYzItYWVlNjM5N2UwMTcwOjM0OGQwM2VkLWY1ZTctNDEzZi05Y2VmLWRlNDM4ZjUwMjFhNA=="; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; brcap=0Sec-WebSocket-Key: V6F80T5V7ZymM8jF/R3SQA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

Source: unknown

DNS traffic detected: queries for: pepe-memes.com

Source: unknown

HTTP traffic detected: POST /?username=mbraedel@hilcorp.com HTTP/1.1Host: 0nline.royaldesignbuild.siteConnection: keep-aliveContent-Length: 1134Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://0nline.royaldesignbuild.siteContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://0nline.royaldesignbuild.site/?username=mbraedel@hilcorp.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Mar 2024 19:34:07 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 19:34:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 72662ebe-6f1d-4588-a44f-13194d4db802x-ms-ests-server: 2.1.17573.7 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://ee4b70c9-e19815ab.royaldesignbuild.site/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 19:34:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 6c6a21aa-e025-4bdb-a395-0d08a4569102x-ms-ests-server: 2.1.17573.7 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://ee4b70c9-e19815ab.royaldesignbuild.site/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 19:34:29 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: 7B1C056712DB486E856C036183F5F369 Ref B: DFW311000103047 Ref C: 2024-03-28T19:34:29Zaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 19:34:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: b3ac6b2f-c2b5-47ab-91cf-0bb338160900x-ms-ests-server: 2.1.17615.13 - NCUS ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://ee4b70c9-e19815ab.royaldesignbuild.site/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 19:34:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 822f8a58-c75d-430d-bcbf-2f414bff1800x-ms-ests-server: 2.1.17615.13 - WUS3 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://ee4b70c9-e19815ab.royaldesignbuild.site/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 19:34:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: b5ae912e-12fd-4fa5-b22a-e1b8b5f50b00x-ms-ests-server: 2.1.17615.13 - WUS3 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://ee4b70c9-e19815ab.royaldesignbuild.site/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 19:34:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: c87ab9c0-e51c-4e86-8b06-a39488a30b00x-ms-ests-server: 2.1.17615.13 - SCUS ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://ee4b70c9-e19815ab.royaldesignbuild.site/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 19:35:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 466e25b8-6e37-476e-bfcf-ab58573e0500x-ms-ests-server: 2.1.17615.13 - EUS ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://ee4b70c9-e19815ab.royaldesignbuild.site/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 28 Mar 2024 19:35:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 89d8e578-79f2-465d-9b04-9a0f953b0900x-ms-ests-server: 2.1.17615.13 - NCUS ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://ee4b70c9-e19815ab.royaldesignbuild.site/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: *access-control-allow-headers: *

Source: chromecache_71.2.dr, chromecache_81.2.dr

String found in binary or memory: http://ns.attribution.com/ads/1.0/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49753 version: TLS 1.2

System Summary

Source: classification engine

Classification label: mal72.phis.win@18/66@32/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2128,i,16002129619905839655,12144192990535214210,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pepe-memes.com/d/ax/q?user=mbraedel@hilcorp.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2128,i,16002129619905839655,12144192990535214210,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected