Play interactive tourEdit tour

Windows Analysis Report
https://atgroupbe.com/?mzbexmhu=bbd299e40cc6ba4977bf44a725eec5648bda7170169e3fbfd31a05747fa7276fd2437dda5a583d6a5ff345cb6fce6d6bd82e92021cc24ab98d2ebfffc47a5826&qrc=nmertens@vanas.eu

Overview

General Information

Sample URL:	https://atgroupbe.com/?mzbexmhu=bbd299e40cc6ba4977bf44a725eec5648bda7170169e3fbfd31a05747fa7276fd2437dda5a583d6a5ff345cb6fce6d6bd82e92021cc24ab98d2ebfffc47a5826&qrc=nmertens@vanas.eu
Analysis ID:	1591822
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish54

AI detected suspicious Javascript

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML page contains obfuscated script src

Stores files to the Windows start menu directory

URL contains potential PII (phishing indication)

Classification

×

Joe Sandbox Signatures

• • Phishing
• • Software Vulnerabilities
• • Networking
• • System Summary
• • Boot Survival

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=true

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL '4x5seoz4hqc.opdrachtencentralebe.site' does not match the legitimate domain 'microsoft.com'., The domain name contains random characters and an unusual domain extension, which are common indicators of phishing., The URL does not have any recognizable association with Microsoft., The presence of a legitimate-looking email input field does not mitigate the suspicious nature of the URL. DOM: 3.6.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 0.4.id.script.csv, type: HTML
Source: Yara match	File source: 0.9.id.script.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: 3.4.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.13.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxb... This script demonstrates several high-risk behaviors, including data exfiltration and potential redirection to an untrusted domain. The script checks if it is running in an iframe and, if not allowed, attempts to redirect the top-level window to a URL containing an 'iframe-request-id' parameter. This behavior could be used for phishing or other malicious purposes, and the use of obfuscated code and unknown domains increases the risk.
Source: 0.4.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxb... This JavaScript snippet exhibits several high-risk behaviors that raise concerns about its potential malicious intent:1. Dynamic Code Execution: The script uses the `eval()` function, which can execute remote or dynamic code, posing a significant security risk.2. Data Exfiltration: The script sends user data (e.g., cookies, session identifiers) to the external domain 'https://4x5seoz4hqc.opdrachtencentralebe.site', which is a potential indicator of data exfiltration.3. Obfuscated Code/URLs: The script contains heavily obfuscated URLs and query strings, making it difficult to determine the true purpose of the script.Additionally, the script interacts with several external domains, including 'aadcdn.msauth.net' and 'autologon.microsoftazuread-sso.com', which may be legitimate but require further investigation to confirm their trustworthiness.Overall, the combination of high-risk behaviors and the use of obfuscated code and URLs suggests that this script should be considered a high-risk security concern and requires further analysis and mitigation.
Source: 0.9.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxb... This script exhibits several high-risk behaviors that indicate potential malicious intent:1. Dynamic Code Execution: The script uses the `$Config` object, which could be used to execute remote or dynamic code.2. Data Exfiltration: The script contains URLs that appear to be sending user data to external domains, such as `4x5seoz4hqc.opdrachtencentralebe.site` and `login.live.com`.3. Obfuscated Code/URLs: The script contains obfuscated or encoded strings, which is a common tactic used to hide malicious behavior.Additionally, the script appears to be attempting to mimic legitimate Microsoft services, such as Outlook Web Access (OWA) and the Microsoft Account (MSA) login flow, which is a common technique used in phishing attacks.Overall, the combination of dynamic code execution, data exfiltration, and obfuscation, along with the apparent attempt to impersonate trusted services, suggests this script is highly likely to be malicious and should be treated with caution.

HTML body contains low number of good links

Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=true

HTTP Parser: Number of links: 0

HTML page contains hidden javascript code

Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=

HTTP Parser: Base64 decoded: function c(){if(!document.querySelector(".b") || !document.querySelector(".g")){document.head.appendChild(Object.assign(document.createElement("div"),{classList:["b"]}));document.documentElement.style.filter="hue-rotate(4deg)";document.head.appendChild(Ob...

HTML page contains obfuscated script src

Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX
Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX

URL contains potential PII (phishing indication)

Source: https://atgroupbe.com/?mzbexmhu=bbd299e40cc6ba4977bf44a725eec5648bda7170169e3fbfd31a05747fa7276fd2437dda5a583d6a5ff345cb6fce6d6bd82e92021cc24ab98d2ebfffc47a5826&qrc=nmertens@vanas.eu

Sample URL: PII: nmertens@vanas.eu

Found iframes

Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=true

HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx

Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=true

HTTP Parser: Iframe src: https://outlook.office365.com/owa/prefetch.aspx

HTML body contains password input

Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=true

HTTP Parser: <input type="password" .../> found

HTML page is missing a favicon

Source: https://atgroupbe.com/?mzbexmhu=4d586b3cdd8398ec81870945fe0e02d3ca84fd1f0aa54e929873ee37a69ffa7e76f2afe9750102aea14522c3040839bc6bfe12d2e504ebc32d90513dc9a1c00b&qrc=nmertens%40vanas.eu	HTTP Parser: No favicon
Source: https://atgroupbe.com/?mzbexmhu=4d586b3cdd8398ec81870945fe0e02d3ca84fd1f0aa54e929873ee37a69ffa7e76f2afe9750102aea14522c3040839bc6bfe12d2e504ebc32d90513dc9a1c00b&qrc=nmertens%40vanas.eu	HTTP Parser: No favicon
Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=	HTTP Parser: No favicon
Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=true	HTTP Parser: No favicon
Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=true	HTTP Parser: No favicon
Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=true	HTTP Parser: No favicon

META author tag missing

Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=true

HTTP Parser: No <meta name="author".. found

Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=true

HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=true

HTTP Parser: No <meta name="copyright".. found

Source: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=true

HTTP Parser: No <meta name="copyright".. found

Software Vulnerabilities

Allocates a big amount of memory (probably used for heap spraying)

Source: chrome.exe

Memory has grown: Private usage: 25MB later: 37MB

Networking

Detected non-DNS traffic on DNS port

Source: global traffic

TCP traffic: 192.168.2.16:52965 -> 1.1.1.1:53

Detected suspicious crossdomain redirect

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: atgroupbe.com to https://4x5seoz4hqc.opdrachtencentralebe.site/?dataxx0=eyjhbgcioijiuzi1niisinr5cci6ikpxvcj9.eyj1cmwioijodhrwczovlzr4nxnlb3o0ahfjlm9wzhjhy2h0zw5jzw50cmfszwjllnnpdguviiwizg9tywluijoinhg1c2vvejrocwmub3bkcmfjahrlbmnlbnryywxlymuuc2l0zsisimtlesi6ijq5z3jpdenyzvnuuiisinfyyyi6im5tzxj0zw5zqhzhbmfzlmv1iiwiawf0ijoxnzm2otq3mje1lcjlehaioje3mzy5ndczmzv9.9hzrzqwb8cfpa4f5kdwhw2-cm9cw9jfh4d4br48u80q

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /?mzbexmhu=bbd299e40cc6ba4977bf44a725eec5648bda7170169e3fbfd31a05747fa7276fd2437dda5a583d6a5ff345cb6fce6d6bd82e92021cc24ab98d2ebfffc47a5826&qrc=nmertens@vanas.eu HTTP/1.1Host: atgroupbe.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?mzbexmhu=4d586b3cdd8398ec81870945fe0e02d3ca84fd1f0aa54e929873ee37a69ffa7e76f2afe9750102aea14522c3040839bc6bfe12d2e504ebc32d90513dc9a1c00b&qrc=nmertens%40vanas.eu HTTP/1.1Host: atgroupbe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://atgroupbe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/e0c90b6a3ed1/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://atgroupbe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/e0c90b6a3ed1/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/pyp2m/0x4AAAAAAA4z3pwKhYTmXrRa/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://atgroupbe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=902629406ac90cae&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/pyp2m/0x4AAAAAAA4z3pwKhYTmXrRa/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/pyp2m/0x4AAAAAAA4z3pwKhYTmXrRa/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=902629406ac90cae&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: atgroupbe.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://atgroupbe.com/?mzbexmhu=4d586b3cdd8398ec81870945fe0e02d3ca84fd1f0aa54e929873ee37a69ffa7e76f2afe9750102aea14522c3040839bc6bfe12d2e504ebc32d90513dc9a1c00b&qrc=nmertens%40vanas.euAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1545665412:1736944027:KIA3QrYIi31F6Ow_jP2wVHXYaCH6w3o5SXBDMvd1Lqc/902629406ac90cae/UntzyPCGy9F6N.8Hr428stsXCLWIeREH1k3d1p2I4Q0-1736947205-1.1.1.1-x_9922SJcNPSCMtgwJ82GVK635VAw9Nf9rQMmt0zZ5TCbY_AJb60cae1uqEr3Q4v HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/902629406ac90cae/1736947206886/a26264d4a11fdea1dabba148c2964288556bd74495365cec885d7fa06dc415d0/JdfWpu73ekZ3PKB HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/pyp2m/0x4AAAAAAA4z3pwKhYTmXrRa/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/902629406ac90cae/1736947206888/gVzBEL-Am4v7Otp HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/pyp2m/0x4AAAAAAA4z3pwKhYTmXrRa/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/902629406ac90cae/1736947206888/gVzBEL-Am4v7Otp HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1545665412:1736944027:KIA3QrYIi31F6Ow_jP2wVHXYaCH6w3o5SXBDMvd1Lqc/902629406ac90cae/UntzyPCGy9F6N.8Hr428stsXCLWIeREH1k3d1p2I4Q0-1736947205-1.1.1.1-x_9922SJcNPSCMtgwJ82GVK635VAw9Nf9rQMmt0zZ5TCbY_AJb60cae1uqEr3Q4v HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1545665412:1736944027:KIA3QrYIi31F6Ow_jP2wVHXYaCH6w3o5SXBDMvd1Lqc/902629406ac90cae/UntzyPCGy9F6N.8Hr428stsXCLWIeREH1k3d1p2I4Q0-1736947205-1.1.1.1-x_9922SJcNPSCMtgwJ82GVK635VAw9Nf9rQMmt0zZ5TCbY_AJb60cae1uqEr3Q4v HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovLzR4NXNlb3o0aHFjLm9wZHJhY2h0ZW5jZW50cmFsZWJlLnNpdGUvIiwiZG9tYWluIjoiNHg1c2VvejRocWMub3BkcmFjaHRlbmNlbnRyYWxlYmUuc2l0ZSIsImtleSI6IjQ5Z3JPdENYZVNuUiIsInFyYyI6Im5tZXJ0ZW5zQHZhbmFzLmV1IiwiaWF0IjoxNzM2OTQ3MjE1LCJleHAiOjE3MzY5NDczMzV9.9HzrZqwB8Cfpa4f5kdWHW2-cm9cw9jFH4D4bR48U80Q HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://atgroupbe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?qrc=nmertens%40vanas.eu HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://atgroupbe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA
Source: global traffic	HTTP traffic detected: GET /owa/?login_hint=nmertens%40vanas.eu HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://atgroupbe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA
Source: global traffic	HTTP traffic detected: GET /?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE= HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://atgroupbe.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_eaF-Fe71oZcWvr096r6xEw2.js HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; fpc=Akk6UZj0ovhLqc74YHtKB8k; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEiAsp2G1HP2GwXyH3aWI5rbPo6sGvBbRkqIgwnqINyGbiFxjQDbQyWpuGLaXMH56n5KHAlKnKZB_VQSKD0Go_D2DBLQzHgf4gG3hAhMd_6n3jl4uQmFqgUN1637iGRLBbgtzzCt35XTDyj1NRSEzqIQjurUBcTRLhpd9fleOqiNggAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/BssoInterrupt_Core_eaF-Fe71oZcWvr096r6xEw2.js HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; fpc=Akk6UZj0ovhLqc74YHtKB8k; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEiAsp2G1HP2GwXyH3aWI5rbPo6sGvBbRkqIgwnqINyGbiFxjQDbQyWpuGLaXMH56n5KHAlKnKZB_VQSKD0Go_D2DBLQzHgf4gG3hAhMd_6n3jl4uQmFqgUN1637iGRLBbgtzzCt35XTDyj1NRSEzqIQjurUBcTRLhpd9fleOqiNggAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=true HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; fpc=Akk6UZj0ovhLqc74YHtKB8k; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEiAsp2G1HP2GwXyH3aWI5rbPo6sGvBbRkqIgwnqINyGbiFxjQDbQyWpuGLaXMH56n5KHAlKnKZB_VQSKD0Go_D2DBLQzHgf4gG3hAhMd_6n3jl4uQmFqgUN1637iGRLBbgtzzCt35XTDyj1NRSEzqIQjurUBcTRLhpd9fleOqiNggAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_n7VKwtWYm2mBLcIKAZfQlw2.js HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_v20ia-gahguvu2fgvxamhg2.js HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_v20ia-gahguvu2fgvxamhg2.js HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_n7VKwtWYm2mBLcIKAZfQlw2.js HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /owa/prefetch.aspx HTTP/1.1Host: outlook.office365.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_ae573f441ee1cf781ec7.js HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /vanas.eu/winauth/ssoprobe?client-request-id=5f1bc651-09ca-2a32-b05c-a64202aaef60&_=1736947226817 HTTP/1.1Host: autologon.microsoftazuread-sso.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_80e93b9a4cb13643afca.js HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://4x5seoz4hqc.opdrachtencentralebe.site/?jxbs6khlw=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1ubWVydGVucyU0MHZhbmFzLmV1JmNsaWVudC1yZXF1ZXN0LWlkPTVmMWJjNjUxLTA5Y2EtMmEzMi1iMDVjLWE2NDIwMmFhZWY2MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg3MjU0NDAxODM5NDQzMjkuNDRmYWExMTEtZGY3NS00ZmE1LWFiZDMtYzUxYTg4N2JkMjdkJnN0YXRlPURZdEpEc0l3REFBVC1wVnlUQnNuRGs0UGlLY2dsNlJRQ1Z5Skxud2ZIMmFrT1l3MXhqVEtTYkZlWmVnU000V0U2Q0hIQVRHR29VT2NtQUhBbFltUzAwaU94eExkSXdIblRHTUpWS3ktYmJfOHVMLTlsLWNzOTljczIxVS05YnRWV2Nfb0R4WmV1N3JfQVE=&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /common/instrumentation/dssostatus HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0
Source: global traffic	HTTP traffic detected: GET /aadcdn.msauth.net/~/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg HTTP/1.1Host: 4x5seoz4hqc.opdrachtencentralebe.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: qPdM=49grOtCXeSnR; qPdM.sig=sHRK-hAuDkX4_NMg7n_fVqm77RA; ClientId=FB21F832B5594C1DA285C60AF464CF56; OIDC=1; OpenIdConnect.nonce.v3.qvskXLuPwMl-JYbppKGaa8hin5nybUbmTDNhRRQO7og=638725440183944329.44faa111-df75-4fa5-abd3-c51a887bd27d; X-OWA-RedirectHistory=ArLym14BiUQrW2c13Qg; esctx-4gkjWv7bPZ4=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAue7rvKCYo0f6g1nfWbdgavmYi6qwgM_hcLZBJTphM5YPvxEtUq7k8Jo6zSMuE41jfw-JjI0p5Es6eef1-bKDMSJZ68Fjv9a8CNIC-wZpIp0o_3xB1N8jcu1QvyArzlXZNeq2jmAuMLhkXmropO1dSAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA|NoExtension; SSOCOOKIEPULLED=1; buid=1.AS8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAAvAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEU_XsqbBdBFe6sOUmdHXr7Uztwjm1lEz7i6GpODzqejqWWM5dcCBKcVNpquYkDHuR9MgHkub_rbHMwxg99K86sppwllZFzRKG6dreZXiBtHsgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQErPDnbPkZ-Z735isqqt39y5wi2Pdd1ggVY3oNS3ZpmxdsUDf8PJWkDcwBzWtX6tHanTqezWkpSd3Mkzte_tfEPOVn12PKsq41Qne-UF79xOgJsY0TrW8h1C66E6mQu9WYw9kNyhu0A8XttjDdsarrNAob_N7hoLznOU9DTFpFH4YgAA; esctx-J6vYPBj7UJc=AQABCQEAAABVrSpeuWamRam2jAF1XRQEOeHcfVF8JaJlnH6BY0AUTLEZOXCKjbTM-CiYoeLIOT8a9WTzz77qZrerzRw1LY3Nonf8H9T89ouTOJMBrWXVeGligHk3-lmMgzkUH8Fz9JDqz7UaeoF08-dOHPP83UZ1_yOe-ujkOBxAvw2BpKxs3SAA; fpc=Akk6UZj0ovhLqc74YHtKB8merOTJAQAAABWtGd8OAAAA; brcap=0

Performs DNS lookups

Source: global traffic	DNS traffic detected: DNS query: atgroupbe.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 4x5seoz4hqc.opdrachtencentralebe.site
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: outlook.office365.com
Source: global traffic	DNS traffic detected: DNS query: r4.res.office365.com
Source: global traffic	DNS traffic detected: DNS query: autologon.microsoftazuread-sso.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1545665412:1736944027:KIA3QrYIi31F6Ow_jP2wVHXYaCH6w3o5SXBDMvd1Lqc/902629406ac90cae/UntzyPCGy9F6N.8Hr428stsXCLWIeREH1k3d1p2I4Q0-1736947205-1.1.1.1-x_9922SJcNPSCMtgwJ82GVK635VAw9Nf9rQMmt0zZ5TCbY_AJb60cae1uqEr3Q4v HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveContent-Length: 3365sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-type: application/x-www-form-urlencodedCF-Chl-RetryAttempt: 0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36CF-Challenge: UntzyPCGy9F6N.8Hr428stsXCLWIeREH1k3d1p2I4Q0-1736947205-1.1.1.1-x_9922SJcNPSCMtgwJ82GVK635VAw9Nf9rQMmt0zZ5TCbY_AJb60cae1uqEr3Q4vsec-ch-ua-platform: "Windows"Accept: */*Origin: https://challenges.cloudflare.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/pyp2m/0x4AAAAAAA4z3pwKhYTmXrRa/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateSet-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyStrict-Transport-Security: max-age=31536000; includeSubDomainsP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 119cb331-6465-4ce2-873c-c154d59cd500x-ms-ests-server: 2.1.19870.3 - WEULR1 ProdSlicesnel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.PReferrer-Policy: strict-origin-when-cross-originContent-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-se39ltsR-u7mk8USGoWz-Q' 'unsafe-inline' 'unsafe-eval' https://*.msauth.net https://*.msftauth.net https://*.msftauthimages.net https://*.msauthimages.net https://*.msidentity.com https://*.microsoftonline-p.com https://*.microsoftazuread-sso.com https://*.azureedge.net https://*.outlook.com https://*.office.com https://*.office365.com https://*.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-AllDate: Wed, 15 Jan 2025 13:20:21 GMTConnection: closeContent-Length: 0Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

URLs found in memory or binary data

Source: chromecache_81.2.dr	String found in binary or memory: http://github.com/jquery/globalize
Source: chromecache_83.2.dr, chromecache_95.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: chromecache_83.2.dr, chromecache_95.2.dr	String found in binary or memory: http://www.json.org/json2.js
Source: chromecache_83.2.dr, chromecache_95.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: chromecache_83.2.dr, chromecache_95.2.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.analytics-web-2.min.js
Source: chromecache_111.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_111.2.dr	String found in binary or memory: https://login.windows-ppe.net

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 52974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52992
Source: unknown	Network traffic detected: HTTP traffic on port 53056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52993
Source: unknown	Network traffic detected: HTTP traffic on port 53033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52994
Source: unknown	Network traffic detected: HTTP traffic on port 53010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53050
Source: unknown	Network traffic detected: HTTP traffic on port 53036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53056
Source: unknown	Network traffic detected: HTTP traffic on port 52979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 52976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 52981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 53005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 52973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53009
Source: unknown	Network traffic detected: HTTP traffic on port 52993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53001
Source: unknown	Network traffic detected: HTTP traffic on port 53017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53010
Source: unknown	Network traffic detected: HTTP traffic on port 53020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52966
Source: unknown	Network traffic detected: HTTP traffic on port 53028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53015
Source: unknown	Network traffic detected: HTTP traffic on port 53032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53012
Source: unknown	Network traffic detected: HTTP traffic on port 52996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53017
Source: unknown	Network traffic detected: HTTP traffic on port 53011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53016
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53020
Source: unknown	Network traffic detected: HTTP traffic on port 52969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52977
Source: unknown	Network traffic detected: HTTP traffic on port 52972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52971
Source: unknown	Network traffic detected: HTTP traffic on port 53031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53024
Source: unknown	Network traffic detected: HTTP traffic on port 52991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52974
Source: unknown	Network traffic detected: HTTP traffic on port 53015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52972
Source: unknown	Network traffic detected: HTTP traffic on port 53012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53027
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53031
Source: unknown	Network traffic detected: HTTP traffic on port 52966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52982
Source: unknown	Network traffic detected: HTTP traffic on port 52994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52980
Source: unknown	Network traffic detected: HTTP traffic on port 53034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53034
Source: unknown	Network traffic detected: HTTP traffic on port 52977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52983
Source: unknown	Network traffic detected: HTTP traffic on port 53006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53023 -> 443

System Summary

Classification label

Source: classification engine

Classification label: mal60.phis.win@21/65@26/9

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1972,i,7562493300872077349,7407348274101490423,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://atgroupbe.com/?mzbexmhu=bbd299e40cc6ba4977bf44a725eec5648bda7170169e3fbfd31a05747fa7276fd2437dda5a583d6a5ff345cb6fce6d6bd82e92021cc24ab98d2ebfffc47a5826&qrc=nmertens@vanas.eu"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1972,i,7562493300872077349,7407348274101490423,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Windows shortcut file (LNK) contains relative path

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior