Edit tour

Windows Analysis Report
https:/hrf-production.us.auth0.com/u/reset-verify?ticket=oX8EPAbN9GVliGk7eT5TPNZKLzbKdTwr#

Overview

General Information

Sample URL:	https:/hrf-production.us.auth0.com/u/reset-verify?ticket=oX8EPAbN9GVliGk7eT5TPNZKLzbKdTwr#
Analysis ID:	1467219
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3020 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1984,i,14768218943604499707,5163116940037230257,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6480 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https:/hrf-production.us.auth0.com/u/reset-verify?ticket=oX8EPAbN9GVliGk7eT5TPNZKLzbKdTwr#" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 19:36:20 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeCF-Ray: 89d952e4f90bc330-EWRCF-Cache-Status: MISSCache-Control: public, max-age=300ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"Strict-Transport-Security: max-age=31536000; includeSubDomainsVary: Accept-Encodingbaggage: auth0-request-id=48f37382956898334079c4c55608c9datraceparent: 00-48f37382956898334079c4c55608c9da-ee0ac2dfad1f141a-01X-Auth0-Not-Found: 1X-Auth0-RequestId: 4a46333de6bd84d3fb2bX-Content-Type-Options: nosniffServer: cloudflarealt-svc: h3=":443"; ma=86400

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57797
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57799
Source: unknown	Network traffic detected: HTTP traffic on port 57799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:57797 version: TLS 1.2

Source: classification engine

Classification label: clean2.win@21/9@8/5

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1984,i,14768218943604499707,5163116940037230257,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https:/hrf-production.us.auth0.com/u/reset-verify?ticket=oX8EPAbN9GVliGk7eT5TPNZKLzbKdTwr#"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1984,i,14768218943604499707,5163116940037230257,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https:/hrf-production.us.auth0.com/u/reset-verify?ticket=oX8EPAbN9GVliGk7eT5TPNZKLzbKdTwr#	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://cdn.auth0.com/styleguide/components/1.0.8/media/logos/img/badge.png	0%	Avira URL Cloud	safe
https://hrf-production.us.auth0.com/u/reset-verify?ticket=oX8EPAbN9GVliGk7eT5TPNZKLzbKdTwr	0%	Avira URL Cloud	safe
https://hrf-production.us.auth0.com/favicon.ico	0%	Avira URL Cloud	safe
https://cdn.auth0.com/ulp/react-components/1.94.4/css/main.cdn.min.css	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	172.217.16.196	true	false	unknown
hrf-production.us.auth0.com	104.19.167.24	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
dp0wn1kjwhg75.cloudfront.net	18.239.16.41	true	false	unknown
cdn.auth0.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.auth0.com/styleguide/components/1.0.8/media/logos/img/badge.png	false	Avira URL Cloud: safe	unknown
https://cdn.auth0.com/ulp/react-components/1.94.4/css/main.cdn.min.css	false	Avira URL Cloud: safe	unknown
https://hrf-production.us.auth0.com/u/reset-verify?ticket=oX8EPAbN9GVliGk7eT5TPNZKLzbKdTwr	false	Avira URL Cloud: safe	unknown
https://hrf-production.us.auth0.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://hrf-production.us.auth0.com/u/reset-password/change?state=YWmbQAYtJAWzxl6oJEJpfP2DgGxLcrnU	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.239.16.41	dp0wn1kjwhg75.cloudfront.net	United States	16509	AMAZON-02US	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
104.19.167.24	hrf-production.us.auth0.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467219
Start date and time:	2024-07-03 21:35:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https:/hrf-production.us.auth0.com/u/reset-verify?ticket=oX8EPAbN9GVliGk7eT5TPNZKLzbKdTwr#
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@21/9@8/5

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.227, 216.58.206.46, 74.125.71.84, 34.104.35.123, 142.250.186.74, 142.250.186.106, 142.250.185.170, 142.250.185.138, 142.250.185.106, 172.217.23.106, 216.58.206.74, 172.217.16.202, 142.250.185.202, 142.250.186.170, 142.250.74.202, 142.250.186.138, 172.217.18.10, 216.58.212.138, 142.250.185.74, 142.250.184.234, 87.248.204.0, 192.229.221.95, 13.95.31.18, 20.242.39.171, 20.3.187.198, 52.165.164.15, 131.107.255.255, 142.250.186.163
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https:/hrf-production.us.auth0.com/u/reset-verify?ticket=oX8EPAbN9GVliGk7eT5TPNZKLzbKdTwr#

Input	Output
URL: https://hrf-production.us.auth0.com/u/reset-password/change?state=YWmbQAYtJAWzxl6oJEJpfP2DgGxLcrnU Model: Perplexity: mixtral-8x7b-instruct	{"loginform": true,"urgency": false,"captcha": false,"reasons": ["The webpage contains a form that requests sensitive information (password), therefore it is a login form.", "The text does not create a sense of urgency.", "There is no CAPTCHA or anti-robot detection mechanism present on the webpage."]}
Title: Reset your password \| All Applications OCR: Change Your Password Enter a new password below to change your password _ New password* Re-enter new password* Reset password
URL: https://hrf-production.us.auth0.com Model: gpt-4o	```json{ "phishing_score": 2, "brands": "Auth0", "phishing": false, "suspicious_domain": false, "has_prominent_loginform": true, "has_captcha": false, "setechniques": false, "has_suspicious_link": false, "legitmate_domain": "auth0.com", "reasons": "The URL 'https://hrf-production.us.auth0.com' appears to be a subdomain of 'auth0.com', which is a legitimate domain associated with the Auth0 brand. The page shows a password reset form, which is a common feature for legitimate sites. There are no obvious social engineering techniques or suspicious links present. The domain name does not appear to be suspicious, and it matches the legitimate domain for Auth0. Therefore, it is likely that this is a legitimate site."}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.110577243331642
Encrypted:	false
SSDEEP:	3:HnSB3iCR:HSB3iCR
MD5:	211EB2E07586717DCEC712C38CB62834
SHA1:	4E67E420BC3ACCB2A1D2876B18947AF01520F4E5
SHA-256:	78A31255390DB4ED37A31F6C0418A39B0AECEF4B328E5288A46B493ACEA2E227
SHA-512:	3FE5D53566E403F0AE3E85A36B3D027CB1D1ADE87ACA9EC063DBE88F307428CD60115747AE4B7804D8F408F6B52A414A8B3CBCEFADDC95AE837E20E1EB0FFD2C
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwm3ccYuSK5sLBIFDQCKMMESBQ3crzCM?alt=proto
Preview:	ChIKBw0AijDBGgAKBw3crzCMGgA=

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 152 x 168, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1591
Entropy (8bit):	7.775369623665417
Encrypted:	false
SSDEEP:	48:Yw3NF3dVJi1eAm9CD2hP0uP5+PkePqnD4hnP4:YQF3/NAF2hPP5+RckVP4
MD5:	E3842AC36D4FBD8D4E31A39999C0EBA6
SHA1:	758B15E719F9F9A01ADD02524629031AB9977F0B
SHA-256:	33FB88F606A3F32F2F218DF25DCC69283D9A555A0F8E253F2092F3AF53404C11
SHA-512:	53ABF59ED573C9261BE6082C18DA34616A38706D0B655CBFB798CD9A4C8117F5B0FA323E66DB83AE636C182D0C0C46A183DF88D192720606F68AED932B9AD06B
Malicious:	false
Reputation:	low
URL:	https://cdn.auth0.com/styleguide/components/1.0.8/media/logos/img/badge.png
Preview:	.PNG........IHDR.............+f....QPLTE....T".R#....(..S".C..R".R..S".P .G..S!.S".M..S".O..S".Q .O..S".Q!.Q!.R".P..P .T$.......tRNS........N.g...(.4..<.v..DY.......{IDATx....0.E...........>.5....:.q."....%k.^2....t............'.q.]WC.Ia.hH.N.I.t.,e.\..Y.&..`..R.'.;.5.RA..-..~...s'~j..G....e......D...e...O<w.@w$..bI....ux...P.O....C......"I>.....@N..<I.BI:....'.x..z.$o..Yn.$.Yn.O....e%.$.H...l..gY..{!.....r"7+?.^...GF..$....(...7."Y.^...?.Fh....l9.I.2.....+P..hV._..5A..4.j.+b....^#P.5.o..f).l.~Z~k_..@,I~...A8. QC.. ....._......_.....\.........YAv.l.T.nS]....r....^<!+.o.....!..b.....21.......[.).y%........+Qi\|y]1.+.3(M....G.....S{m......t..b..4..\|:.7@P._^>..>..@.'/....W.}.o.x........}..Js..c.T.+=.CJ^>...Cy.=.=..6.~........W....^..J..3.....J..G.x.@RiGb..8....\|JT?.....hp.>.SV^..{.5YIy9...Z3R..n....k7....$..!......46....F.,.....A.O.....D.N.....%.@.@?..`.....D...M.`BOE.I:j.0.".$g.d.>.;...P.+8.1.<a./,......Lv..\|.&)........>..L..@

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 152 x 168, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1591
Entropy (8bit):	7.775369623665417
Encrypted:	false
SSDEEP:	48:Yw3NF3dVJi1eAm9CD2hP0uP5+PkePqnD4hnP4:YQF3/NAF2hPP5+RckVP4
MD5:	E3842AC36D4FBD8D4E31A39999C0EBA6
SHA1:	758B15E719F9F9A01ADD02524629031AB9977F0B
SHA-256:	33FB88F606A3F32F2F218DF25DCC69283D9A555A0F8E253F2092F3AF53404C11
SHA-512:	53ABF59ED573C9261BE6082C18DA34616A38706D0B655CBFB798CD9A4C8117F5B0FA323E66DB83AE636C182D0C0C46A183DF88D192720606F68AED932B9AD06B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............+f....QPLTE....T".R#....(..S".C..R".R..S".P .G..S!.S".M..S".O..S".Q .O..S".Q!.Q!.R".P..P .T$.......tRNS........N.g...(.4..<.v..DY.......{IDATx....0.E...........>.5....:.q."....%k.^2....t............'.q.]WC.Ia.hH.N.I.t.,e.\..Y.&..`..R.'.;.5.RA..-..~...s'~j..G....e......D...e...O<w.@w$..bI....ux...P.O....C......"I>.....@N..<I.BI:....'.x..z.$o..Yn.$.Yn.O....e%.$.H...l..gY..{!.....r"7+?.^...GF..$....(...7."Y.^...?.Fh....l9.I.2.....+P..hV._..5A..4.j.+b....^#P.5.o..f).l.~Z~k_..@,I~...A8. QC.. ....._......_.....\.........YAv.l.T.nS]....r....^<!+.o.....!..b.....21.......[.).y%........+Qi\|y]1.+.3(M....G.....S{m......t..b..4..\|:.7@P._^>..>..@.'/....W.}.o.x........}..Js..c.T.+=.CJ^>...Cy.=.=..6.~........W....^..J..3.....J..G.x.@RiGb..8....\|JT?.....hp.>.SV^..{.5YIy9...Z3R..n....k7....$..!......46....F.,.....A.O.....D.N.....%.@.@?..`.....D...M.`BOE.I:j.0.".$g.d.>.;...P.+8.1.<a./,......Lv..\|.&)........>..L..@

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65528), with no line terminators
Category:	downloaded
Size (bytes):	279323
Entropy (8bit):	5.325706382699083
Encrypted:	false
SSDEEP:	1536:sjdeHUSfevNGipNk6268y8xV9sCEFrrdc0UgXsqe+vmO4fU7xW+ek6S3wg2wsc1L:Ud8evnj2TGXqixyk6SHsyDrbykAc
MD5:	78627D3B768913EA4BA479D723FEED27
SHA1:	434780DF4AA6D005695C45891C8039388B8817EA
SHA-256:	0F006723E0CFE5E14308282F25ABEBAA3D8E72CE593E765EFB904084779E7699
SHA-512:	91FB9BB02C230B243023CF2DF690D9D91BB7FF747A19DBB310AA8AEDF2C67E9294F9024EC9B931659D86597F9A386087F2B666791E8E11049B6348887EC3E41F
Malicious:	false
Reputation:	low
URL:	https://cdn.auth0.com/ulp/react-components/1.94.4/css/main.cdn.min.css
Preview:	a,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,em,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,main,mark,menu,nav,object,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section{display:block}[hidden]{display:none}body{line-height:1}menu,ol,ul{list-style:none}blockquote,q{quotes:none}blockquote:after,blockquote:before,q:after,q:before{content:"";content:none}table{border-collapse:collapse;border-spacing:0}.cca50d281{display:inline-block;width:20px;height:20px;position:relative;background-size:contain;background-repeat:no-repeat;background-position:50%}.cca50d281[data-provider^=apple]{backgrou

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	9
Entropy (8bit):	2.94770277922009
Encrypted:	false
SSDEEP:	3:Obn:Obn
MD5:	9D1EAD73E678FA2F51A70A933B0BF017
SHA1:	D205CBD6783332A212C5AE92D73C77178C2D2F28
SHA-256:	0019DFC4B32D63C1392AA264AED2253C1E0C2FB09216F8E2CC269BBFB8BB49B5
SHA-512:	935B3D516E996F6D25948BA8A54C1B7F70F7F0E3F517E36481FDF0196C2C5CFC2841F86E891F3DF9517746B7FB605DB47CDDED1B8FF78D9482DDAA621DB43A34
Malicious:	false
Reputation:	low
URL:	https://hrf-production.us.auth0.com/favicon.ico
Preview:	Not Found

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 21:36:03.013890982 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 3, 2024 21:36:12.701278925 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 3, 2024 21:36:16.552710056 CEST	49735	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:16.552753925 CEST	443	49735	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:16.552818060 CEST	49735	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:16.553108931 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:16.553116083 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:16.553428888 CEST	49735	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:16.553443909 CEST	443	49735	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:16.553457975 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:16.553742886 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:16.553755999 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.026751041 CEST	443	49735	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.027076006 CEST	49735	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.027106047 CEST	443	49735	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.028140068 CEST	443	49735	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.028209925 CEST	49735	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.029942036 CEST	49735	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.030013084 CEST	443	49735	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.030201912 CEST	49735	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.047243118 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.047457933 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.047468901 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.048688889 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.048758984 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.049104929 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.049185991 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.076508045 CEST	443	49735	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.079648018 CEST	49735	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.079659939 CEST	443	49735	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.094978094 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.094986916 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.126615047 CEST	49735	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.141849995 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.356658936 CEST	443	49735	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.356801987 CEST	443	49735	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.356890917 CEST	49735	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.358721972 CEST	49735	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.358743906 CEST	443	49735	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.359668970 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.359684944 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.656461000 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.656522036 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.656550884 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.656579018 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.656578064 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.656599045 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.656640053 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.657213926 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.657267094 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.657274961 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.657305956 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.657354116 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.657361031 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.658123016 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.658154964 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.658184052 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.658194065 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.658240080 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.661094904 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.690434933 CEST	49739	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:17.690459967 CEST	443	49739	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:17.690529108 CEST	49739	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:17.690841913 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:17.690882921 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:17.690953016 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:17.691252947 CEST	49739	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:17.691267014 CEST	443	49739	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:17.691596985 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:17.691608906 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:17.715727091 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.750077963 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.750144005 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.750173092 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.750195026 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.750206947 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.750236988 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.750245094 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.750252962 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.750296116 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.750303030 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.750410080 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.750428915 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.750448942 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.750458956 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.750495911 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.750555992 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.751216888 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.751238108 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.751264095 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.751272917 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.751312971 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.751321077 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.751348972 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.751374960 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.751385927 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.751393080 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.751429081 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.751847982 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.752026081 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.752051115 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.752068043 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.752074957 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.752096891 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.752110958 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.752118111 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.752161026 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.752202988 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.791639090 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.791754007 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.791775942 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.841200113 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.843748093 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.843903065 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.843909979 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.843966961 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.843981981 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.844012976 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.844060898 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.844073057 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.844111919 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.844326973 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.844335079 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.844384909 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.844526052 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.844532967 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.844569921 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.844588041 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.844697952 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.844747066 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.845328093 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.845371962 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.845381975 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.845397949 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.845433950 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.845441103 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.845479965 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:17.845518112 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.860963106 CEST	49736	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:17.860982895 CEST	443	49736	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:18.406774998 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.407202959 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.407227039 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.408246994 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.408281088 CEST	443	49739	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.408319950 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.408806086 CEST	49739	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.408833027 CEST	443	49739	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.409924030 CEST	443	49739	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.409986973 CEST	49739	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.418046951 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.418171883 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.418273926 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.418289900 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.418802023 CEST	49739	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.418919086 CEST	443	49739	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.422008038 CEST	49739	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.422018051 CEST	443	49739	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.459641933 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.476001978 CEST	49739	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.654670954 CEST	443	49739	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.654692888 CEST	443	49739	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.654747963 CEST	49739	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.654764891 CEST	443	49739	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.654963970 CEST	443	49739	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.655009985 CEST	49739	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.658036947 CEST	49739	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.658051014 CEST	443	49739	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.658849001 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.658880949 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.658888102 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.658910990 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.658941984 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.658946991 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.658962965 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.658974886 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.658992052 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.659027100 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.691478968 CEST	49741	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.691500902 CEST	443	49741	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.691639900 CEST	49741	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.692044020 CEST	49741	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.692060947 CEST	443	49741	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.743033886 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.743057013 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.743109941 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.743129969 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.743168116 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.743180990 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.748859882 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.748887062 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.748917103 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.748924971 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.748959064 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.748972893 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.833952904 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.833972931 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.834038019 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.834050894 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.834099054 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.834954023 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.834969997 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.835026979 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.835036039 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.835078955 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.835530043 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.835555077 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.835585117 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.835591078 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.835629940 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.835649967 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.838697910 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.838711977 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.838774920 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.838781118 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.838818073 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.922497988 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.922528982 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.922574043 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.922586918 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.922610998 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.922626019 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.923039913 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.923053980 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.923093081 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.923098087 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.923129082 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.923151970 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.923959970 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.923974037 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.924014091 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.924020052 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.924046993 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.924065113 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.924386978 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.924401999 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.924458027 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.924463034 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.924504042 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.927264929 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.927279949 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.927335024 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.927340031 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.927377939 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.927839041 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.927865028 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.927925110 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.927931070 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.927973032 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.928752899 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.928770065 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.928814888 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.928818941 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:18.928853035 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:18.928869009 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.012362003 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.012403011 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.012444973 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.012464046 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.012489080 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.012506008 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.012783051 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.012799978 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.012880087 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.012886047 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.012932062 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.013592005 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.013619900 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.013655901 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.013660908 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.013670921 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.013705015 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.013732910 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.013736963 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.013773918 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.013789892 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.013840914 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.013895035 CEST	49740	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.013910055 CEST	443	49740	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.429697037 CEST	49742	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:36:19.429729939 CEST	443	49742	172.217.16.196	192.168.2.4
Jul 3, 2024 21:36:19.429789066 CEST	49742	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:36:19.430196047 CEST	49742	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:36:19.430212021 CEST	443	49742	172.217.16.196	192.168.2.4
Jul 3, 2024 21:36:19.431400061 CEST	49743	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:19.431451082 CEST	443	49743	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:19.431516886 CEST	49743	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:19.432267904 CEST	49743	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:19.432286024 CEST	443	49743	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:19.442820072 CEST	443	49741	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.443026066 CEST	49741	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.443034887 CEST	443	49741	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.444025993 CEST	443	49741	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.444088936 CEST	49741	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.444726944 CEST	49741	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.444787979 CEST	443	49741	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.444942951 CEST	49741	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.444950104 CEST	443	49741	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.487366915 CEST	49741	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.705455065 CEST	443	49741	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.705471992 CEST	443	49741	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.705586910 CEST	49741	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.705602884 CEST	443	49741	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.705739021 CEST	443	49741	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.705923080 CEST	49741	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.710464001 CEST	49741	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.710464001 CEST	49741	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.710478067 CEST	443	49741	18.239.16.41	192.168.2.4
Jul 3, 2024 21:36:19.710603952 CEST	49741	443	192.168.2.4	18.239.16.41
Jul 3, 2024 21:36:19.754595041 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:19.754625082 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:19.758250952 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:19.762095928 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:19.762113094 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:19.907032967 CEST	443	49743	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:19.907520056 CEST	49743	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:19.907538891 CEST	443	49743	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:19.907881975 CEST	443	49743	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:19.910725117 CEST	49743	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:19.910792112 CEST	443	49743	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:19.911082029 CEST	49743	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:19.952503920 CEST	443	49743	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:20.176323891 CEST	443	49743	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:20.176397085 CEST	443	49743	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:20.176570892 CEST	49743	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:20.187835932 CEST	49743	443	192.168.2.4	104.19.167.24
Jul 3, 2024 21:36:20.187854052 CEST	443	49743	104.19.167.24	192.168.2.4
Jul 3, 2024 21:36:20.209172964 CEST	443	49742	172.217.16.196	192.168.2.4
Jul 3, 2024 21:36:20.209935904 CEST	49742	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:36:20.209964037 CEST	443	49742	172.217.16.196	192.168.2.4
Jul 3, 2024 21:36:20.210956097 CEST	443	49742	172.217.16.196	192.168.2.4
Jul 3, 2024 21:36:20.211138010 CEST	49742	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:36:20.213232040 CEST	49742	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:36:20.213295937 CEST	443	49742	172.217.16.196	192.168.2.4
Jul 3, 2024 21:36:20.262960911 CEST	49742	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:36:20.262970924 CEST	443	49742	172.217.16.196	192.168.2.4
Jul 3, 2024 21:36:20.309775114 CEST	49742	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:36:20.426403046 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:20.430226088 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:20.450109959 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:20.450139046 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:20.450402021 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:20.498744965 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:20.567486048 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:20.608513117 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:20.758630037 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:20.758713961 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:20.758760929 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:20.758868933 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:20.758884907 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:20.758898020 CEST	49745	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:20.758904934 CEST	443	49745	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:20.804949045 CEST	49746	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:20.804970980 CEST	443	49746	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:20.805041075 CEST	49746	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:20.805742025 CEST	49746	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:20.805754900 CEST	443	49746	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:21.466615915 CEST	443	49746	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:21.466702938 CEST	49746	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:21.469196081 CEST	49746	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:21.469208956 CEST	443	49746	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:21.469439030 CEST	443	49746	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:21.472060919 CEST	49746	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:21.512501955 CEST	443	49746	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:21.748634100 CEST	443	49746	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:21.748697042 CEST	443	49746	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:21.750180960 CEST	49746	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:21.750180960 CEST	49746	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:21.750231981 CEST	49746	443	192.168.2.4	184.28.90.27
Jul 3, 2024 21:36:21.750248909 CEST	443	49746	184.28.90.27	192.168.2.4
Jul 3, 2024 21:36:25.145989895 CEST	49747	443	192.168.2.4	13.85.23.86
Jul 3, 2024 21:36:25.146019936 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:25.146119118 CEST	49747	443	192.168.2.4	13.85.23.86
Jul 3, 2024 21:36:25.147108078 CEST	49747	443	192.168.2.4	13.85.23.86
Jul 3, 2024 21:36:25.147126913 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:25.874922037 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:25.875123024 CEST	49747	443	192.168.2.4	13.85.23.86
Jul 3, 2024 21:36:25.878068924 CEST	49747	443	192.168.2.4	13.85.23.86
Jul 3, 2024 21:36:25.878082991 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:25.878336906 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:25.920986891 CEST	49747	443	192.168.2.4	13.85.23.86
Jul 3, 2024 21:36:26.585936069 CEST	49747	443	192.168.2.4	13.85.23.86
Jul 3, 2024 21:36:26.628496885 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:26.828773975 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:26.828794003 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:26.828802109 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:26.828825951 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:26.828866005 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:26.828870058 CEST	49747	443	192.168.2.4	13.85.23.86
Jul 3, 2024 21:36:26.828902960 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:26.828922033 CEST	49747	443	192.168.2.4	13.85.23.86
Jul 3, 2024 21:36:26.828929901 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:26.828953981 CEST	49747	443	192.168.2.4	13.85.23.86
Jul 3, 2024 21:36:26.828969002 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:26.828984022 CEST	49747	443	192.168.2.4	13.85.23.86
Jul 3, 2024 21:36:26.829013109 CEST	49747	443	192.168.2.4	13.85.23.86
Jul 3, 2024 21:36:27.497611046 CEST	49747	443	192.168.2.4	13.85.23.86
Jul 3, 2024 21:36:27.497633934 CEST	443	49747	13.85.23.86	192.168.2.4
Jul 3, 2024 21:36:28.837599993 CEST	52194	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:28.842377901 CEST	53	52194	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:28.842441082 CEST	52194	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:28.842489958 CEST	52194	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:28.847256899 CEST	53	52194	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:29.306904078 CEST	53	52194	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:29.308110952 CEST	52194	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:29.313891888 CEST	53	52194	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:29.313950062 CEST	52194	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:30.002397060 CEST	443	49742	172.217.16.196	192.168.2.4
Jul 3, 2024 21:36:30.002466917 CEST	443	49742	172.217.16.196	192.168.2.4
Jul 3, 2024 21:36:30.002535105 CEST	49742	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:36:30.520683050 CEST	80	49723	217.20.57.18	192.168.2.4
Jul 3, 2024 21:36:30.521609068 CEST	49723	80	192.168.2.4	217.20.57.18
Jul 3, 2024 21:36:30.610321999 CEST	49723	80	192.168.2.4	217.20.57.18
Jul 3, 2024 21:36:30.615164042 CEST	80	49723	217.20.57.18	192.168.2.4
Jul 3, 2024 21:36:31.235146999 CEST	49742	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:36:31.235172987 CEST	443	49742	172.217.16.196	192.168.2.4
Jul 3, 2024 21:36:44.977679014 CEST	80	49724	217.20.57.18	192.168.2.4
Jul 3, 2024 21:36:44.977782011 CEST	49724	80	192.168.2.4	217.20.57.18
Jul 3, 2024 21:36:44.978039980 CEST	49724	80	192.168.2.4	217.20.57.18
Jul 3, 2024 21:36:44.982770920 CEST	80	49724	217.20.57.18	192.168.2.4
Jul 3, 2024 21:36:56.976183891 CEST	57795	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:56.980979919 CEST	53	57795	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:56.981043100 CEST	57795	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:56.981122971 CEST	57795	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:56.985827923 CEST	53	57795	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:58.403634071 CEST	53	57795	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:58.404059887 CEST	53	57795	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:58.404093027 CEST	57795	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:58.404181957 CEST	57795	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:58.404558897 CEST	53	57795	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:58.404728889 CEST	57795	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:58.406517982 CEST	53	57795	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:58.406749964 CEST	57795	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:58.412909031 CEST	53	57795	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:58.413001060 CEST	57795	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:37:05.519321918 CEST	57797	443	192.168.2.4	40.68.123.157
Jul 3, 2024 21:37:05.519366980 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:05.519433975 CEST	57797	443	192.168.2.4	40.68.123.157
Jul 3, 2024 21:37:05.519834042 CEST	57797	443	192.168.2.4	40.68.123.157
Jul 3, 2024 21:37:05.519843102 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:06.325699091 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:06.325787067 CEST	57797	443	192.168.2.4	40.68.123.157
Jul 3, 2024 21:37:06.329523087 CEST	57797	443	192.168.2.4	40.68.123.157
Jul 3, 2024 21:37:06.329534054 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:06.329766989 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:06.338131905 CEST	57797	443	192.168.2.4	40.68.123.157
Jul 3, 2024 21:37:06.384495974 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:06.665973902 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:06.665999889 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:06.666016102 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:06.666105032 CEST	57797	443	192.168.2.4	40.68.123.157
Jul 3, 2024 21:37:06.666119099 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:06.666177988 CEST	57797	443	192.168.2.4	40.68.123.157
Jul 3, 2024 21:37:06.666671991 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:06.666712999 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:06.666729927 CEST	57797	443	192.168.2.4	40.68.123.157
Jul 3, 2024 21:37:06.666737080 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:06.666914940 CEST	57797	443	192.168.2.4	40.68.123.157
Jul 3, 2024 21:37:06.666973114 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:06.667098045 CEST	57797	443	192.168.2.4	40.68.123.157
Jul 3, 2024 21:37:06.671375036 CEST	57797	443	192.168.2.4	40.68.123.157
Jul 3, 2024 21:37:06.671391010 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:06.671468019 CEST	57797	443	192.168.2.4	40.68.123.157
Jul 3, 2024 21:37:06.671473026 CEST	443	57797	40.68.123.157	192.168.2.4
Jul 3, 2024 21:37:19.447843075 CEST	57799	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:37:19.447879076 CEST	443	57799	172.217.16.196	192.168.2.4
Jul 3, 2024 21:37:19.447936058 CEST	57799	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:37:19.448508024 CEST	57799	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:37:19.448518991 CEST	443	57799	172.217.16.196	192.168.2.4
Jul 3, 2024 21:37:20.351061106 CEST	443	57799	172.217.16.196	192.168.2.4
Jul 3, 2024 21:37:20.351417065 CEST	57799	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:37:20.351447105 CEST	443	57799	172.217.16.196	192.168.2.4
Jul 3, 2024 21:37:20.351785898 CEST	443	57799	172.217.16.196	192.168.2.4
Jul 3, 2024 21:37:20.352144003 CEST	57799	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:37:20.352217913 CEST	443	57799	172.217.16.196	192.168.2.4
Jul 3, 2024 21:37:20.403551102 CEST	57799	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:37:30.248918056 CEST	443	57799	172.217.16.196	192.168.2.4
Jul 3, 2024 21:37:30.248991013 CEST	443	57799	172.217.16.196	192.168.2.4
Jul 3, 2024 21:37:30.249113083 CEST	57799	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:37:31.205594063 CEST	57799	443	192.168.2.4	172.217.16.196
Jul 3, 2024 21:37:31.205624104 CEST	443	57799	172.217.16.196	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 21:36:14.856584072 CEST	53	49330	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:15.010405064 CEST	53	53718	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:16.049482107 CEST	53	65453	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:16.537837029 CEST	58635	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:16.538126945 CEST	57345	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:16.547976971 CEST	53	58635	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:16.552028894 CEST	53	57345	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:17.681379080 CEST	55406	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:17.681710958 CEST	50665	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:17.689507961 CEST	53	50665	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:17.689707994 CEST	53	55406	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:18.682074070 CEST	63095	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:18.682682037 CEST	64027	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:18.690491915 CEST	53	63095	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:18.690509081 CEST	53	64027	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:19.397391081 CEST	62455	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:19.397610903 CEST	64048	53	192.168.2.4	1.1.1.1
Jul 3, 2024 21:36:19.404722929 CEST	53	62455	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:19.404742956 CEST	53	64048	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:19.435610056 CEST	53	52554	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:28.836960077 CEST	53	62863	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:31.020745039 CEST	138	138	192.168.2.4	192.168.2.255
Jul 3, 2024 21:36:32.935771942 CEST	53	55689	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:51.915920019 CEST	53	57105	1.1.1.1	192.168.2.4
Jul 3, 2024 21:36:56.975749016 CEST	53	65315	1.1.1.1	192.168.2.4
Jul 3, 2024 21:37:14.617685080 CEST	53	56676	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 21:36:16.537837029 CEST	192.168.2.4	1.1.1.1	0xfc4d	Standard query (0)	hrf-production.us.auth0.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:36:16.538126945 CEST	192.168.2.4	1.1.1.1	0x7362	Standard query (0)	hrf-production.us.auth0.com	65	IN (0x0001)	false
Jul 3, 2024 21:36:17.681379080 CEST	192.168.2.4	1.1.1.1	0x74c8	Standard query (0)	cdn.auth0.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:36:17.681710958 CEST	192.168.2.4	1.1.1.1	0x8fb	Standard query (0)	cdn.auth0.com	65	IN (0x0001)	false
Jul 3, 2024 21:36:18.682074070 CEST	192.168.2.4	1.1.1.1	0x2fc3	Standard query (0)	cdn.auth0.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:36:18.682682037 CEST	192.168.2.4	1.1.1.1	0x33fa	Standard query (0)	cdn.auth0.com	65	IN (0x0001)	false
Jul 3, 2024 21:36:19.397391081 CEST	192.168.2.4	1.1.1.1	0x6fe0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:36:19.397610903 CEST	192.168.2.4	1.1.1.1	0x1e17	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 21:36:16.547976971 CEST	1.1.1.1	192.168.2.4	0xfc4d	No error (0)	hrf-production.us.auth0.com		104.19.167.24	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:36:16.547976971 CEST	1.1.1.1	192.168.2.4	0xfc4d	No error (0)	hrf-production.us.auth0.com		104.19.168.24	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:36:17.689507961 CEST	1.1.1.1	192.168.2.4	0x8fb	No error (0)	cdn.auth0.com	dp0wn1kjwhg75.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:36:17.689707994 CEST	1.1.1.1	192.168.2.4	0x74c8	No error (0)	cdn.auth0.com	dp0wn1kjwhg75.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:36:17.689707994 CEST	1.1.1.1	192.168.2.4	0x74c8	No error (0)	dp0wn1kjwhg75.cloudfront.net		18.239.16.41	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:36:18.690491915 CEST	1.1.1.1	192.168.2.4	0x2fc3	No error (0)	cdn.auth0.com	dp0wn1kjwhg75.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:36:18.690491915 CEST	1.1.1.1	192.168.2.4	0x2fc3	No error (0)	dp0wn1kjwhg75.cloudfront.net		18.239.16.41	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:36:18.690509081 CEST	1.1.1.1	192.168.2.4	0x33fa	No error (0)	cdn.auth0.com	dp0wn1kjwhg75.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:36:19.404722929 CEST	1.1.1.1	192.168.2.4	0x6fe0	No error (0)	www.google.com		172.217.16.196	A (IP address)	IN (0x0001)	false
Jul 3, 2024 21:36:19.404742956 CEST	1.1.1.1	192.168.2.4	0x1e17	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 3, 2024 21:36:26.629981995 CEST	1.1.1.1	192.168.2.4	0x7dc6	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 21:36:26.629981995 CEST	1.1.1.1	192.168.2.4	0x7dc6	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

hrf-production.us.auth0.com

cdn.auth0.com

https:

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	104.19.167.24	443	5016	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:36:17 UTC	724	OUT	GET /u/reset-verify?ticket=oX8EPAbN9GVliGk7eT5TPNZKLzbKdTwr HTTP/1.1 Host: hrf-production.us.auth0.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:36:17 UTC	1258	IN	HTTP/1.1 302 Found Date: Wed, 03 Jul 2024 19:36:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 170 Connection: close Location: /u/reset-password/change?state=YWmbQAYtJAWzxl6oJEJpfP2DgGxLcrnU CF-Ray: 89d952d2dae2c481-EWR CF-Cache-Status: DYNAMIC Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0, no-transform Set-Cookie: did=s%3Av0%3Ac1193269-7883-4dbc-8df2-eddc499a065c.kBFpHUP%2Fxbd45qVYKs0PSeU677Spvdpimr3HJlLlH7A; Max-Age=31557600; Path=/; Expires=Fri, 04 Jul 2025 01:36:17 GMT; HttpOnly; Secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Accept baggage: auth0-request-id=56be2c729c0e3ad4cc80a923f3c07f99 Set-Cookie: auth0=s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQM1jqOHvIOiGLklVZJVW8e1aZ_JhoVvyQfKI5DhBv8tAxtlBgwH89_U4HA3nw-VNPiq2xdkHF0hZQ-ES2QY0xEymY29va2llg6dleHBpcmVz1_8_qGMAZomcsa5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.vbX16a4Lj3ax0R14H6XGHmbm9VMsi0plQreo%2Bw8YWAk; Path=/; Expires=Sat, 06 Jul 2024 19:36:17 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: did_compat=s%3Av0%3Ac1193269-7883-4dbc-8df2-eddc499a065c.kBFpHUP%2Fxbd45qVYKs0PSeU677Spvdpimr3HJlLlH7A; Max-Age=31557600; Path=/; Expires=Fri, 04 Jul 2025 01:36:17 GMT; HttpOnly; Secure
2024-07-03 19:36:17 UTC	615	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 61 75 74 68 30 5f 63 6f 6d 70 61 74 3d 73 25 33 41 76 31 2e 67 61 64 7a 5a 58 4e 7a 61 57 39 75 67 71 5a 6f 59 57 35 6b 62 47 58 45 51 4d 31 6a 71 4f 48 76 49 4f 69 47 4c 6b 6c 56 5a 4a 56 57 38 65 31 61 5a 5f 4a 68 6f 56 76 79 51 66 4b 49 35 44 68 42 76 38 74 41 78 74 6c 42 67 77 48 38 39 5f 55 34 48 41 33 6e 77 2d 56 4e 50 69 71 32 78 64 6b 48 46 30 68 5a 51 2d 45 53 32 51 59 30 78 45 79 6d 59 32 39 76 61 32 6c 6c 67 36 64 6c 65 48 42 70 63 6d 56 7a 31 5f 38 5f 71 47 4d 41 5a 6f 6d 63 73 61 35 76 63 6d 6c 6e 61 57 35 68 62 45 31 68 65 45 46 6e 5a 63 34 50 63 78 51 41 71 48 4e 68 62 57 56 54 61 58 52 6c 70 47 35 76 62 6d 55 2e 76 62 58 31 36 61 34 4c 6a 33 61 78 30 52 31 34 48 36 58 47 48 6d 62 6d 39 56 4d 73 69 30 70 Data Ascii: Set-Cookie: auth0_compat=s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQM1jqOHvIOiGLklVZJVW8e1aZ_JhoVvyQfKI5DhBv8tAxtlBgwH89_U4HA3nw-VNPiq2xdkHF0hZQ-ES2QY0xEymY29va2llg6dleHBpcmVz1_8_qGMAZomcsa5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.vbX16a4Lj3ax0R14H6XGHmbm9VMsi0p
2024-07-03 19:36:17 UTC	170	IN	Data Raw: 3c 70 3e 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 2f 75 2f 72 65 73 65 74 2d 70 61 73 73 77 6f 72 64 2f 63 68 61 6e 67 65 3f 73 74 61 74 65 3d 59 57 6d 62 51 41 59 74 4a 41 57 7a 78 6c 36 6f 4a 45 4a 70 66 50 32 44 67 47 78 4c 63 72 6e 55 22 3e 2f 75 2f 72 65 73 65 74 2d 70 61 73 73 77 6f 72 64 2f 63 68 61 6e 67 65 3f 73 74 61 74 65 3d 59 57 6d 62 51 41 59 74 4a 41 57 7a 78 6c 36 6f 4a 45 4a 70 66 50 32 44 67 47 78 4c 63 72 6e 55 3c 2f 61 3e 3c 2f 70 3e Data Ascii: <p>Found. Redirecting to <a href="/u/reset-password/change?state=YWmbQAYtJAWzxl6oJEJpfP2DgGxLcrnU">/u/reset-password/change?state=YWmbQAYtJAWzxl6oJEJpfP2DgGxLcrnU</a></p>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	104.19.167.24	443	5016	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:36:17 UTC	1452	OUT	GET /u/reset-password/change?state=YWmbQAYtJAWzxl6oJEJpfP2DgGxLcrnU HTTP/1.1 Host: hrf-production.us.auth0.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: did=s%3Av0%3Ac1193269-7883-4dbc-8df2-eddc499a065c.kBFpHUP%2Fxbd45qVYKs0PSeU677Spvdpimr3HJlLlH7A; auth0=s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQM1jqOHvIOiGLklVZJVW8e1aZ_JhoVvyQfKI5DhBv8tAxtlBgwH89_U4HA3nw-VNPiq2xdkHF0hZQ-ES2QY0xEymY29va2llg6dleHBpcmVz1_8_qGMAZomcsa5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.vbX16a4Lj3ax0R14H6XGHmbm9VMsi0plQreo%2Bw8YWAk; did_compat=s%3Av0%3Ac1193269-7883-4dbc-8df2-eddc499a065c.kBFpHUP%2Fxbd45qVYKs0PSeU677Spvdpimr3HJlLlH7A; auth0_compat=s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQM1jqOHvIOiGLklVZJVW8e1aZ_JhoVvyQfKI5DhBv8tAxtlBgwH89_U4HA3nw-VNPiq2xdkHF0hZQ-ES2QY0xEymY29va2llg6dleHBpcmVz1_8_qGMAZomcsa5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.vbX16a4Lj3ax0R14H6XGHmbm9VMsi0plQreo%2Bw8YWAk
2024-07-03 19:36:17 UTC	964	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 19:36:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 89d952d4d9dd4340-EWR CF-Cache-Status: DYNAMIC Cache-Control: no-store, max-age=0, no-transform Content-Language: en ETag: W/"13c9c-7603SizIbW8j5GKqk7bSoXhhCJA" Expires: Wed, 03 Jul 2024 19:36:17 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Accept-Encoding baggage: auth0-request-id=d5072321dde694f83afe847340714dd9 Content-Security-Policy: frame-ancestors 'none' Pragma: no-cache Referrer-Policy: same-origin traceparent: 00-d5072321dde694f83afe847340714dd9-8aaf34da4c67eeec-01 X-Auth0-RequestId: cfc23ff0cbfa999f1489 X-Content-Type-Options: nosniff X-Frame-Options: deny X-RateLimit-Limit: 20 X-RateLimit-Remaining: 19 X-RateLimit-Reset: 1720035384 X-Robots-Tag: noindex, nofollow X-XSS-Protection: 1; mode=block Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-07-03 19:36:17 UTC	405	IN	Data Raw: 37 62 65 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 20 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 75 6c 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e Data Ascii: 7be5<!DOCTYPE html> <html lang="en" > <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="ulp-version" conten
2024-07-03 19:36:17 UTC	1369	IN	Data Raw: 2f 72 65 61 63 74 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2f 31 2e 39 34 2e 34 2f 63 73 73 2f 6d 61 69 6e 2e 63 64 6e 2e 6d 69 6e 2e 63 73 73 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 69 64 3d 22 63 75 73 74 6f 6d 2d 73 74 79 6c 65 73 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 0a 62 6f 64 79 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 30 30 30 3b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 75 6c 70 2d 66 6f 6e 74 2c 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 52 6f 62 6f 74 6f 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 2e 63 61 66 65 62 66 61 62 37 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 30 Data Ascii: /react-components/1.94.4/css/main.cdn.min.css"> <style id="custom-styles-container"> body { background: #000; font-family: ulp-font, -apple-system, BlinkMacSystemFont, Roboto, Helvetica, sans-serif;}.cafebfab7 { background: #0
2024-07-03 19:36:17 UTC	1369	IN	Data Raw: 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 61 70 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 70 78 3b 0a 20 20 20 20 7d 0a 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 2f 2a 20 57 65 20 75 73 65 20 21 69 6d 70 6f 72 74 61 6e 74 20 74 6f 20 6f 76 65 72 72 69 64 65 20 74 68 65 20 64 65 66 61 75 6c 74 20 66 6f 72 20 6a 73 20 65 6e 61 62 6c 65 64 20 2a 2f 0a 20 20 20 20 20 20 2f 2a 20 49 66 20 74 68 65 20 64 69 73 70 6c 61 79 20 73 68 6f 75 6c 64 20 62 65 20 6f 74 68 65 72 20 74 68 61 6e 20 62 6c 6f 63 6b 2c 20 69 74 20 73 68 6f 75 6c 64 20 62 65 20 64 65 66 69 6e 65 64 20 73 70 65 63 69 66 69 63 61 6c 6c 79 20 68 65 72 65 Data Ascii: bsolute; white-space: nowrap; width: 1px; } </style> <noscript> <style> /* We use !important to override the default for js enabled / / If the display should be other than block, it should be defined specifically here
2024-07-03 19:36:17 UTC	1369	IN	Data Raw: 6d 65 64 69 61 2f 6c 6f 67 6f 73 2f 69 6d 67 2f 62 61 64 67 65 2e 70 6e 67 22 20 61 6c 74 3d 22 68 72 66 2d 70 72 6f 64 75 63 74 69 6f 6e 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 63 66 61 38 64 36 38 65 61 20 63 31 38 35 61 37 37 64 34 22 3e 43 68 61 6e 67 65 20 59 6f 75 72 20 50 61 73 73 77 6f 72 64 3c 2f 68 31 3e 0a 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 63 36 64 34 30 31 36 33 20 63 34 36 61 33 39 66 35 37 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 63 63 32 35 38 33 62 65 39 20 63 38 33 64 32 31 62 64 63 22 3e 45 6e 74 65 72 20 61 20 6e Data Ascii: media/logos/img/badge.png" alt="hrf-production"> <h1 class="cfa8d68ea c185a77d4">Change Your Password</h1> <div class="cc6d40163 c46a39f57"> <p class="cc2583be9 c83d21bdc">Enter a n
2024-07-03 19:36:17 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 63 6c 61 73 73 3d 22 69 6e 70 75 74 20 63 61 34 35 33 34 32 63 34 20 63 34 32 37 37 65 36 63 36 22 20 6e 61 6d 65 3d 22 70 61 73 73 77 6f 72 64 2d 72 65 73 65 74 22 20 69 64 3d 22 70 61 73 73 77 6f 72 64 2d 72 65 73 65 74 22 20 74 79 70 65 3d 22 70 61 73 73 77 6f 72 64 22 20 72 65 71 75 69 72 65 64 20 61 75 74 6f 43 6f 6d 70 6c 65 74 65 3d 22 6e 65 77 2d 70 61 73 73 77 6f 72 64 22 20 61 75 74 6f 43 61 70 69 74 61 6c 69 7a 65 3d 22 6e 6f 6e 65 22 20 73 70 65 6c 6c 43 68 65 63 6b 3d 22 66 61 6c 73 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 Data Ascii: <input class="input ca45342c4 c4277e6c6" name="password-reset" id="password-reset" type="password" required autoComplete="new-password" autoCapitalize="none" spellCheck="false">
2024-07-03 19:36:17 UTC	1369	IN	Data Raw: 22 63 35 38 66 39 61 61 31 36 20 70 61 73 73 77 6f 72 64 20 6a 73 2d 72 65 71 75 69 72 65 64 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: "c58f9aa16 password js-required" aria-hidden="true"></span> </button> </div> </div>
2024-07-03 19:36:17 UTC	1369	IN	Data Raw: 74 61 2d 61 63 74 69 6f 6e 3d 22 74 6f 67 67 6c 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 20 63 6c 61 73 73 3d 22 70 61 73 73 77 6f 72 64 2d 69 63 6f 6e 2d 74 6f 6f 6c 74 69 70 20 73 68 6f 77 2d 70 61 73 73 77 6f 72 64 2d 74 6f 6f 6c 74 69 70 22 3e 53 68 6f 77 20 70 61 73 73 77 6f 72 64 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 20 63 6c 61 73 73 3d 22 70 61 73 73 77 6f 72 64 2d 69 Data Ascii: ta-action="toggle"> <span aria-hidden="true" class="password-icon-tooltip show-password-tooltip">Show password</span> <span aria-hidden="true" class="password-i
2024-07-03 19:36:17 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 63 63 37 66 32 37 65 35 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 63 66 35 31 66 64 33 31 64 20 63 64 61 33 38 37 63 38 62 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 34 30 37 37 64 36 61 66 20 63 66 35 31 66 64 33 31 Data Ascii: <ul class="cc7f27e5e"> <li class="cf51fd31d cda387c8b"> <div class="c4077d6af cf51fd31
2024-07-03 19:36:17 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 63 30 63 36 33 62 64 61 62 20 63 36 61 32 66 33 66 37 61 22 20 64 61 74 61 2d 65 72 72 6f 72 2d 63 6f 64 65 3d 22 70 61 73 73 77 6f 72 64 2d 70 6f 6c 69 63 79 2d 6c 6f 77 65 72 2d 63 61 73 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 35 63 39 30 32 62 32 65 22 3e 4c 6f 77 65 72 20 63 61 73 Data Ascii: <li class="c0c63bdab c6a2f3f7a" data-error-code="password-policy-lower-case"> <span class="c5c902b2e">Lower cas
2024-07-03 19:36:17 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: </li> </ul> </div>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	18.239.16.41	443	5016	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:36:18 UTC	538	OUT	GET /ulp/react-components/1.94.4/css/main.cdn.min.css HTTP/1.1 Host: cdn.auth0.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:36:18 UTC	756	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 279323 Connection: close Date: Wed, 03 Jul 2024 04:22:47 GMT x-amz-replication-status: FAILED Last-Modified: Wed, 26 Jun 2024 16:32:57 GMT ETag: "78627d3b768913ea4ba479d723feed27" x-amz-server-side-encryption: AES256 Cache-Control: max-age=86400 x-amz-version-id: HJASdD9GKP3AcEuqrcpOhsTrfqbPu_MQ Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 297dc74786919df7ba1867fc37f80bb6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P6 X-Amz-Cf-Id: Yh9JsYYzcI0BMITmnsljME7kwky4mqXcdGelnWtBPUhEW-_sDWfPng== Age: 54812 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=63072000; includeSubDomains X-Robots-Tag: noindex
2024-07-03 19:36:18 UTC	15628	IN	Data Raw: 61 2c 61 62 62 72 2c 61 63 72 6f 6e 79 6d 2c 61 64 64 72 65 73 73 2c 61 70 70 6c 65 74 2c 61 72 74 69 63 6c 65 2c 61 73 69 64 65 2c 61 75 64 69 6f 2c 62 2c 62 69 67 2c 62 6c 6f 63 6b 71 75 6f 74 65 2c 62 6f 64 79 2c 63 61 6e 76 61 73 2c 63 61 70 74 69 6f 6e 2c 63 65 6e 74 65 72 2c 63 69 74 65 2c 63 6f 64 65 2c 64 64 2c 64 65 6c 2c 64 65 74 61 69 6c 73 2c 64 66 6e 2c 64 69 76 2c 64 6c 2c 64 74 2c 65 6d 2c 65 6d 62 65 64 2c 66 69 65 6c 64 73 65 74 2c 66 69 67 63 61 70 74 69 6f 6e 2c 66 69 67 75 72 65 2c 66 6f 6f 74 65 72 2c 66 6f 72 6d 2c 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 65 61 64 65 72 2c 68 67 72 6f 75 70 2c 68 74 6d 6c 2c 69 2c 69 66 72 61 6d 65 2c 69 6d 67 2c 69 6e 73 2c 6b 62 64 2c 6c 61 62 65 6c 2c 6c 65 67 65 6e 64 2c 6c 69 2c Data Ascii: a,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,em,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,
2024-07-03 19:36:18 UTC	16384	IN	Data Raw: 30 31 2d 34 35 2e 31 39 37 2d 2e 30 31 2d 36 36 2e 31 32 33 68 32 33 2e 32 33 36 61 34 2e 34 32 34 20 34 2e 34 32 34 20 30 20 30 20 30 20 34 2e 34 32 2d 34 2e 34 31 34 63 2e 30 30 34 2d 32 2e 34 32 37 2d 31 2e 39 38 32 2d 34 2e 34 30 37 2d 34 2e 34 31 36 2d 34 2e 34 30 37 7a 6d 31 30 33 2e 39 31 33 20 37 30 2e 35 34 39 76 2d 2e 30 32 63 2d 37 2e 34 33 38 2e 30 36 36 2d 31 33 2e 34 33 36 2d 2e 33 38 31 2d 31 36 2e 38 34 2d 32 2e 39 34 33 2d 33 2e 33 36 39 2d 32 2e 33 39 35 2d 36 2e 33 36 31 2d 37 2e 36 33 31 2d 36 2e 34 2d 32 30 2e 39 37 35 2d 2e 30 30 36 2d 31 38 2e 39 38 2d 2e 30 31 2d 32 37 2e 37 35 36 2d 2e 30 31 2d 33 37 2e 36 37 32 68 32 33 2e 32 34 36 63 32 2e 34 33 38 20 30 20 34 2e 34 31 34 2d 31 2e 39 37 39 20 34 2e 34 31 34 2d 34 2e 34 31 34 73 Data Ascii: 01-45.197-.01-66.123h23.236a4.424 4.424 0 0 0 4.42-4.414c.004-2.427-1.982-4.407-4.416-4.407zm103.913 70.549v-.02c-7.438.066-13.436-.381-16.84-2.943-3.369-2.395-6.361-7.631-6.4-20.975-.006-18.98-.01-27.756-.01-37.672h23.246c2.438 0 4.414-1.979 4.414-4.414s
2024-07-03 19:36:18 UTC	16384	IN	Data Raw: 61 64 69 65 6e 74 25 33 45 25 33 43 2f 64 65 66 73 25 33 45 25 33 43 67 20 66 69 6c 6c 3d 27 6e 6f 6e 65 27 25 33 45 25 33 43 70 61 74 68 20 64 3d 27 4d 32 32 2e 37 39 32 20 31 34 2e 32 36 38 6c 2d 33 2e 38 32 31 20 31 2e 32 32 31 61 34 2e 32 37 20 34 2e 32 37 20 30 20 30 20 31 2d 32 2e 35 32 37 2e 30 32 32 4c 31 32 2e 36 20 31 34 2e 33 35 37 61 2e 33 32 33 2e 33 32 33 20 30 20 30 20 30 2d 2e 34 31 36 2e 33 31 76 34 2e 36 36 37 63 30 20 2e 31 34 33 2e 30 39 34 2e 32 36 39 2e 32 33 31 2e 33 31 6c 34 2e 37 20 31 2e 34 30 39 63 2e 33 37 35 2e 31 31 33 2e 37 37 34 2e 31 31 20 31 2e 31 34 37 2d 2e 30 31 4c 32 33 20 31 39 2e 35 33 31 61 2e 33 32 34 2e 33 32 34 20 30 20 30 20 30 20 2e 32 32 35 2d 2e 33 30 38 76 2d 34 2e 36 34 37 61 2e 33 32 34 2e 33 32 34 20 30 Data Ascii: adient%3E%3C/defs%3E%3Cg fill='none'%3E%3Cpath d='M22.792 14.268l-3.821 1.221a4.27 4.27 0 0 1-2.527.022L12.6 14.357a.323.323 0 0 0-.416.31v4.667c0 .143.094.269.231.31l4.7 1.409c.375.113.774.11 1.147-.01L23 19.531a.324.324 0 0 0 .225-.308v-4.647a.324.324 0
2024-07-03 19:36:18 UTC	16384	IN	Data Raw: 61 74 68 20 64 3d 27 4d 32 32 33 2e 37 37 34 20 35 37 2e 33 34 63 2d 2e 32 30 31 2d 31 2e 34 36 2d 31 2e 34 38 2d 32 2e 32 36 38 2d 32 2e 35 33 37 2d 32 2e 33 35 37 61 31 39 36 31 34 20 31 39 36 31 34 20 30 20 30 20 30 2d 32 33 2e 33 38 33 2d 31 2e 37 34 33 73 2d 31 35 2e 35 30 37 2d 31 35 2e 33 39 35 2d 31 37 2e 32 30 39 2d 31 37 2e 30 39 39 63 2d 31 2e 37 30 33 2d 31 2e 37 30 33 2d 35 2e 30 32 39 2d 31 2e 31 38 35 2d 36 2e 33 32 2d 2e 38 30 35 2d 2e 31 39 2e 30 35 36 2d 33 2e 33 38 38 20 31 2e 30 34 33 2d 38 2e 36 37 38 20 32 2e 36 38 2d 35 2e 31 38 2d 31 34 2e 39 30 36 2d 31 34 2e 33 32 32 2d 32 38 2e 36 30 34 2d 33 30 2e 34 30 35 2d 32 38 2e 36 30 34 2d 2e 34 34 34 20 30 2d 2e 39 30 31 2e 30 31 38 2d 31 2e 33 35 38 2e 30 34 34 43 31 32 39 2e 33 31 20 Data Ascii: ath d='M223.774 57.34c-.201-1.46-1.48-2.268-2.537-2.357a19614 19614 0 0 0-23.383-1.743s-15.507-15.395-17.209-17.099c-1.703-1.703-5.029-1.185-6.32-.805-.19.056-3.388 1.043-8.678 2.68-5.18-14.906-14.322-28.604-30.405-28.604-.444 0-.901.018-1.358.044C129.31
2024-07-03 19:36:18 UTC	16384	IN	Data Raw: 67 68 74 3d 27 39 38 35 27 20 76 69 65 77 42 6f 78 3d 27 30 20 30 20 34 32 39 2e 35 35 37 20 31 36 39 2e 32 33 27 25 33 45 25 33 43 70 61 74 68 20 66 69 6c 6c 3d 27 25 32 33 32 37 32 35 32 35 27 20 64 3d 27 4d 31 38 39 2e 30 33 39 20 36 34 2e 31 32 34 63 2d 39 2e 38 33 20 30 2d 32 30 2e 30 37 39 20 37 2e 31 37 35 2d 32 30 2e 30 37 39 20 37 2e 31 37 35 76 2d 34 2e 36 31 31 63 30 2d 31 2e 30 31 31 2d 2e 34 30 34 2d 31 2e 34 31 36 2d 31 2e 34 31 35 2d 31 2e 34 31 36 68 2d 31 32 2e 35 34 37 63 2d 31 2e 30 31 32 20 30 2d 31 2e 36 31 39 2e 36 30 37 2d 31 2e 36 31 39 20 31 2e 34 31 36 76 39 38 2e 33 33 38 63 30 20 31 2e 30 31 35 2e 34 30 35 20 31 2e 36 32 32 20 31 2e 34 31 37 20 31 2e 36 32 32 68 31 32 2e 37 34 38 63 2e 38 30 38 20 30 20 31 2e 34 31 35 2d 2e 36 Data Ascii: ght='985' viewBox='0 0 429.557 169.23'%3E%3Cpath fill='%23272525' d='M189.039 64.124c-9.83 0-20.079 7.175-20.079 7.175v-4.611c0-1.011-.404-1.416-1.415-1.416h-12.547c-1.012 0-1.619.607-1.619 1.416v98.338c0 1.015.405 1.622 1.417 1.622h12.748c.808 0 1.415-.6
2024-07-03 19:36:18 UTC	16384	IN	Data Raw: 3b 2d 2d 69 63 6f 6e 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 2d 2d 69 63 6f 6e 2d 77 69 64 74 68 3a 32 30 70 78 3b 2d 2d 69 63 6f 6e 2d 64 65 66 61 75 6c 74 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 67 72 61 79 2d 64 61 72 6b 29 3b 2d 2d 69 63 6f 6e 2d 61 75 74 68 30 2d 62 61 64 67 65 3a 75 72 6c 28 22 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 2c 25 33 43 73 76 67 20 77 69 64 74 68 3d 27 31 39 27 20 68 65 69 67 68 74 3d 27 32 32 27 20 78 6d 6c 6e 73 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 27 25 33 45 25 33 43 70 61 74 68 20 64 3d 27 4d 31 35 2e 30 38 34 20 31 37 2e 37 39 37 4c 31 32 2e 39 35 32 20 31 31 6c 35 2e 35 38 32 2d 34 2e 32 68 2d 36 2e 39 4c 39 2e 35 2e Data Ascii: ;--icon-height:20px;--icon-width:20px;--icon-default-color:var(--gray-dark);--icon-auth0-badge:url("data:image/svg+xml;charset=utf-8,%3Csvg width='19' height='22' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath d='M15.084 17.797L12.952 11l5.582-4.2h-6.9L9.5.
2024-07-03 19:36:18 UTC	16384	IN	Data Raw: 30 20 31 2d 2e 35 30 37 2d 31 2e 38 36 7a 6d 2d 31 30 2e 36 37 35 2e 33 39 34 61 31 2e 33 36 20 31 2e 33 36 20 30 20 30 20 31 20 31 2e 39 32 36 20 30 20 31 2e 33 36 35 20 31 2e 33 36 35 20 30 20 30 20 31 20 30 20 31 2e 39 32 38 6c 2d 2e 30 30 31 2e 30 30 31 2d 2e 30 30 31 2e 30 30 31 2d 2e 30 30 31 2e 30 30 31 2d 2e 30 30 31 2e 30 30 31 2d 2e 30 30 31 2e 30 30 31 2d 2e 30 30 31 2e 30 30 31 2d 2e 30 30 31 2e 30 30 31 2d 2e 30 30 31 2e 30 30 31 2d 2e 30 30 31 2e 30 30 31 2d 2e 30 30 31 2e 30 30 32 68 2d 2e 30 30 31 6c 2d 2e 30 30 32 2e 30 30 32 2d 2e 30 30 32 2e 30 30 32 2d 2e 30 30 34 2e 30 30 34 2d 2e 30 30 31 2e 30 30 32 2d 2e 30 30 34 2e 30 30 33 2d 2e 30 30 31 2e 30 30 32 68 2d 2e 30 30 32 6c 2d 2e 30 30 34 2e 30 30 35 2d 2e 30 30 33 2e 30 30 33 2d 2e Data Ascii: 0 1-.507-1.86zm-10.675.394a1.36 1.36 0 0 1 1.926 0 1.365 1.365 0 0 1 0 1.928l-.001.001-.001.001-.001.001-.001.001-.001.001-.001.001-.001.001-.001.001-.001.001-.001.002h-.001l-.002.002-.002.002-.004.004-.001.002-.004.003-.001.002h-.002l-.004.005-.003.003-.
2024-07-03 19:36:18 UTC	16384	IN	Data Raw: 69 6c 64 29 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 38 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 76 61 72 28 2d 2d 73 70 61 63 69 6e 67 2d 31 29 7d 6c 61 62 65 6c 2e 63 38 30 37 32 35 64 64 63 7b 70 61 64 64 69 6e 67 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 73 70 61 63 69 6e 67 2d 31 29 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 63 32 63 38 64 30 3b 62 6f 72 64 65 72 3a 76 61 72 28 2d 2d 72 61 64 69 6f 2d 62 6f 72 64 65 72 2d 77 69 64 74 68 29 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 29 3b Data Ascii: ild){margin-left:8px;margin-left:var(--spacing-1)}label.c80725ddc{padding:8px;padding:var(--spacing-1);display:flex;align-items:center;justify-content:center;border:1px solid #c2c8d0;border:var(--radio-border-width) solid var(--radio-button-border-color);
2024-07-03 19:36:18 UTC	16384	IN	Data Raw: 37 63 62 35 2e 70 61 73 73 77 6f 72 64 20 2e 75 6c 70 2d 62 75 74 74 6f 6e 2d 69 63 6f 6e 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 34 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 35 32 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 69 6e 70 75 74 2d 68 65 69 67 68 74 29 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 33 70 78 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 2d 66 6f 72 6d 2d 65 6c 65 6d 65 6e 74 73 29 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 33 70 78 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 6f 72 64 65 72 2d 72 61 Data Ascii: 7cb5.password .ulp-button-icon{padding-left:4px;min-height:52px;min-height:var(--input-height);border-top-right-radius:3px;border-top-right-radius:var(--border-radius-form-elements);border-bottom-right-radius:3px;border-bottom-right-radius:var(--border-ra
2024-07-03 19:36:18 UTC	16384	IN	Data Raw: 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 64 33 33 33 61 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 66 6f 6e 74 2d 64 65 66 61 75 6c 74 2d 63 6f 6c 6f 72 29 3b 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 31 70 78 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 36 38 36 38 36 38 3b 62 6f 72 64 65 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 62 6f 72 64 65 72 2d 77 69 64 74 68 29 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 69 6e 70 75 74 2d 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 29 3b 6d 61 72 67 69 6e 3a 38 70 78 20 30 20 31 32 70 78 3b 6d 61 72 67 69 6e 3a 76 61 72 28 2d 2d 73 70 61 63 69 6e 67 2d 31 29 20 30 20 76 61 72 28 2d 2d 73 70 61 63 69 6e 67 2d 31 2d 35 29 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 Data Ascii: ;background:#fff;color:#2d333a;color:var(--font-default-color);border-width:1px;border-color:#686868;border:var(--button-border-width) solid var(--input-border-color);margin:8px 0 12px;margin:var(--spacing-1) 0 var(--spacing-1-5);outline:none;border-radiu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	18.239.16.41	443	5016	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:36:18 UTC	589	OUT	GET /styleguide/components/1.0.8/media/logos/img/badge.png HTTP/1.1 Host: cdn.auth0.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:36:18 UTC	729	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1591 Connection: close x-amz-replication-status: COMPLETED Last-Modified: Thu, 04 May 2017 21:37:11 GMT x-amz-version-id: CghttMoXpqZBzj9pIZwTb7OuGonBat5c Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 03 Jul 2024 08:14:56 GMT Cache-Control: max-age=2628000,public ETag: "e3842ac36d4fbd8d4e31a39999c0eba6" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 9dba3ae645587c3cf23f9d232c9cb4e8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P6 X-Amz-Cf-Id: MM4LI7FyYWI4ayFZmF_Kf0Lri-4o2m3AW23eVWPqXWbWFk9zRYwkgA== Age: 40883 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=63072000; includeSubDomains X-Robots-Tag: noindex
2024-07-03 19:36:18 UTC	1591	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 98 00 00 00 a8 08 03 00 00 00 2b 66 d7 be 00 00 00 51 50 4c 54 45 00 00 00 ea 54 22 ea 52 23 87 11 00 dc 28 00 eb 53 22 de 43 11 eb 52 22 ea 52 1f ea 53 22 ea 50 20 e5 47 17 ea 53 21 eb 53 22 e8 4d 1b ea 53 22 e9 4f 1c ea 53 22 ea 51 20 e9 4f 1f eb 53 22 ea 51 21 eb 51 21 ea 52 22 e9 50 1f ea 50 20 eb 54 24 d9 b9 0f 01 00 00 00 1a 74 52 4e 53 00 f3 ec 03 08 fb 10 c1 4e db 67 1b 8f cf 28 99 34 a3 82 3c e4 76 b4 ab 44 59 f9 f5 07 96 00 00 05 7b 49 44 41 54 78 da cd 9c db 96 9b 30 0c 45 05 be 00 e1 12 ae 81 f0 ff 1f da 3e b4 35 ad e3 d8 92 a2 3a fb 71 d6 22 93 e4 c0 b6 25 6b 06 5e 32 95 14 fa 8a 74 d9 04 c9 e8 e2 a4 d0 cd a4 cb 0a 0d a9 d4 27 89 71 a4 5d 57 43 2a d3 49 61 05 68 48 17 4e d2 49 02 74 c4 Data Ascii: PNGIHDR+fQPLTET"R#(S"CR"RS"P GS!S"MS"OS"Q OS"Q!Q!R"PP T$tRNSNg(4<vDY{IDATx0E>5:q"%k^2t'q]WC*IahHNIt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	18.239.16.41	443	5016	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:36:19 UTC	390	OUT	GET /styleguide/components/1.0.8/media/logos/img/badge.png HTTP/1.1 Host: cdn.auth0.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 19:36:19 UTC	729	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1591 Connection: close x-amz-replication-status: COMPLETED Last-Modified: Thu, 04 May 2017 21:37:11 GMT x-amz-version-id: CghttMoXpqZBzj9pIZwTb7OuGonBat5c Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 03 Jul 2024 08:14:56 GMT Cache-Control: max-age=2628000,public ETag: "e3842ac36d4fbd8d4e31a39999c0eba6" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6c60742ba67aa10b881e511aba8e470a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P6 X-Amz-Cf-Id: 8hZBEfgWGeCHynpYHK1FBofOx6zNi-GybgKO_EpUciYj4XhWgiUrmA== Age: 40884 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=63072000; includeSubDomains X-Robots-Tag: noindex
2024-07-03 19:36:19 UTC	1591	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 98 00 00 00 a8 08 03 00 00 00 2b 66 d7 be 00 00 00 51 50 4c 54 45 00 00 00 ea 54 22 ea 52 23 87 11 00 dc 28 00 eb 53 22 de 43 11 eb 52 22 ea 52 1f ea 53 22 ea 50 20 e5 47 17 ea 53 21 eb 53 22 e8 4d 1b ea 53 22 e9 4f 1c ea 53 22 ea 51 20 e9 4f 1f eb 53 22 ea 51 21 eb 51 21 ea 52 22 e9 50 1f ea 50 20 eb 54 24 d9 b9 0f 01 00 00 00 1a 74 52 4e 53 00 f3 ec 03 08 fb 10 c1 4e db 67 1b 8f cf 28 99 34 a3 82 3c e4 76 b4 ab 44 59 f9 f5 07 96 00 00 05 7b 49 44 41 54 78 da cd 9c db 96 9b 30 0c 45 05 be 00 e1 12 ae 81 f0 ff 1f da 3e b4 35 ad e3 d8 92 a2 3a fb 71 d6 22 93 e4 c0 b6 25 6b 06 5e 32 95 14 fa 8a 74 d9 04 c9 e8 e2 a4 d0 cd a4 cb 0a 0d a9 d4 27 89 71 a4 5d 57 43 2a d3 49 61 05 68 48 17 4e d2 49 02 74 c4 Data Ascii: PNGIHDR+fQPLTET"R#(S"CR"RS"P GS!S"MS"OS"Q OS"Q!Q!R"PP T$tRNSNg(4<vDY{IDATx0E>5:q"%k^2t'q]WC*IahHNIt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	104.19.167.24	443	5016	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:36:19 UTC	1392	OUT	GET /favicon.ico HTTP/1.1 Host: hrf-production.us.auth0.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://hrf-production.us.auth0.com/u/reset-password/change?state=YWmbQAYtJAWzxl6oJEJpfP2DgGxLcrnU Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: did=s%3Av0%3Ac1193269-7883-4dbc-8df2-eddc499a065c.kBFpHUP%2Fxbd45qVYKs0PSeU677Spvdpimr3HJlLlH7A; auth0=s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQM1jqOHvIOiGLklVZJVW8e1aZ_JhoVvyQfKI5DhBv8tAxtlBgwH89_U4HA3nw-VNPiq2xdkHF0hZQ-ES2QY0xEymY29va2llg6dleHBpcmVz1_8_qGMAZomcsa5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.vbX16a4Lj3ax0R14H6XGHmbm9VMsi0plQreo%2Bw8YWAk; did_compat=s%3Av0%3Ac1193269-7883-4dbc-8df2-eddc499a065c.kBFpHUP%2Fxbd45qVYKs0PSeU677Spvdpimr3HJlLlH7A; auth0_compat=s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQM1jqOHvIOiGLklVZJVW8e1aZ_JhoVvyQfKI5DhBv8tAxtlBgwH89_U4HA3nw-VNPiq2xdkHF0hZQ-ES2QY0xEymY29va2llg6dleHBpcmVz1_8_qGMAZomcsa5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.vbX16a4Lj3ax0R14H6XGHmbm9VMsi0plQreo%2Bw8YWAk
2024-07-03 19:36:20 UTC	635	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 19:36:20 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close CF-Ray: 89d952e4f90bc330-EWR CF-Cache-Status: MISS Cache-Control: public, max-age=300 ETag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg" Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Accept-Encoding baggage: auth0-request-id=48f37382956898334079c4c55608c9da traceparent: 00-48f37382956898334079c4c55608c9da-ee0ac2dfad1f141a-01 X-Auth0-Not-Found: 1 X-Auth0-RequestId: 4a46333de6bd84d3fb2b X-Content-Type-Options: nosniff Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-07-03 19:36:20 UTC	9	IN	Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49745	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:36:20 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-03 19:36:20 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=73964 Date: Wed, 03 Jul 2024 19:36:20 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:36:21 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-03 19:36:21 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=73973 Date: Wed, 03 Jul 2024 19:36:21 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-03 19:36:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:36:26 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3l8hxWLK17D69LB&MD=gcSobguU HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-03 19:36:26 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b446170c-8ca4-4360-854f-fff4f7b8cee7 MS-RequestId: a6bb4376-7941-4dee-8bcf-8f826e50be08 MS-CV: rSADIl/JFECywlzO.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 03 Jul 2024 19:36:25 GMT Connection: close Content-Length: 24490
2024-07-03 19:36:26 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-03 19:36:26 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	57797	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 19:37:06 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3l8hxWLK17D69LB&MD=gcSobguU HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-03 19:37:06 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 6f1db74d-7412-44d6-b6a4-f47f0167966f MS-RequestId: d42d3165-624e-4583-98ab-9ed3db65d7a6 MS-CV: n5Xzmk8bHkyKHMaY.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 03 Jul 2024 19:37:05 GMT Connection: close Content-Length: 30005
2024-07-03 19:37:06 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-07-03 19:37:06 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	15:36:07
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:36:13
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1984,i,14768218943604499707,5163116940037230257,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	15:36:15
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https:/hrf-production.us.auth0.com/u/reset-verify?ticket=oX8EPAbN9GVliGk7eT5TPNZKLzbKdTwr#"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: global traffic	TCP traffic: 192.168.2.4:52194 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:57795 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET /u/reset-verify?ticket=oX8EPAbN9GVliGk7eT5TPNZKLzbKdTwr HTTP/1.1Host: hrf-production.us.auth0.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /u/reset-password/change?state=YWmbQAYtJAWzxl6oJEJpfP2DgGxLcrnU HTTP/1.1Host: hrf-production.us.auth0.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: did=s%3Av0%3Ac1193269-7883-4dbc-8df2-eddc499a065c.kBFpHUP%2Fxbd45qVYKs0PSeU677Spvdpimr3HJlLlH7A; auth0=s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQM1jqOHvIOiGLklVZJVW8e1aZ_JhoVvyQfKI5DhBv8tAxtlBgwH89_U4HA3nw-VNPiq2xdkHF0hZQ-ES2QY0xEymY29va2llg6dleHBpcmVz1_8_qGMAZomcsa5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.vbX16a4Lj3ax0R14H6XGHmbm9VMsi0plQreo%2Bw8YWAk; did_compat=s%3Av0%3Ac1193269-7883-4dbc-8df2-eddc499a065c.kBFpHUP%2Fxbd45qVYKs0PSeU677Spvdpimr3HJlLlH7A; auth0_compat=s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQM1jqOHvIOiGLklVZJVW8e1aZ_JhoVvyQfKI5DhBv8tAxtlBgwH89_U4HA3nw-VNPiq2xdkHF0hZQ-ES2QY0xEymY29va2llg6dleHBpcmVz1_8_qGMAZomcsa5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.vbX16a4Lj3ax0R14H6XGHmbm9VMsi0plQreo%2Bw8YWAk
Source: global traffic	HTTP traffic detected: GET /ulp/react-components/1.94.4/css/main.cdn.min.css HTTP/1.1Host: cdn.auth0.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /styleguide/components/1.0.8/media/logos/img/badge.png HTTP/1.1Host: cdn.auth0.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /styleguide/components/1.0.8/media/logos/img/badge.png HTTP/1.1Host: cdn.auth0.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: hrf-production.us.auth0.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://hrf-production.us.auth0.com/u/reset-password/change?state=YWmbQAYtJAWzxl6oJEJpfP2DgGxLcrnUAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: did=s%3Av0%3Ac1193269-7883-4dbc-8df2-eddc499a065c.kBFpHUP%2Fxbd45qVYKs0PSeU677Spvdpimr3HJlLlH7A; auth0=s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQM1jqOHvIOiGLklVZJVW8e1aZ_JhoVvyQfKI5DhBv8tAxtlBgwH89_U4HA3nw-VNPiq2xdkHF0hZQ-ES2QY0xEymY29va2llg6dleHBpcmVz1_8_qGMAZomcsa5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.vbX16a4Lj3ax0R14H6XGHmbm9VMsi0plQreo%2Bw8YWAk; did_compat=s%3Av0%3Ac1193269-7883-4dbc-8df2-eddc499a065c.kBFpHUP%2Fxbd45qVYKs0PSeU677Spvdpimr3HJlLlH7A; auth0_compat=s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQM1jqOHvIOiGLklVZJVW8e1aZ_JhoVvyQfKI5DhBv8tAxtlBgwH89_U4HA3nw-VNPiq2xdkHF0hZQ-ES2QY0xEymY29va2llg6dleHBpcmVz1_8_qGMAZomcsa5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.vbX16a4Lj3ax0R14H6XGHmbm9VMsi0plQreo%2Bw8YWAk
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3l8hxWLK17D69LB&MD=gcSobguU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3l8hxWLK17D69LB&MD=gcSobguU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: hrf-production.us.auth0.com
Source: global traffic	DNS traffic detected: DNS query: cdn.auth0.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https:/hrf-production.us.auth0.com/u/reset-verify?ticket=oX8EPAbN9GVliGk7eT5TPNZKLzbKdTwr#

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 3020, Parent PID: 5312

General

Chronological Activities

Analysis Process: chrome.exePID: 5016, Parent PID: 3020

General

Chronological Activities

Analysis Process: chrome.exePID: 6480, Parent PID: 5312

General

Chronological Activities

Disassembly

Windows Analysis Report
https:/hrf-production.us.auth0.com/u/reset-verify?ticket=oX8EPAbN9GVliGk7eT5TPNZKLzbKdTwr#